WASHINGTON, June 28 (DC Times Online) — If an unexpected envelope or package shows up in the mail, the safest move is simple: do not scan any QR code inside it until you know it is legitimate.
The U.S. Postal Inspection Service says some of these mailings may be part of a brushing scam, an illegal scheme in which someone sends merchandise that was never ordered. The goal is not to give away a free gift. The goal is to make it look like the recipient was a verified buyer, so the seller can post fake positive reviews in that person’s name.
What is a brushing scam?
In a brushing scam, a seller — often a third-party or international seller — gets a recipient’s address online and mails an item that was never requested. The Postal Inspection Service says the package may be used to create the appearance of a real sale. That can help the seller boost ratings and sales on online marketplaces.
The Federal Trade Commission says there is also a newer twist to watch for: a QR code tucked into an unexpected package. The agency warns that scanning the code could send a person to a phishing website designed to steal personal information or install malware.
Some warnings describe this QR-code variation as “quishing,” a mix of QR code and phishing. The Postal Inspection Service says cards with QR codes may be included in brushing packages and may claim to help identify the sender or provide more information about the company. In reality, the code could be the trap.
What should you do if one arrives?
The Postal Inspection Service says recipients should report unsolicited merchandise to the Postal Inspection Service. It also says people may keep unsolicited merchandise by law. If the item is unopened and has a return address, it can be returned to the sender. If it has been opened, it can be thrown away if it is safe to do so.
If a person thinks personal information may have been exposed, the Postal Inspection Service says to change passwords and watch credit reports and credit card statements closely.
USPS guidance quoted in consumer coverage also says not to contact the sender, because that could confirm your address and lead to more unwanted mail. Postal Inspector Brook Robinson has said people should report brushing packages and treat personal information “as if it were cash.”
Why this matters
These scams can look harmless at first. An empty envelope, a random box or a card with a code may seem like junk mail. But federal consumer agencies say the risk is real because one careless scan can send a person to a fake site or expose private data.
The bottom line is straightforward: if the mail was not expected, do not trust the QR code, do not click unknown links and report suspicious packages through the proper federal channels.
