WASHINGTON, June 28 (DC Times Online) — An unexpected envelope or package in the mail may be more than a nuisance. The U.S. Postal Inspection Service and the Federal Trade Commission say it can be part of a brushing scam, or a newer QR-code trick that could put personal information at risk.
What is a brushing scam?
The Postal Inspection Service says brushing scams are illegal in the United States. In a brushing scheme, a person receives merchandise they did not order or request. The sender is often a third-party seller, sometimes overseas, that found the recipient’s address online.
The goal is not to surprise the recipient with a gift. The Postal Inspection Service says the purpose is to make the person look like a verified buyer so the seller can post a fake positive review in that person’s name.
In short, the seller wants to create the appearance of real sales and good feedback.
Why are QR codes part of the warning?
The Federal Trade Commission says an unexpected package with a QR code may be a new twist on the same scam. The FTC warns that scanning the code can send a person to a phishing website, where thieves may try to steal personal information or install malware.
The Postal Inspection Service says this QR-code variation is sometimes called quishing. In those cases, scammers put a card or other insert with a QR code inside the package and urge the recipient to scan it to identify the sender or learn more about the company.
Consumer warnings cited by the Postal Service and other federal agencies say people should be wary of any QR code in unsolicited mail, especially if the sender is unknown.
What should you do if one arrives?
The Postal Inspection Service says recipients of unsolicited merchandise should report it to the Postal Inspection Service. The agency also says people may keep unsolicited merchandise by law.
If the item has a return address, the Postal Inspection Service says it can be returned unopened. If it has been opened, it can be disposed of if it is safe to do so.
If you think your personal information may have been exposed, the Postal Inspection Service says to change passwords and watch credit reports and credit card bills closely.
Postal Service guidance quoted in consumer coverage also warns against contacting the sender. Doing that could confirm your address and may lead to more unwanted packages.
Should you scan the code just to see what it says?
Federal agencies say no. The FTC says an unexpected QR code can be part of a phishing attempt. U.S. Postal Inspector Brook Robinson, quoted in KSL coverage, said people should report brushing packages and never scan QR codes they do not trust.
Why does this matter?
Brushing scams can be annoying on their own. But the QR-code version raises the stakes because it can be used to collect personal data or infect a device with malware.
That is why federal consumer alerts say the safest move is simple: treat unexpected mail with caution, do not scan unknown codes, and report suspicious items to the proper agency.
The mail may look harmless. The code inside may not be.
