WASHINGTON, June 28 (DC Times Online) — Federal consumer and postal authorities are warning Americans not to scan QR codes found in unexpected mail. The U.S. Postal Inspection Service says an odd envelope, card or package may be part of a brushing scam, a scheme that uses other people’s addresses to create fake purchases and fake positive reviews. The Federal Trade Commission says a QR code in unexpected mail can also be a phishing trap that sends a phone or computer to a fake website or loads malware.
What is a brushing scam?
The Postal Inspection Service says brushing scams are illegal in the United States. In a typical brushing scam, a third-party seller — often one based outside the country — gets an address online and sends merchandise the person never ordered. The point is not the item itself. The point is to make the recipient appear to be a verified buyer so the seller can post a positive review in that person’s name.
Why do some of these mailings include QR codes?
The Postal Inspection Service says a newer variation adds a QR code, sometimes called quishing, which is QR-code phishing. The mailing may tell the recipient to scan the code to identify the sender or learn more about the company. The FTC warns that scanning an unexpected code can send someone to a phishing website that steals personal information or to a download that installs malware.
What should someone do with it?
The Postal Inspection Service says not to scan an untrusted QR code or click unknown links. It also says recipients should report unsolicited merchandise to the Postal Inspection Service.
USPIS says people may keep unsolicited merchandise by law. If an item has a return address, it can be returned unopened. If it has been opened and is safe to throw away, it may be disposed of.
If someone thinks personal information may have been exposed, the Postal Inspection Service advises changing passwords and watching credit reports and credit card bills closely.
Do all mystery envelopes mean fraud?
No federal guidance says every unexpected envelope is a scam. But the warning from both agencies is clear: an unexpected mailing with a QR code should be treated as suspicious, and the code should not be scanned unless the sender and purpose are known.
The guidance does not identify who is behind any specific mailing campaign. What it does show is how a harmless-looking envelope or package can be used as a cover for fake reviews, phishing or malware.
