Empty envelopes in your mailbox? Do not scan that code

A plain white envelope shows up in your mailbox. It is addressed to you. It may even have a tracking number. The sender's name looks unfamiliar, but the delivery seems real. Then you open it. Nothing is inside. No note. No product. No explanation.

The bigger risk is what scammers hope you do next. If they can get you to scan a QR code, click a link, call a fake number or enter personal information, that strange envelope can turn into a much bigger problem.

Sign up for my FREE CyberGuy Report

Recent reports describe people receiving small white padded envelopes from unfamiliar or possibly fake sender names. Some people get them more than once. Others receive cheap trinkets, packing material or nothing at all.

That may seem like a strange nuisance. But to me, the bigger concern is this: Someone may already have your name and home address.

Scammers do not need to send you anything valuable. They only need a tracking number that shows something arrived at a real home. Here is how the scam often works:

A scammer gets your name and address from a data broker, public record, old breach or online leak. Then they create a fake order using your information. Next, they mail a cheap item or an empty envelope to your home.

After the delivery gets marked as complete, the seller can make it appear that you bought the product. A fake positive review may then appear under your name or account details. That helps bad sellers boost ratings and fool real shoppers. It also shows that your personal information may already be floating around, where scammers can grab it.

Some mystery packages now include a QR code. The message may sound harmless. It may say something like "scan to see who sent this gift" or "scan to verify delivery." Do not scan it.

A QR code is a hidden link. You cannot easily see where it leads before your phone reads it. Scammers know curiosity is powerful, especially when a package arrives with your name on it.

That is where the real financial risk begins. If you give scammers your login details or banking information, they may be able to take over accounts, make purchases or access payment apps.

If an envelope or package arrives, and you did not order it, do not panic. Treat it as a warning sign and take a few smart steps.

Even if the card says you need to scan it to identify the sender, skip it. Go directly to the retailer, shipper or official website yourself.

Scammers may include a fake customer service number or website inside the package. If you need to contact Amazon, Walmart, eBay, USPS, UPS or FedEx, type the official website into your browser or use the company's official app.

Log in directly to your Amazon, Walmart, eBay, TikTok Shop and other shopping accounts. Look for orders you do not recognize, strange reviews, changed addresses or unfamiliar payment methods.

Start with your email, shopping accounts and financial accounts. Use strong, unique passwords and consider using a password manager to create and store them safely. Do not reuse the same password across multiple sites. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

Report suspicious packages to the U.S. Postal Inspection Service at uspis.gov/report. You can also file a scam report with the FBI's Internet Crime Complaint Center at ic3.gov. If a retailer's name appears on the label, report it directly through that retailer's official site.

Scanning a QR code does not always mean your accounts are compromised. But if you entered information, downloaded an app or typed in a verification code, act quickly.

A good security tool can help block phishing websites, unsafe links and malicious downloads before they cause damage. We recommend using a strong antivirus software because it adds protection beyond basic virus scanning. It includes phishing protection, scam protection and web threat blocking for Windows, Mac, Android and iOS. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com

Brushing scams often start because your name, home address, phone number or other details are already online. Data brokers collect and sell this information. Scammers can use it to make their tricks feel more believable. A data removal service can help reduce your exposure by requesting that your personal information be removed from broker sites. We recommend using a good data removal service to help remove your personal information from data broker sites and reduce the amount of data scammers can use to target you. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

An empty envelope may look harmless, but it can be a sign that your personal information is already being misused. The most important move is to avoid anything inside the package that tries to pull you into another step. Do not scan QR codes from mystery packages. Do not call unknown numbers printed on cards. Do not enter personal information on a website you reached from a package you never ordered. Scammers are counting on curiosity. Slow down, go directly to official websites and secure your accounts before a strange envelope turns into a much bigger headache.

Have you received an empty envelope or mystery package you never ordered? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com.  All rights reserved.