WASHINGTON, June 28 (DC Times Online) — An odd envelope or package in the mail may look harmless, especially if it seems empty or does not match anything you ordered. But the U.S. Postal Inspection Service and the Federal Trade Commission say it can be part of a brushing scam — and if it includes a QR code, scanning it could put your personal information at risk.
What is a brushing scam?
The Postal Inspection Service says brushing scams are illegal in the United States. In this scheme, a seller sends items to people who did not order them. The seller usually gets the recipient’s address online.
The goal is not to trick the recipient into buying something. Instead, the seller wants to make the person look like a verified buyer. That can allow the seller to post fake positive reviews in the recipient’s name, the Postal Inspection Service says.
Why are QR codes part of the problem?
The FTC says some unexpected packages now include a QR code. It warns that this can be a newer twist on the brushing scam.
The code may claim to identify the sender or explain why the item arrived. But the FTC says scanning it can send a person to a phishing site that steals personal information or downloads malware.
The Postal Inspection Service says this QR-code version is sometimes called quishing. The agency says the codes may be placed inside brushing packages to get people to scan them.
What should you do if one arrives?
The safest move is simple: do not scan the code.
The Postal Inspection Service says people who receive unsolicited merchandise should report it to the Postal Inspection Service. It also says recipients may keep unsolicited merchandise by law. If the item is unopened and has a return address, it can be returned to the sender. If it is opened and safe to dispose of, it can be thrown away.
The service also advises people to change passwords and closely watch credit reports and credit card bills if they think personal information may have been exposed.
The USPS has also warned that people should not contact the sender, because that can confirm the address and lead to more unwanted packages.
Are all mystery mailings the same?
No. The warnings from federal agencies cover unexpected merchandise, parcels, packages and similar mailings. Some may be part of brushing scams. Others may be phishing attempts or malware traps that use a QR code as the hook.
The FBI has also warned that unsolicited packages with QR codes can be used to steal personal data or install malware.
The bottom line is that a mystery envelope is not just a curiosity. In some cases, it may be a scammer’s way of testing your address, building fake seller reviews or trying to lure you to a fake website. The best defense is to treat unexpected mail with caution and avoid scanning any code you do not trust.
