NewsNTech
Consumer protection investigators are warning that plain, unmarked envelopes arriving at residential addresses — sometimes empty, occasionally carrying a QR code — are functioning as entry points for a two-stage fraud scheme known as brushing.
The mechanics are straightforward: bad actors exploit real delivery confirmations to post fabricated verified-buyer reviews on major online marketplaces, while the QR code variant layers an active credential-theft risk on top of what might otherwise look like a minor nuisance.
The Brushing Mechanic and What the Envelope Actually Proves A third-party seller acquires a target's name and home address through data brokers, public records, or breach data, then creates a fake order under that person's details and ships a cheap item — or nothing at all.
Once the carrier marks the delivery complete, the seller can claim the recipient made a verified purchase and post a favorable review under that person's account credentials.
Keep reading