WASHINGTON, June 28 (DC Times Online) — An empty or unexpected envelope in the mailbox may be more than a nuisance. The U.S. Postal Inspection Service says some mystery mail is tied to a scam called brushing, and a newer version may use a QR code to push people to fake websites or malware.
What is a brushing scam?
The Postal Inspection Service says brushing scams are illegal in the United States. In a brushing scam, someone receives a package or parcel they did not order or request. The sender is often an overseas third-party seller that found the person’s address online.
The goal is not to send a gift. The Postal Inspection Service says the seller is trying to make the recipient look like a verified buyer so it can post fake positive reviews in that person’s name.
Why is the QR code a problem?
The Federal Trade Commission says an unexpected package with a QR code can be a new twist on brushing. The agency warns that scanning the code could send a person to a phishing website, where criminals may try to steal personal information, or it could download malware.
The Postal Inspection Service says some mailings now include cards or inserts with QR codes and tell the recipient to scan them to identify the sender or learn more about the company. The warning is simple: do not trust an unknown QR code just because it came in the mail.
What should you do if one shows up?
The Postal Inspection Service says recipients of unsolicited merchandise should report it to the agency. It also says people may keep unsolicited merchandise by law, return unopened items to the sender if there is a return address, or dispose of opened items if it is safe to do so.
If a person thinks personal information may have been exposed, the Postal Inspection Service says to change passwords and closely watch credit reports and credit card bills.
Should you contact the sender?
Consumer guidance quoted in reporting about USPS warnings says not to contact the sender. That could confirm your address and lead to more unwanted mail.
The safest rule
If a strange envelope, package or parcel arrives and it contains a QR code, the safest move is to treat it as suspicious. The FTC says do not scan an unexpected code. The Postal Inspection Service says to report the item and protect personal information before the problem spreads.
For most people, the best defense is simple: do not scan, do not click and do not assume mystery mail is harmless.
