WASHINGTON, June 28 (DC Times Online) — An unexpected envelope or package in the mail can be more than a nuisance. The U.S. Postal Inspection Service says it may be part of a brushing scam, a scheme that uses your address to create fake sales and fake reviews.
The main warning from federal consumer agencies is simple: do not scan a QR code in mail you were not expecting. The Federal Trade Commission says a QR code in an unexpected package can send you to a phishing website that steals personal information or installs malware on your device.
What is a brushing scam?
The Postal Inspection Service says brushing scams are illegal in the United States and many other countries. In a brushing scam, someone receives merchandise they did not order or request. The sender is often an overseas third-party seller who found the person’s address online.
The goal is not to make a real sale. The Postal Inspection Service says the seller uses the recipient’s name and address to make it look like a real customer bought the item. That can help the seller post a fake positive review in the person’s name.
Why are QR codes a problem?
Some newer scams add a QR code to the mailing. The Postal Inspection Service says this variation is sometimes called quishing, a mix of “QR code” and “phishing.” The card or package may tell the recipient to scan the code to identify the sender or learn more about the company.
The FTC says that can be dangerous. Scanning the code may lead to a fake website designed to steal logins, payment information or other personal data. It can also trigger the download of malware.
What should you do if one shows up?
The Postal Inspection Service says recipients of unsolicited merchandise should report it to the Postal Inspection Service.
It also says people may keep unsolicited merchandise by law. If the item is unopened and has a return address, it can be returned to the sender. If it has been opened, it can be thrown away if it is safe to do so.
If you think your personal information may already have been exposed, the Postal Inspection Service says to change your passwords and watch your credit reports and credit card bills closely.
Consumer warnings also say not to contact the sender just to ask about the package. A USPS warning quoted in consumer coverage says doing that could confirm your address and lead to more unwanted mail.
How can you tell if it is suspicious?
A mystery mailing is worth a second look if:
- you did not order it
- it arrives with no clear reason
- it has a QR code asking you to scan for details
- the return address looks vague or incomplete
- it seems unrelated to any gift or purchase you made
Not every unexpected envelope means fraud. But the safest move is to treat it as suspicious until you can verify where it came from.
The bottom line
The Postal Inspection Service and the FTC both say the best defense is caution. Do not scan QR codes from mail you were not expecting. Do not share personal information with unknown senders. And if the mailing seems tied to a brushing scam, report it and keep an eye on your financial accounts.
