Thomas Dement of Wake Forest, North Carolina, is no stranger to online shopping deliveries.
But recently, he’s been inundated with packages that he didn’t order — and some don’t even have his name on them.
Don’t miss
- I’m 49 years old and have nothing saved for retirement — what should I do? Don’t panic. Here are 5 of the easiest ways you can catch up (and fast)
- Gain potential quarterly income through this $1B private real estate fund — even if you’re not a millionaire. Here’s how to get started with as little as $10
- Robert Kiyosaki warns of a ‘Greater Depression’ coming to the US — with millions of Americans going poor. But he says these 2 ‘easy-money’ assets will bring in ‘great wealth’. How to get in now
He has counted more than 20 of the odd deliveries so far — small padded envelopes delivered by the U.S. Postal Service and filled with things no one would buy on purpose: handfuls of gravel, scraps of paper, even a blank greeting card that simply read “Best Wishes.”
When Dement tried writing “return to sender” and dropping them back in the outgoing mail, the stream didn’t slow.
“It just seems like we’re in a loop where constantly things are being sent to us,” he told local reporters, wondering if his address “is out on the dark web somewhere.”
After posting photos in a neighborhood social media group, Dement learned he wasn’t alone; several neighbors said they’d received similar mystery mail. Commenters pointed him to what cyber‑fraud experts call a brushing scam.
“How do brushing scams work?”
A brushing scam is a marketing con that exploits e‑commerce review systems. A seller — usually an overseas third‑party shop using a big platform — finds a real U.S. address online, ships a feather‑light trinket to prove “delivery,” then posts a glowing “verified purchase” review in the recipient’s name to boost product rankings.
“We know that it’s prevalent all over the United States,” said Sgt. Kurt Steinberger of the Wake County Sheriff’s Office’s Property and Fraud Unit.
The person receiving the package is not in danger and is unlikely to be further targeted. However, officials do recommend keeping a close eye on your credit, just in case.
“What we tell people if they are a victim of such a scam, the best thing for them to do is report it to your local law enforcement,” he said. ”The second thing is to make sure you monitor your credit."
The Better Business Bureau warns that brushing complaints are rising, including reports that now feature QR codes inside the package. These are often part of "quishing" scams, or QR phishing scams.
The classic brushing envelope was annoying but largely harmless, but the new version isn’t. When curious people scan the QR code, the code can redirect victims to a spoofed retail site that phishes for login credentials or silently installs malware. This can result in a stolen identity, fraudulent charges, and other fraud, like tech support scams.
Read more: Want an extra $1,300,000 when you retire? Dave Ramsey says this 7-step plan ‘works every single time’ to kill debt, get rich in America — and that ‘anyone’ can do it
“What to do if you’re targeted by a brushing scam”
Random packages might seem harmless—and in most cases they are. However, it’s a sign your address is already in a scammer’s database. Here’s how to protect your personal data from being misused.
Never scan QR codes on packages you didn’t order
Treat every unsolicited code or customer service number as a potential phishing trap. If you receive a real item, the FTC says you can keep it, but don’t scan any codes, even those for a user’s manual.
Report the scam
File a complaint with Amazon, eBay, or the platform named on the shipping label (if any) so the fake review can be removed. Forward the tracking details to the U.S. Postal Inspection Service or your shipper’s fraud unit.
Check your cards
Check credit card statements and enable two‑factor authentication on major shopping sites; scammers sometimes reuse scraped data for identity theft rings. Setting up text or email notifications for purchases can also help you spot fraudulent purchases faster.
Consider a delivery pause
If the boxes pile up, USPS’s free “Hold Mail” service or a delivery locker can break the feedback loop and starve the scammer of new “deliveries" that allow them to leave fake reviews. While this won’t work for everyone, it can help in some situations.
As for Dement, he is now refusing to open the latest envelopes while hoping the scammers get tired of mailing gravel across the country. Until then, the best defense for him and everyone else is the simplest one: document, report, and never give the fraudsters the click (or scan) they’re counting on.
What to read next
- JPMorgan sees gold soaring to $6,000/ounce — use this 1 simple IRA trick to lock in those potential shiny gains (before it’s too late)
- This is how American car dealers use the ‘4-square method’ to make big profits off you — and how you can ensure you pay a fair price for all your vehicle costs
- Here are 5 ‘must have’ items that Americans (almost) always overpay for — and very quickly regret. How many are hurting you?
Like what you read? Join 200,000+ readers and get the best of Moneywise straight to your inbox every week. Subscribe for free.
This article provides information only and should not be construed as advice. It is provided without warranty of any kind.
