WASHINGTON, June 28 (DC Times Online) — A surprise envelope in the mailbox can be more than a nuisance. The U.S. Postal Inspection Service says some unexpected mail is tied to a scam called brushing, and the Federal Trade Commission warns that a QR code inside may be a trap that leads to fake websites, stolen information or malware.
The basic advice from federal consumer agencies is simple: If you did not order it, be careful with it — and do not scan any QR code just because it arrived in the mail.
What is a brushing scam?
The U.S. Postal Inspection Service says brushing scams are illegal and usually involve people receiving packages or parcels they did not order. The sender is often an international third-party seller who found the recipient’s address online.
The goal is not to send a gift. The goal is to make the recipient appear to be a verified buyer. That lets the seller post a fake positive review in the person’s name.
In other words, the package can be part of a ratings scam. The recipient may never have bought the item, but the seller can use the delivery to make a product look more popular or more trustworthy.
Why are QR codes part of the warning?
A newer variation has added QR codes, according to the Postal Inspection Service and the Federal Trade Commission.
The FTC says an unexpected package with a QR code could be a new twist on brushing. Scanning the code may send a person to a phishing website that tries to steal personal information or install malware.
The Postal Inspection Service says some cards with QR codes are being sent inside brushing packages under the false idea that the recipient should scan the code to identify the sender or learn more about the company. The agency warns that the code itself may be the danger.
QR codes are common, and many are harmless. But a code from an unknown sender can take a person to a fake login page, a bogus delivery page or another site designed to collect passwords, bank details or other sensitive information.
What should you do if the mail is not yours?
The Postal Inspection Service says recipients of unsolicited merchandise should report it to the Postal Inspection Service.
The agency also says people may keep unsolicited merchandise by law. If an unopened item has a return address, the Postal Inspection Service says it can be returned to the sender. If the item is opened and it is safe to do so, it can be disposed of.
If the package or envelope includes a QR code, the safest move is not to scan it.
The FTC says consumers should be cautious about any unexpected package with a code on it. The same warning applies to links, emails and text messages from senders you do not recognize.
What if your personal information may already be exposed?
The Postal Inspection Service says people who suspect their personal information may have been compromised should change passwords and closely monitor credit reports and credit card bills.
That advice is meant to catch fraud early. If a scammer has access to an account or enough personal data to try opening new ones, quick action can help limit the damage.
What about the FBI warnings people have seen online?
Recent consumer warnings attributed to the FBI say unsolicited packages with QR codes may be used to steal personal data or install malware. Those warnings also describe mystery packages without sender information as part of a brushing-scam variation.
The practical lesson is the same across the federal guidance: an unexpected package is not proof of a scam, but it is a reason to slow down, avoid scanning unknown codes and check whether the mail really came from a sender you trust.
The bottom line
If an unexpected envelope or package shows up in your mailbox, treat it as suspicious until you know where it came from. Do not scan a QR code just because it is there. Report unsolicited merchandise to the Postal Inspection Service, and if you think your information may be at risk, change your passwords and monitor your accounts closely.
