WASHINGTON, June 28 (DC Times Online) — An unexpected envelope or package in the mail can be more than a nuisance. The U.S. Postal Inspection Service says some of these mailings are part of a brushing scam, an illegal scheme that can be used to create fake online reviews. The Federal Trade Commission says a QR code inside an unexpected package can be a new twist on that scam, and scanning it could send a person to a fake website or load malware onto a phone.
What is a brushing scam?
The Postal Inspection Service says brushing scams usually involve people receiving merchandise they did not order or request. The sender is often an international third-party seller who found the recipient’s address online.
The goal is not to sell the item itself. The Postal Inspection Service says the point is to make the recipient look like a verified buyer so the seller can post a positive review in that person’s name.
Why is the QR code a problem?
Some of the newer mailings include a QR code, often on a card tucked inside the package or envelope. The Postal Inspection Service says this variation is sometimes called “quishing,” which is a mix of QR code and phishing.
The warning is simple: do not scan a QR code just because it arrived in the mail. The FTC says an unexpected package with a QR code could be a scam and that scanning it may lead to a phishing site designed to steal personal information or install malware.
How should you handle an unwanted package?
The Postal Inspection Service says recipients can keep unsolicited merchandise under U.S. law. If the item is unopened and has a return address, it can be returned to the sender. If it has already been opened, it can be thrown away if it is safe to do so.
If the package or envelope seems suspicious, the Postal Inspection Service says to report it to the agency.
What if the mail may have exposed your personal data?
If you think a scammer may have gotten access to your information, the Postal Inspection Service says to change passwords and closely watch credit reports and credit card statements.
Consumer warnings also say not to contact the sender. That could confirm that your address is active and may lead to more unwanted mail.
The safest rule is a simple one: if the mail was not expected, treat any QR code inside it as suspicious and do not scan it.
