WASHINGTON, June 28 (DC Times Online) — An unexpected envelope or package in the mailbox may look harmless. But federal consumer agencies say the real risk can be the QR code tucked inside.
The U.S. Postal Inspection Service says brushing scams are illegal in the United States. In a brushing scam, a person receives merchandise they did not order. The sender is often a third-party seller who found the address online and wants to make the recipient look like a verified buyer. That lets the seller post a fake positive review in the recipient’s name.
The Federal Trade Commission says some of these mailings now include QR codes, which turns the scam into a phishing risk. Scanning an unexpected code can send a person to a fake website or install malware on a phone or computer.
What is brushing?
Brushing is a scam built around fake sales. The package itself may contain a cheap item, an empty insert, or a card telling the recipient to scan a code or learn more about the sender.
The Postal Inspection Service says the point is not to give the recipient a gift. It is to create the appearance of a real purchase so the seller can boost its ratings on online marketplaces.
Why is the QR code dangerous?
The Postal Inspection Service says a newer version of the scam, sometimes called quishing, uses QR codes instead of links printed in the mail.
The FTC warns that an unexpected package with a QR code could be a new twist on brushing. The code may lead to a phishing page designed to steal personal information or download malware.
In some versions of the scam, the mailing says the code should be scanned to identify the sender or learn more about the company. Consumer agencies say that instruction should be treated with caution if the package was not expected.
What should someone do if one arrives?
The Postal Inspection Service says people who receive unsolicited merchandise should report it to the Postal Inspection Service.
It also says recipients may keep unsolicited merchandise by law. If the item is unopened and has a return address, it may be returned to the sender. If it has been opened, it can be discarded if it is safe to do so.
USPS guidance also warns against contacting the sender. That could confirm the address and lead to more unwanted packages.
If someone thinks personal information may have been exposed, the Postal Inspection Service says to change passwords and closely watch credit reports and credit card bills.
What is the bottom line?
A mystery envelope or package is not automatically a scam. But if it arrives out of the blue and includes a QR code, federal agencies say the safest move is simple: do not scan it. Treat it like any other suspicious message asking for personal information — and report it instead of engaging with it.
