WASHINGTON, June 28 (DC Times Online) — The U.S. Postal Inspection Service and the Federal Trade Commission are warning people not to scan QR codes that arrive in unexpected mail. The code may be part of a brushing scam, a phishing scheme called quishing, or another attempt to steal personal information or install malware.
What is a brushing scam?
The U.S. Postal Inspection Service says brushing happens when someone receives merchandise they did not order or request. The sender is often an international third-party seller who found the address online. The goal is to make the recipient look like a verified buyer so the seller can post a fake positive review in that person’s name. The Postal Inspection Service says brushing scams are illegal in the United States.
Why does the QR code matter?
A newer version of the scam uses a QR code, which is a square code that can be scanned with a phone camera. The Postal Inspection Service says cards with QR codes are being placed inside brushing packages under the pretense that the recipient should scan the code to identify the sender or learn more about the company.
The FTC says an unexpected package with a QR code could be a new twist on brushing scam. It warns that scanning the code could lead to a phishing website that steals personal information or downloads malware. The Postal Inspection Service calls this QR-code version quishing.
What should you do if one arrives?
Do not scan the code. Do not click unknown links that come with the mail. USPS guidance quoted in consumer reporting also warns against contacting the sender, because that could confirm your address and lead to more unwanted packages.
If the item is truly unsolicited, the Postal Inspection Service says you may keep the merchandise by law. If the package is unopened and has a return address, you can return it unopened. If it has been opened and it is safe to do so, you can dispose of it. In every case, report the mailing to the Postal Inspection Service.
What if you already scanned it?
If you scanned a QR code, clicked a link, or shared personal information, the Postal Inspection Service says to change your passwords and watch your credit reports and credit card bills closely. The goal is to catch fraud early if someone has used your information.
The FBI has also warned that unsolicited packages with QR codes can be used to steal data or install malware. In the warnings cited here, officials do not name a single sender or a specific criminal case. The risk is the same: an odd envelope or package can be bait.
How can you tell a scam from a normal delivery?
A real package usually comes from someone you know, a business you expect, or a shipment you ordered. An unexpected envelope, box, or parcel with no clear reason to be there deserves caution, especially if it asks you to scan a code.
The simplest rule is also the safest one: if you did not ask for the mail, do not trust the QR code until you know who sent it.
