Empty envelopes in your mailbox? Do not scan that code

A plain achromatic envelope shows up successful your mailbox. It is addressed to you. It whitethorn adjacent person a tracking number. The sender's sanction looks unfamiliar, but the transportation seems real. Then you unfastened it. Nothing is inside. No note. No product. No explanation.

That would marque anyone curious. And that is precisely what scammers whitethorn beryllium counting on. Investigators and user extortion groups person warned that bare envelopes and enigma packages tin beryllium tied to a scam known arsenic brushing. In a much unsafe version, the bundle whitethorn see a QR codification that tries to nonstop you to a fake website oregon bargain your idiosyncratic information.

The bigger hazard is what scammers anticipation you bash next. If they tin get you to scan a QR code, click a link, telephone a fake fig oregon participate idiosyncratic information, that unusual envelope tin crook into a overmuch bigger problem.

Sign up for my FREE CyberGuy Report

• Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.
• For simple, real-world ways to spot scams aboriginal and enactment protected, sojourn CyberGuy.com - trusted by millions who ticker CyberGuy connected TV daily.
• Plus, you'll get instant entree to my Ultimate Scam Survival Guide escaped erstwhile you join. 

QR CODE SCAMS RISE AS 73% OF AMERICANS SCAN WITHOUT CHECKING 

A enigma envelope whitethorn look harmless, but it tin beryllium a motion that your sanction and code are already being utilized successful a brushing scam. (Kurt "CyberGuy" Knutsson)

What is the bare envelope scam?

The bare envelope scam is often connected to brushing. That is erstwhile a third-party seller sends a inexpensive item, oregon sometimes an bare envelope, to a existent person's code to marque it look similar a existent bid was delivered.

Once the bundle gets marked arsenic delivered, a shady seller whitethorn usage that transportation grounds to station a fake "verified buyer" reappraisal connected an online marketplace. Those reviews tin marque junk products look much fashionable than they truly are.

Recent reports picture radical receiving tiny achromatic padded envelopes from unfamiliar oregon perchance fake sender names. Some radical get them much than once. Others person inexpensive trinkets, packing worldly oregon thing astatine all.

That whitethorn look similar a unusual nuisance. But to me, the bigger interest is this: idiosyncratic whitethorn already person your sanction and location address.

Why scammers nonstop bare envelopes

Scammers bash not request to nonstop you thing valuable. They lone request a tracking fig that shows thing arrived astatine a existent home. Here is however the scam often works:

A scammer gets your sanction and code from a information broker, nationalist record, aged breach oregon online leak. Then they make a fake bid utilizing your information. Next, they message a inexpensive point oregon an bare envelope to your home.

After the transportation gets marked arsenic complete, the seller tin marque it look that you bought the product. A fake affirmative reappraisal whitethorn past look nether your sanction oregon relationship details. That helps atrocious sellers boost ratings and fool existent shoppers. It besides shows that your idiosyncratic accusation whitethorn already beryllium floating around, wherever scammers tin drawback it.

THE ONE THING SCAMMERS CHECK BEFORE TARGETING YOU ONLINE

Scammers whitethorn usage existent deliveries, bare envelopes oregon inexpensive items to make fake "verified buyer" reviews online. (Kurt "CyberGuy" Knutsson)

The QR codification twist makes this scam much dangerous

Some enigma packages present see a QR code. The connection whitethorn dependable harmless. It whitethorn accidental thing similar "scan to spot who sent this gift" oregon "scan to verify delivery." Do not scan it.

A QR codification is simply a hidden link. You cannot easy spot wherever it leads earlier your telephone reads it. Scammers cognize curiosity is powerful, particularly erstwhile a bundle arrives with your sanction connected it.

That QR codification whitethorn nonstop you to a fake website that asks for your name, telephone number, address, recognition card, slope login oregon buying relationship password. It whitethorn besides effort to instrumentality you into entering a one-time verification code.

That is wherever the existent fiscal hazard begins. If you springiness scammers your login details oregon banking information, they whitethorn beryllium capable to instrumentality implicit accounts, marque purchases oregon entree outgo apps.

What to bash if you person an bare envelope

If an envelope oregon bundle arrives and you did not bid it, bash not panic. Treat it arsenic a informing motion and instrumentality a fewer astute steps.

1) Do not scan immoderate QR code

Even if the paper says you request to scan it to place the sender, skip it. Go straight to the retailer, shipper oregon authoritative website yourself.

2) Do not telephone enigma telephone numbers

Scammers whitethorn see a fake lawsuit work fig oregon website wrong the package. If you request to interaction Amazon, Walmart, eBay, USPS, UPS oregon FedEx, benignant the authoritative website into your browser oregon usage the company's authoritative app.

3) Check your buying accounts

Log successful straight to your Amazon, Walmart, eBay, TikTok Shop and different buying accounts. Look for orders you bash not recognize, unusual reviews, changed addresses oregon unfamiliar outgo methods.

4) Change important passwords

Start with your email, buying accounts and fiscal accounts. Use strong, unsocial passwords and see utilizing a password manager to make and store them safely. Do not reuse the aforesaid password crossed aggregate sites. Check retired the champion expert-reviewed password managers of 2026 astatine Cyberguy.com

5) Turn connected two-factor authentication

Two-factor authentication, besides called 2FA, adds a 2nd measurement to your login truthful a password unsocial isn’t enough. Use an authenticator app erstwhile possible. It gives you stronger extortion than substance messages and makes it harder for a scammer to get into your accounts.

6) Watch your slope and recognition paper statements

Look for tiny trial charges, unfamiliar purchases, caller subscriptions oregon withdrawals you did not make. Report thing suspicious to your slope close away.

7) Check your recognition reports

If you deliberation your individuality whitethorn beryllium astatine risk, reappraisal your recognition reports. You tin besides see a fraud alert oregon recognition frost with Equifax, Experian and TransUnion.

8) Report the package

Report suspicious packages to the U.S. Postal Inspection Service astatine uspis.gov/report. You tin besides record a scam study with the FBI's Internet Crime Complaint Center at ic3.gov. If a retailer's sanction appears connected the label, study it straight done that retailer's authoritative site.

WARNING SIGNS YOUR MAIL HAS BEEN FRAUDULENTLY REDIRECTED

If an unexpected envelope includes a QR code, bash not scan it. Go straight to the retailer, shipper oregon authoritative website instead. (Kurt "CyberGuy" Knutsson)

What if you already scanned the QR code?

Scanning a QR codification does not ever mean your accounts are compromised. But if you entered information, downloaded an app oregon typed successful a verification code, enactment quickly.

• Close the browser model and halt utilizing the site.
• Do not participate immoderate much idiosyncratic oregon fiscal information.
• Change the password for immoderate relationship you entered and usage a password manager to make and store a strong, unsocial replacement.
• Turn connected two-factor authentication (2FA).
• Check your slope and recognition paper accounts for suspicious activity.
• Contact your slope if you entered outgo information.
• Run a information scan connected your telephone oregon machine with a beardown antivirus software.
• Delete immoderate app you installed from the QR code.
• Report the incidental to the FBI's Internet Crime Complaint Center astatine ic3.gov and the FTC astatine reportfraud.ftc.gov.
• If you entered your Social Security number, banking login oregon different delicate information, see freezing your credit.

Protect your telephone from malicious links and QR codes

A bully information instrumentality tin assistance artifact phishing websites, unsafe links and malicious downloads earlier they origin damage. We urge utilizing a beardown antivirus bundle due to the fact that it adds extortion beyond basal microorganism scanning. It includes phishing protection, scam extortion and web menace blocking for Windows, Mac, Android and iOS. Get my picks for the champion 2026 antivirus extortion winners for your Windows, Mac, Android & iOS devices astatine Cyberguy.com

Reduce the idiosyncratic information scammers tin use

Brushing scams often commencement due to the fact that your name, location address, telephone fig oregon different details are already online. Data brokers cod and merchantability this information. Scammers tin usage it to marque their tricks consciousness much believable. A information removal work tin assistance trim your vulnerability by requesting that your idiosyncratic accusation beryllium removed from broker sites. We urge utilizing a bully information removal work to assistance region your idiosyncratic accusation from information broker sites and trim the magnitude of information scammers tin usage to people you. Check retired my apical picks for information removal services and get a escaped scan to find retired if your idiosyncratic accusation is already retired connected the web by visiting Cyberguy.com

Kurt's cardinal takeaways

An bare envelope whitethorn look harmless, but it tin beryllium a motion that your idiosyncratic accusation is already being misused. The astir important determination is to debar thing wrong the bundle that tries to propulsion you into different step. Do not scan QR codes from enigma packages. Do not telephone chartless numbers printed connected cards. Do not participate idiosyncratic accusation connected a website you reached from a bundle you ne'er ordered. Scammers are counting connected curiosity. Slow down, spell straight to authoritative websites and unafraid your accounts earlier a unusual envelope turns into a overmuch bigger headache.

Have you received an bare envelope oregon enigma bundle you ne'er ordered? Let america cognize by penning to america astatine Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

• Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.
• For simple, real-world ways to spot scams aboriginal and enactment protected, sojourn CyberGuy.com - trusted by millions who ticker CyberGuy connected TV daily.
• Plus, you'll get instant entree to my Ultimate Scam Survival Guide escaped erstwhile you join.

Copyright 2026 CyberGuy.com.  All rights reserved.