WASHINGTON, June 28 (DC Times Online) — An envelope or package that shows up out of nowhere can be more than a mail oddity. The U.S. Postal Inspection Service says some of these deliveries are part of a brushing scam, and the Federal Trade Commission says a QR code tucked inside an unexpected package can be a second trap.
The basic warning is simple: if you did not order it, do not assume it is harmless.
What is a brushing scam?
The U.S. Postal Inspection Service says brushing scams are illegal in the United States. In a brushing scheme, a seller sends a package or parcel to someone who did not order it. The seller usually finds the recipient’s address online.
USPIS says the goal is to make the recipient look like a verified buyer. That can let the seller post a fake positive review in the recipient’s name. In other words, the shipment helps create the appearance that a product has been bought and approved by a real customer.
What is the QR-code version?
USPIS says a newer variation, sometimes called quishing, uses QR codes. In some cases, cards with QR codes are sent inside brushing packages and tell the recipient to scan the code to identify the sender or learn more about the company.
The FTC warns that an unexpected package with a QR code could be a new twist on brushing. Scanning the code could send a person to a phishing website that steals personal information or installs malware.
Why is scanning the code risky?
A QR code can work like a shortcut to a website. If the code is fake or has been altered, it can send the user to a site designed to collect passwords, financial details or other personal data.
That is why consumer agencies say to treat a QR code from an unknown sender the same way they would treat an unknown link in a text message or email: with caution.
What should you do if one arrives?
USPIS says recipients of unsolicited merchandise should report it to the Postal Inspection Service. The agency also says people may keep unsolicited merchandise by law.
If the item is unopened and has a return address, USPIS says it may be returned to the sender. If it has been opened and it is safe to do so, it may be disposed of.
USPIS also says people who think their personal information may have been compromised should change passwords and closely watch credit reports and credit card bills.
Another important step: do not scan a QR code if you do not trust the source. Consumer warnings also say not to click unknown links.
USPS guidance quoted in consumer coverage adds one more caution: do not contact the sender. That could confirm your address and lead to more unwanted packages.
The bottom line is that an unexpected envelope is not always a scam, but a package that arrives without warning, especially one with a QR code, should be treated carefully. Federal consumer agencies say the safest move is to report it, avoid the code and protect your personal information.
