MalwareZero

Rings and cheap jewelry in packages you didn't order

Updated August 6, 2026

The question isn't whether the ring is real. It's whether somebody has got into your accounts, and the answer is almost certainly no. An unordered ring or pendant, usually in a small red or velvet presentation box, nearly always means a brushing scam: the jewelry is worth close to nothing, you're legally entitled to keep it or throw it away, and neither of those is the interesting part. What actually matters is the card tucked in beside it, and the fact that your name and address are circulating on somebody's list.

Why it's so often jewelry

Brushing works by shipping something, anything, to a real US address so a seller can attach a review carrying a "verified purchase" badge. The seller pays for both the item and the postage, so the maths only works if the item is cheap. Jewelry fits that better than almost anything else.

You'll also see earbuds, phone grips, silicone kitchen gadgets, cheap tools, and seeds. The 2020 mystery seed shipments were declared as jewelry on their customs paperwork, which tells you which category the shippers thought looked normal. If seed is what arrived at your house, that's the one variant that needs reporting to a federal agency, and I've written up what to do with unordered seed packets separately.

Is it worth anything?

No. The US Postal Inspection Service has warned specifically about "diamond" rings turning up in fancy red boxes, set with inexpensive faux stones. When a jeweler examined one of these rings for a news outlet, the gemologist noted the stone was glued in rather than held by prongs, and identified it as cubic zirconia with no significant value.

Bands are typically plated base metal. Plating this thin wears through quickly, and if you react to nickel you probably won't enjoy wearing it for long. It isn't dangerous sitting in a drawer. It just isn't an asset. Paying for an appraisal would cost more than the ring, and any pawn shop will tell you the same thing for free.

You can keep it, and that isn't a loophole

Federal law is unusually blunt here. Under 39 U.S.C. 3009, merchandise mailed without your prior express request or consent may be treated as a gift, and you have "the right to retain, use, discard, or dispose of it in any manner without any obligation whatsoever to the sender." A postal inspector quoted in the USPIS alert put it more plainly: if you didn't order the package, you don't have to return it.

So ignore anything asking you to pay a fee, arrange a return, or confirm delivery before release. No bill is coming. If one shows up anyway, it's fake, and paying it is the actual loss event.

The card is the real payload

Older brushing packages contained only merchandise. Current ones frequently include two cards, one with company details and one carrying a QR code, and the code is framed as registering your gem, activating a warranty, claiming a second free gift, or leaving a review in exchange for a reward. It leads to a phishing page. The FBI's Internet Crime Complaint Center issued a public service announcement on exactly this pattern, "Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes," on July 31, 2025, alert number I-073125-PSA. Its advice includes not scanning QR codes from unknown origins and being careful about the permissions you grant to any site or app afterward.

Wording on the inserts varies a lot, but the ask stays the same shape. I've collected the versions I keep seeing on the page about the card inside the package.

How dangerous is scanning it, really

Less dangerous than most warnings imply, and Snopes made this point in a fact check back in December 2024. Pointing a camera at a code does not by itself empty a bank account or take over a phone. It opens a web page. The harm happens on that page, when you type a password, a card number, or a one-time code into a convincing copy of a real login screen, or when you approve an app install you shouldn't have.

That's not permission to scan it. It's a reason not to spiral if you already did and then closed the tab without entering anything. If you went further than that, the recovery steps are short and specific, and the first hour matters more than the first day.

Where they got your address

Almost always a data broker file, a breached customer list, or public records. Rarely a break-in on your accounts. That's the reassuring half and the annoying half at once: your name and address are cheap, widely traded, and outside your control. A brushing package is evidence they're in circulation, not evidence somebody is sitting inside your email.

Check anyway. Not because a hack is likely, but because fifteen minutes settles the question for good.

Reporting it, and whether that's worth the effort

Report to the FTC at reportfraud.ftc.gov or on 877-382-4357. If a QR code or a follow-up message was involved, file at ic3.gov as well, since that's where the FBI wants this pattern logged. Anyone aged 60 or over can also use the Justice Department's Elder Justice Hotline on 833-372-8311.

Will your individual report get your package traced? No, and I'd rather say that than pretend otherwise. Volume is what pushes marketplaces to purge seller accounts and what shapes the next agency alert. Filing is worth the four minutes. Nobody is knocking on a door overseas because of yours.

If they keep arriving

Repeat deliveries usually mean your address landed on a list several sellers are working from at once. There's no switch that turns it off. Removal requests with the bigger data brokers help somewhat and are tedious. Asking the marketplace to look at the accounts shipping to you sometimes helps more. The postal service won't stop delivering mail correctly addressed to you, so refusing at the door only works if you happen to catch the carrier. I couldn't find reliable data on how long these runs last, and reports vary from one package to a handful spread over a couple of months.

Packages addressed to a former resident or a deceased relative are the same scam with a stale list behind it. Write "not at this address, return to sender" on unopened mail and give it back to the carrier if you'd rather not keep it.

The delivery fee call that comes after the box

Watch the follow-up contact more closely than the package. A text about an unpaid delivery fee. A call about a shipping error that needs a refund processed over the phone. An email asking you to confirm card details for a return you never requested. Each one is an attempt to convert a delivery you already believe in into a payment or a login, and the package exists mainly to make that call sound plausible. The wider pattern is covered on the unordered packages page.

Going by what people report, a run like this lands somewhere between a single package and a handful spread over a couple of months, and then it stops. Six months from now the ring is still worth nothing and your address is still sitting in the same broker files, which is exactly what lets a different seller start the whole thing over. That part doesn't expire. The box never was the problem, so keep the ring, bin the ring, hand it to a kid as play jewelry. Just don't scan the card.