Beware of Empty Envelopes in the Mail

Imagine this: you get a plain white envelope in your mailbox, addressed to you. Maybe there’s a tracking number included. But you don’t recognize the sender. Curiosity kicks in as you open it—only to find it completely empty. No notes, no products, nothing at all.

This kind of mystery can spark intrigue, and that’s precisely what scammers are counting on. Authorities and consumer advocates are flagging this as a potential scam known as brushing. In worse cases, these empty deliveries might include a QR code designed to lead you to a fraudulent website or steal your personal data.

The real concern arises when you start wondering what the scammer’s next move will be. If they’re successful in getting someone to scan a QR code, click a link, or provide personal information, that innocuous envelope could signal a much larger problem.

What is Empty Envelope Fraud?

Empty envelope fraud usually falls into the category of brushing scams. This is when a third-party seller sends items—sometimes just an empty envelope—to a real address to make it look like an actual order has been completed.

Once a package is marked delivered, these shady sellers can leverage that record to post fake “Verified Buyer” reviews online. Such reviews make low-quality products appear more desirable than they really are. There have been accounts of individuals receiving small white padded envelopes from shady or fake senders, with some receiving these increasingly often. Others get meaningless trinkets or nothing at all.

It might seem like a minor annoyance, but for many, there’s an unsettling implication: it suggests that someone might already have access to your name and address.

Why Do Scammers Send Empty Envelopes?

Surprisingly, scammers don’t need to send valuable items to create confusion. They just need a tracking number to show that something has arrived at your address. Here’s how it typically unfolds:

Scammers obtain your personal information through data brokers, public records, past breaches, or online leaks. They then generate fake orders using this information. Cheap items or empty envelopes are dispatched to your home.

Once a delivery status indicates completion, the seller can create the illusion that the item has genuinely been purchased. Fraudulent positive reviews may then be posted under your name, boosting ratings for dishonest sellers while simultaneously putting your personal data at risk.

A Cautionary Twist with QR Codes

These days, some of these strange packages are including QR codes. You might encounter a message saying something benign like “Scan to see who sent this gift” or “Scan to confirm delivery.” But the advice here is clear—don’t scan it.

QR codes can lead to hidden links. It’s difficult to know where they are directing you before your phone reads them. Scammers leverage curiosity, especially with packages that appear to be intended for you.

If you scan it, you might end up at a fake website asking for your name, phone number, address, credit card info, or even your shopping account credentials. This is where your financial safety could be at risk. If you inadvertently share your banking details, the consequences could be severe.

Steps to Take if You Receive an Empty Envelope

Receiving an unexpected envelope or package can be disconcerting, but it’s essential to stay calm. Here are some practical steps you can take:

1) Avoid Scanning the QR Code

If the packaging urges you to scan it for sender identification, resist the temptation. Instead, navigate directly to the retailer’s or delivery company’s official website.

2) Don’t Call Unknown Phone Numbers

Scammers sometimes include bogus customer service numbers within the package. If you need to contact a well-known company, go to their official site or app directly.

3) Verify Your Shopping Account

Log into your Amazon, Walmart, or other shopping accounts. Look for unfamiliar orders, odd reviews, or changes to your address or payment methods.

4) Change Important Passwords

Begin by updating passwords for your email and shopping accounts. Use strong, unique passwords and consider keeping them in a password manager.

5) Enable Two-Factor Authentication (2FA)

2FA adds a layer of security, protecting your accounts further. If possible, opt for an authentication app over text messages for greater security.

6) Monitor Your Bank and Credit Card Statements

Look out for small, unfamiliar transactions or unexpected charges. If you see anything suspicious, contact your bank immediately.

7) Check Your Credit Report

If you suspect your identity is compromised, keep an eye on your credit report. You can place fraud alerts or freezes with major credit bureaus.

8) Report Suspicious Packages

Notify the U.S. Postal Inspection Service about questionable packages. You can also file a report with the FBI’s Internet Crime Complaint Center.

What If I’ve Already Scanned a QR Code?

If you’ve scanned one but didn’t share any personal information, you may be okay. However, if you submitted any details, now is the time to act:

• Close your browser window immediately.
• Refrain from entering further personal information.
• Change the password of any accounts you accessed.
• Enable two-factor authentication on those accounts.
• Keep an eye on your financial accounts for unusual activity.
• If you provided financial details, contact your bank.
• Run a security scan on your devices.
• Uninstall any apps you may have downloaded after scanning.
• Report the incident to the FBI and the FTC.
• Consider freezing your credit if sensitive info was shared.

Protect Yourself from Malicious Links and QR Codes

Using strong security tools can help you avoid phishing attempts, unsafe links, and harmful downloads before they cause issues. It’s wise to invest in reliable antivirus software that offers phishing and fraud protection, along with web threat blocking across various devices.

Limit Personal Data Available to Fraudsters

Brushing scams often start with the personal information that’s already out there. Data brokers collect and sell this information, which scammers exploit. Services that help remove your info from broker sites can be beneficial in limiting this exposure.

In Conclusion

An empty envelope may seem harmless, but it could signal that your personal data has already been compromised. Be cautious and resist any attempts to engage further with the package. Avoid scanning QR codes, don’t call unknown phone numbers, and steer clear of entering personal data from unfamiliar websites. Scammers thrive on curiosity. So, before an unusual envelope leads to more significant headaches, protect your information by going directly to official websites.

Have you encountered an empty envelope or mysterious package? Share your experience with us.