WASHINGTON, June 28 (DC Times Online) — An unexpected envelope, package or card in the mail can be more than a nuisance. Federal consumer agencies say some of it may be tied to a brushing scam, a scheme that uses your address to make it look as if you bought something you never ordered.
The U.S. Postal Inspection Service says brushing scams are illegal in the United States. In the typical version, a seller — often a third-party seller using an address found online — sends merchandise to a person who did not order it. The point is not the item itself. The point is to make that person appear to be a verified buyer so the seller can post a fake positive review in the person’s name.
What makes the QR code version dangerous?
The Postal Inspection Service says a newer variation, sometimes called quishing, uses QR codes. A QR code is the square barcode that can be scanned with a phone camera.
In these mailings, the code may be presented as a way to identify the sender or learn more about a company. But the Postal Inspection Service says that is exactly what makes it risky. The Federal Trade Commission warns that a QR code on an unexpected package could send a person to a phishing website, where criminals try to steal personal information, or could trigger a download of malware.
That is why the safest advice is simple: if the mail was not expected and the QR code is not clearly from a trusted source, do not scan it.
What should someone do if suspicious mail arrives?
The Postal Inspection Service says recipients of unsolicited merchandise should report it to the Postal Inspection Service. The agency also says people may keep unsolicited merchandise by law. If the item is unopened and has a return address, it can be returned to the sender. If it has been opened, it can be disposed of if it is safe to do so.
If there is any chance personal information was exposed, the Postal Inspection Service says to change passwords and closely watch credit reports and credit card bills.
Why this matters even if the envelope seems harmless
Brushing scams are not only about fake reviews. They can also be used to test whether an address is active and to lure a person into interacting with a bogus QR code. That makes an ordinary-looking piece of mail a possible entry point for fraud.
The basic rule from federal consumer guidance is to treat unexpected mail with caution. Do not scan unknown QR codes. Do not assume the envelope is safe just because it is small, blank or looks ordinary. And if the item was never ordered, the Postal Inspection Service says it may be part of a brushing scam.
