May 23, 2025
Thomas Dement of Wake Forest, North Carolina, is no stranger to online shopping deliveries.
But recently, he's been inundated with packages that he didn't order — and some don't even have his name on them.
Advertisement
He has counted more than 20 of the odd deliveries so far — small padded envelopes delivered by the U.S. Postal Service and filled with things no one would buy on purpose: handfuls of gravel, scraps of paper, even a blank greeting card that simply read “Best Wishes.”
When Dement tried writing “return to sender” and dropping them back in the outgoing mail, the stream didn’t slow.
“It just seems like we’re in a loop where constantly things are being sent to us,” he told local reporters, wondering if his address “is out on the dark web somewhere.”
After posting photos in a neighborhood social media group, Dement learned he wasn’t alone; several neighbors said they’d received similar mystery mail. Commenters pointed him to what cyber‑fraud experts call a brushing scam.
“How do brushing scams work?”
A brushing scam is a marketing con that exploits e‑commerce review systems. A seller — usually an overseas third‑party shop using a big platform — finds a real U.S. address online, ships a feather‑light trinket to prove “delivery,” then posts a glowing “verified purchase” review in the recipient’s name to boost product rankings.
“We know that it’s prevalent all over the United States,” said Sgt. Kurt Steinberger of the Wake County Sheriff’s Office’s Property and Fraud Unit.
Advertisement
The person receiving the package is not in danger and is unlikely to be further targeted. However, officials do recommend keeping a close eye on your credit, just in case.
“What we tell people if they are a victim of such a scam, the best thing for them to do is report it to your local law enforcement,” he said. ”The second thing is to make sure you monitor your credit."
The Better Business Bureau warns that brushing complaints are rising, including reports that now feature QR codes inside the package. These are often part of "quishing" scams, or QR phishing scams.
The classic brushing envelope was annoying but largely harmless, but the new version isn't. When curious people scan the QR code, the code can redirect victims to a spoofed retail site that phishes for login credentials or silently installs malware. This can result in a stolen identity, fraudulent charges, and other fraud, like tech support scams.
Must Read
- Dave Ramsey warns nearly 50% of Americans are making 1 big Social Security mistake — here’s what it is and the simple steps to fix it ASAP
- Robert Kiyosaki begs investors not to miss this ‘explosion’ — says this 1 asset will surge 400% in a year
- Vanguard reveals what could be coming for U.S. stocks, and it’s raising alarm bells for retirees. Here’s why and how to protect yourself
Join 250,000+ readers and get Moneywise’s best stories and exclusive interviews first — clear insights curated and delivered weekly. Subscribe now.
“What to do if you're targeted by a brushing scam”
Random packages might seem harmless—and in most cases they are. However, it's a sign your address is already in a scammer's database. Here's how to protect your personal data from being misused.
Never scan QR codes on packages you didn't order
Treat every unsolicited code or customer service number as a potential phishing trap. If you receive a real item, the FTC says you can keep it, but don't scan any codes, even those for a user's manual.
Report the scam
File a complaint with Amazon, eBay, or the platform named on the shipping label (if any) so the fake review can be removed. Forward the tracking details to the U.S. Postal Inspection Service or your shipper’s fraud unit.
Check your cards
Check credit card statements and enable two‑factor authentication on major shopping sites; scammers sometimes reuse scraped data for identity theft rings. Setting up text or email notifications for purchases can also help you spot fraudulent purchases faster.
Consider a delivery pause
If the boxes pile up, USPS’s free “Hold Mail” service or a delivery locker can break the feedback loop and starve the scammer of new “deliveries" that allow them to leave fake reviews. While this won't work for everyone, it can help in some situations.
As for Dement, he is now refusing to open the latest envelopes while hoping the scammers get tired of mailing gravel across the country. Until then, the best defense for him and everyone else is the simplest one: document, report, and never give the fraudsters the click (or scan) they’re counting on.
You May Also Like
- Turning 50 with $0 saved for retirement? Most people don’t realize they’re actually just entering their prime earning decade. Here are 6 ways to catch up fast
- This 20-year-old lotto winner refused $1M in cash and chose $1,000/week for life. Now she’s getting slammed for it. Which option would you pick?
- Warren Buffett used these 8 repeatable money rules to turn $9,800 into a $150B fortune. Start using them today to get rich (and stay rich)
- Here are 5 easy ways to own multiple properties like Bezos and Beyoncé. You can start with $10 (and no, you don’t have to manage a single thing)
Danielle is a personal finance writer based in Ohio. Her work has appeared in numerous publications including Motley Fool and Business Insider. She believes financial literacy key to helping people build a life they love.
