WASHINGTON, June 28 (DC Times Online) — An unexpected envelope or package in the mail can be more than a nuisance. The U.S. Postal Inspection Service says it can be part of a brushing scam, a scheme in which a seller sends items to people who did not order them, often after finding an address online. The goal is to make the recipient look like a verified buyer so the seller can post fake positive reviews in that person’s name.
A newer twist involves QR codes. The Postal Inspection Service says some brushing mailings now include a card or label that tells the recipient to scan a code to learn who sent it or to get more information. The Federal Trade Commission warned that scanning a QR code from an unexpected package can send a person to a phishing site or trigger malware.
What is a brushing scam?
In a brushing scam, the item itself is usually not the point. The point is to create false sales activity and boost an online seller’s reputation. USPIS says the practice is illegal in the United States. The scam can involve packages, parcels or other surprise mailings, and the address on the item may have been pulled from the internet.
Why is the QR code risky?
A QR code is a square barcode that a phone camera can read. When people scan a trusted code from a restaurant menu or a known business, it can be harmless. But when a code arrives in mail that was never ordered, consumer protection officials say it should be treated with caution.
USPIS says the QR-code version of the scam is sometimes called “quishing.” The FTC says an unexpected code could lead to a fake website designed to steal personal information. It could also download harmful software onto a phone or computer.
What should you do if one arrives?
USPIS says recipients of unsolicited merchandise may keep it by law. If the item is unopened and marked with a return address, it can be sent back. If it has already been opened, it can be thrown away if it is safe to do so. The main step is to report the unsolicited merchandise to the Postal Inspection Service.
If you think the mailing or code may have exposed your information, USPIS says to change passwords and watch credit reports and credit card statements closely.
The safest rule is simple: do not scan a QR code from unexpected mail. If the item was not ordered, the code should be treated as a possible scam, not a useful link.
