WASHINGTON, June 28 (DC Times Online) — Federal consumer and postal agencies say an unexpected envelope or package in the mail can be more than a nuisance. The U.S. Postal Inspection Service says one common tactic is a brushing scam: a seller sends items people did not order, often after finding their address online, so the seller can post fake positive reviews under the recipient’s name.
In a newer twist, the Postal Inspection Service says some of those mailings include a QR code. The code may be part of what the agency calls “quishing,” a scam that uses QR codes to send people to fake websites.
What is a brushing scam?
The Postal Inspection Service says brushing scams are illegal in the United States. In a brushing scheme, someone receives merchandise they never requested. The sender is often a third-party seller, sometimes based outside the United States, that uses the recipient’s name and address to make it look as if the person made a real purchase.
The goal is simple: make the recipient appear to be a verified buyer. That can let the seller leave a glowing review in the person’s name and give the product a better online rating.
Why does the QR code matter?
The Federal Trade Commission says an unexpected package with a QR code could be a new version of brushing. The concern is that the code may not identify the sender at all. Instead, it can lead to a phishing website designed to steal personal information or install malware.
That is why consumer agencies say the safest move is not to scan a QR code just because it arrived in the mail.
What should you do if one arrives?
The Postal Inspection Service says people who receive unsolicited merchandise should report it to the agency.
It also says recipients may keep unsolicited merchandise by law. If the item is unopened and has a return address, the agency says it can be returned to the sender. If the item has been opened and it is safe to do so, it can be disposed of.
If there is any chance personal information was exposed, the Postal Inspection Service says to change passwords and keep a close watch on credit reports and credit card bills.
Should you contact the sender?
USPS guidance quoted in consumer coverage says not to contact the sender directly. The concern is that doing so could confirm your address and lead to more unwanted mail.
What if the package looks harmless?
The safest assumption is that an unexpected mailing is not automatically safe just because it looks small, plain or low-value. A QR code can be enough to create a risk, even if the envelope itself does not look threatening.
The bottom line from federal consumer warnings is straightforward: do not scan unknown QR codes from mystery mail, do not trust an unsolicited package just because it arrived through the mail, and report suspicious items to the Postal Inspection Service.
