Empty envelope scam explained and how to protect your personal data

A plain white envelope appears in your mailbox. It appeals to you. There may even be a tracking number. The sender’s name doesn’t sound familiar, but the delivery appears to be genuine. Then you open it. There is nothing inside. No notes. No product. No explanation.

This arouses everyone’s curiosity. This is exactly what scammers rely on. Investigators and consumer protection groups have warned that empty envelopes and mystery packages may be linked to a scam known as brushing. In a more dangerous version, the package may contain a QR code that tries to send you to a fake website or steal your personal information.

The bigger risk is what the scammers hope you do next. If they can make you scan a QR code, click a link, call a fake number, or enter your personal information, that weird envelope could turn into a much bigger problem.

Sign up for my FREE CyberGuy Report

• Get my best tech tips, urgent safety alerts and special deals straight to your inbox.
• For simple, real-world ways to spot scams early and stay protected, visit: CyberGuy.com – Trusted by millions of people who watch CyberGuy on TV every day.
• Additionally, you will have instant access to my information. The Ultimate Scam Survival Guide It’s free when you join.

QR CODE SCAMS ARE INCREASING AS 73% OF AMERICANS SCAN IT WITHOUT CHECKING

What is empty envelope fraud?

Empty envelope scams are often linked to: scrub. This is when a third-party seller ships a cheap item, or sometimes an empty envelope, to a real person’s address to make it look like a real order has been delivered.

Once the package is marked as delivered, a suspicious seller can use this delivery record to post a fake “verified buyer” review on an online marketplace. These reviews can make junk products appear more popular than they actually are.

Recent reports are reporting people receiving small white padded envelopes with unfamiliar or possibly fake sender names. Some people get them more than once. Others buy cheap trinkets, packaging materials, or nothing at all.

This may seem like a strange annoyance. But to me, the bigger concern is this: Someone might already know your name and home address.

Why do scammers send empty envelopes?

Scammers don’t need to send you anything of value. They just need a tracking number to show that something has arrived at an actual home. The scam usually works like this:

The scammer obtains your name and address from a data broker, public records, an old breach, or online leak. They then use your information to create a fake order. Then they send a cheap item or an empty envelope to your home.

Once the delivery is marked as completed, the seller can show it as if you purchased the item. A fake positive review may then appear under your name or account details. This helps bad sellers increase their ratings and deceive real customers. It also indicates that your personal information may be floating around and could fall into the hands of fraudsters.

THE ONE THING SCAMMERS CHECK BEFORE TARGETING YOU ONLINE

Scammers may use genuine deliveries, empty envelopes or cheap items to create fake “verified buyer” reviews online. (Kurt “CyberGuy” Knutsson)

Changing the QR code makes this scam more dangerous

Some mystery packages now include a QR code. The message may seem harmless. It might say something like “Scan to see who sent this gift” or “Scan to verify delivery.” Do not scan.

QR code is a hidden link. You can’t easily see where it’s going unless your phone reads it. Scammers know curiosity is powerful, especially when a package arrives with your name on it.

This QR code may send you to a fake website that asks for your name, phone number, address, credit card, bank login information, or shopping account password. It may also try to trick you into entering a one-time verification code.

This is where the real financial risk begins. If you give scammers your login or banking information, they can hijack accounts, make purchases, or access payment apps.

What should you do if you receive an empty envelope?

If an envelope or package arrives and you didn’t order it, don’t panic. Treat this as a warning sign and take a few smart steps.

1) Do not scan any QR codes

Even if the card says you need to scan it to identify the sender, skip it. Go directly to the retailer, shipper or official website yourself.

2) Do not call private phone numbers

Scammers may include a fake customer service number or website inside the package. If you need to contact Amazon, Walmart, eBay, USPS, UPS or FedEx, type the official website into your browser or use the company’s official app.

3) Check your shopping accounts

Log in directly to your Amazon, Walmart, eBay, TikTok Shop and other shopping accounts. Look for orders you don’t recognize, strange reviews, changing addresses or unfamiliar payment methods.

4) Change important passwords

Start with your email, shopping accounts, and financial accounts. Use strong, unique passwords and consider using a password manager to create and store them securely. Don’t reuse the same password on multiple sites. Check out the best expert-reviewed password managers of 2026 at: cyberguy.com

5) Turn on two-factor authentication

Also called two-factor authentication 2FAIt adds a second step to your login information, so password alone is not enough. use one authenticator app whenever possible. It gives you stronger protection from text messages and makes it harder for fraudsters to break into your accounts.

6) Monitor your bank and credit card statements

To call small testing feesunusual purchases, new subscriptions or withdrawals you did not make. Report any suspicious situations to your bank immediately.

7) Check your credit reports

If you think your identity may be at risk, review your credit reports. You may also consider a fraud alert or credit freeze With Equifax, Experian and TransUnion.

8) Report the package

Report suspicious packages to the US Postal Inspection Service at: uspis.gov/report. You can also file a fraud report with the FBI’s Internet Crime Complaint Center. ic3.gov. If a retailer’s name appears on the label, report it directly through that retailer’s official site.

WARNING SIGNS THAT YOUR MAIL IS BEING FRAUDULENT

If there is a QR code on an unexpected envelope, do not scan it. Instead, go directly to the retailer, carrier, or official website. (Kurt “CyberGuy” Knutsson)

But what if you’ve already scanned the QR code?

Scanning a QR code doesn’t always mean your accounts have been compromised. But if you’ve entered information, downloaded an app, or typed a verification code, act quickly.

• Close the browser window and stop using the site.
• Do not enter any more personal or financial information.
• Change the password of any account you log into and password manager to create and store a powerful, unique backup.
• Turn on two-factor authentication (2FA).
• Check your bank and credit card accounts for suspicious activity.
• If you entered payment information, contact your bank.
• Run a security scan on your phone or computer with strong antivirus software.
• To delete any application You install it from the QR code.
• Report the incident to the FBI’s Internet Crime Complaint Center. ic3.gov and at the FTC reportfraud.ftc.gov.
• If you entered your Social Security number, bank login information, or other sensitive information, consider freezing your credit.

Protect your phone from malicious links and QR codes

A good security tool can help block phishing websites, unsafe links, and malicious downloads before they can do harm. We recommend Using strong antivirus software because it provides protection beyond basic virus scanning. Includes phishing protection, fraud protection, and web threat blocking for Windows, Mac, Android, and iOS. Get my picks for the 2026 winners for the best antivirus protection for your Windows, Mac, Android, and iOS devices at: cyberguy.com

Reduce personal data available to fraudsters

Tooth brushing scams often start because your name, home address, phone number or other information is already online. Data brokers collect and sell this information. Scammers can use this to make their tricks more believable. A data removal service can help you reduce your risk of exposure by requesting removal of your personal information from broker sites. We recommend using a good data removal service to help remove your personal information from data broker sites and reduce the amount of data scammers can use to target you. Check out my top picks for data removal services and run a free scan to see if your personal information is already on the internet by visiting: cyberguy.com

Kurt’s important takeaways

An empty envelope may seem harmless, but it could be a sign that your personal information has already been misused. The most important move is to avoid anything in the package that tries to pull you into another step. Don’t scan QR codes on mysterious packages. Do not call unknown numbers written on the cards. Do not enter your personal information on a website you access from a package you never ordered. Scammers rely on curiosity. Slow down, go directly to their official website and secure your accounts before an awkward envelope turns into a much bigger headache.

Have you ever received an empty envelope or mystery package that you never ordered? Let us know by writing to us. cyberguy.com

CLICK TO DOWNLOAD FOX NEWS APPLICATION

Sign up for my FREE CyberGuy Report

• Get my best tech tips, urgent safety alerts and special deals straight to your inbox.
• For simple, real-world ways to spot scams early and stay protected, visit: CyberGuy.com – Trusted by millions of people who watch CyberGuy on TV every day.
• Additionally, you will have instant access to my information. The Ultimate Scam Survival Guide It’s free when you join.

Copyright 2026 CyberGuy.com. All rights reserved.