Thomas Dement of Wake Forest, North Carolina, is no stranger to online shopping deliveries.
But recently, he's been inundated with packages that he didn't order — and some don't even have his name on them.
He has counted more than 20 of the odd deliveries so far — small padded envelopes delivered by the U.S. Postal Service and filled with things no one would buy on purpose: handfuls of gravel, scraps of paper, even a blank greeting card that simply read “Best Wishes.”
Thanks for subscribing!
The money news that actually matters.
By signing up, you accept Moneywise Terms of Use, Subscription Agreement, and Privacy Policy.
When Dement tried writing “return to sender” and dropping them back in the outgoing mail, the stream didn’t slow.
“It just seems like we’re in a loop where constantly things are being sent to us,” he told local reporters, wondering if his address “is out on the dark web somewhere.”
After posting photos in a neighborhood social media group, Dement learned he wasn’t alone; several neighbors said they’d received similar mystery mail. Commenters pointed him to what cyber‑fraud experts call a brushing scam.
“How do brushing scams work?”
A brushing scam is a marketing con that exploits e‑commerce review systems. A seller — usually an overseas third‑party shop using a big platform — finds a real U.S. address online, ships a feather‑light trinket to prove “delivery,” then posts a glowing “verified purchase” review in the recipient’s name to boost product rankings.
“We know that it’s prevalent all over the United States,” said Sgt. Kurt Steinberger of the Wake County Sheriff’s Office’s Property and Fraud Unit.
The person receiving the package is not in danger and is unlikely to be further targeted. However, officials do recommend keeping a close eye on your credit, just in case.
“What we tell people if they are a victim of such a scam, the best thing for them to do is report it to your local law enforcement,” he said. ”The second thing is to make sure you monitor your credit."
The Better Business Bureau warns that brushing complaints are rising, including reports that now feature QR codes inside the package. These are often part of "quishing" scams, or QR phishing scams.
The classic brushing envelope was annoying but largely harmless, but the new version isn't. When curious people scan the QR code, the code can redirect victims to a spoofed retail site that phishes for login credentials or silently installs malware. This can result in a stolen identity, fraudulent charges, and other fraud, like tech support scams.
Must Read
- Jeff Bezos backs a platform that lets anyone invest in rental homes for as little as $100 — 6 ways to build wealth like a landlord without actually being one
- The tax breaks in Trump's 'big beautiful bill' expire after 2028. Here are 4 moves to make before the window closes
“What to do if you're targeted by a brushing scam”
Random packages might seem harmless—and in most cases they are. However, it's a sign your address is already in a scammer's database. Here's how to protect your personal data from being misused.
Never scan QR codes on packages you didn't order
Treat every unsolicited code or customer service number as a potential phishing trap. If you receive a real item, the FTC says you can keep it, but don't scan any codes, even those for a user's manual.
Report the scam
File a complaint with Amazon, eBay, or the platform named on the shipping label (if any) so the fake review can be removed. Forward the tracking details to the U.S. Postal Inspection Service or your shipper’s fraud unit.
Check your cards
Check credit card statements and enable two‑factor authentication on major shopping sites; scammers sometimes reuse scraped data for identity theft rings. Setting up text or email notifications for purchases can also help you spot fraudulent purchases faster.
Consider a delivery pause
If the boxes pile up, USPS’s free “Hold Mail” service or a delivery locker can break the feedback loop and starve the scammer of new “deliveries" that allow them to leave fake reviews. While this won't work for everyone, it can help in some situations.
As for Dement, he is now refusing to open the latest envelopes while hoping the scammers get tired of mailing gravel across the country. Until then, the best defense for him and everyone else is the simplest one: document, report, and never give the fraudsters the click (or scan) they’re counting on.
You May Also Like
- Dave Ramsey warns nearly 50% of Americans are making 1 big Social Security mistake — here’s what it is and 3 simple steps to fix it ASAP
- A single line on your car insurance policy could be inflating your premium by up to 30% — here's what to change
Danielle is a personal finance writer whose work has appeared in publications including Motley Fool and Business Insider. She believes financial literacy key to helping people build a life they love. She’s especially passionate about helping families and kids learn smart money habits early.
