WASHINGTON, June 28 (DC Times Online) — If an unfamiliar envelope or package shows up in your mailbox, federal consumer officials say the safest first step is simple: do not scan any QR code inside it.
The U.S. Postal Inspection Service says some of these mailings are part of a brushing scam, an illegal scheme in which a seller sends unordered items to a real address. The point is not to give the recipient a gift. It is to make that person look like a verified buyer so the seller can post fake positive reviews in the recipient’s name.
The Federal Trade Commission says some of these mailings may now include a QR code, which is a square barcode that a phone camera can read. In this newer twist, sometimes called quishing, the code can send a person to a fake website. The FTC warns that site could try to steal personal information or install malware, which is harmful software that can damage a device or spy on data.
What is a brushing scam?
Brushing scams usually start with an item you did not order and do not recognize. The U.S. Postal Inspection Service says the sender is often an international third-party seller who found the address online. By sending a real package to that address, the seller can make it seem as if a customer received and liked the product, even if the person never bought it.
That fake activity can make online ratings look better than they really are. The recipient may not lose money right away, but the scam can be a sign that an address or other personal information has been exposed.
Why are QR codes a problem?
QR codes are convenient when they come from a trusted source. But in a suspicious mailing, the code can be the trap.
The FTC says an unexpected package with a QR code may be a new twist on brushing. Scanning the code could lead to a phishing site, which is a fake page designed to trick people into entering passwords, bank details or other personal information. It can also trigger a download of malware.
That is why officials say the code should be treated like any other unknown link: if the source is not trusted, do not open it.
What should you do if one arrives?
The Postal Inspection Service says recipients of unsolicited merchandise should report it to the agency.
The service also says people may keep unsolicited merchandise by law. If the item is unopened and has a return address, it can be returned to the sender. If it has been opened and it is safe to do so, it can be disposed of.
If you think personal information may have been compromised, the Postal Inspection Service says to change passwords and closely monitor credit reports and credit card bills.
The simple rule
An unexpected envelope or package with a QR code is not something to rush to scan. Federal officials say the safer move is to treat it as suspicious, avoid the code and report the mailing through the Postal Inspection Service.
