A new scam involving empty white envelopes, known as brushing scams, is targeting consumers by using their information to post fake reviews and install malware via QR codes. Additionally, social media platforms like Facebook and Instagram are rife with job and investment scams that have cost victims billions. Learn how these scams work and how to protect yourself effectively.
Have you recently received an empty white envelope in the mail with your name and address on it? This seemingly harmless package is part of a new and disturbing scam known as a "brushing scam," which is rapidly spreading in 2026.
The scam involves sending you a mysterious white envelope, often with a barcode and your personal details, but containing nothing inside. Sometimes, the package may include small items like hair clips or baseballs, but often it is completely empty.
The purpose of this scam is twofold:
Fake Verified Buyer Reviews: When you receive a package, you become a "verified buyer" on platforms like Amazon, Walmart, or eBay. Scammers use your verified buyer status to post fake positive reviews under your name, boosting the ratings and sales of their products.
Malware and Spyware Installation: Many of these envelopes contain QR codes. If you scan the QR code out of curiosity, it can lead to phishing sites or install malware and spyware on your phone or computer, allowing scammers to monitor your activities and steal sensitive information.
By accepting the package, scammers confirm your address and name are valid, making you a target for further scams. The malware installed via QR codes can capture everything you type, potentially draining your bank accounts and compromising your identity.
Social media platforms, especially those owned by Meta (Facebook, Instagram, WhatsApp), have become hotbeds for scams, with billions of dollars lost annually.
Scammers prey on vulnerable job seekers by offering fake remote jobs, often involving placing ads or managing accounts. Victims are asked to transfer money to crypto platforms or digital wallets, which scammers then steal.
Dawn Forseth, a cyber-trained professional, lost $176,000 after being scammed by a fake Facebook job offer involving ad placements and crypto transfers.
Scammers pose as investment experts on platforms like WhatsApp, convincing victims to invest in cryptocurrency or other schemes. These scams have cost victims over $1 billion.
Jerry and Mindy Dunaway lost $800,000 after investing in a fraudulent crypto opportunity contacted through WhatsApp.
Arjun Bhatnagar, co-founder of Cloak, explains a technique called "data poisoning," which involves providing misleading or virtual information to confuse scammers and AI systems harvesting your data.
If you receive an unsolicited package:
The FBI has issued a warning about a new scam targeting Microsoft 365 users (Outlook, OneDrive).
You may encounter pop-up messages claiming your computer is infected and urging you to call a support number.
The world of scams is evolving rapidly, using sophisticated methods to steal your money and personal information. Staying informed and cautious is your best defense.
By following these guidelines, you can protect yourself and your loved ones from falling victim to these scams.
