WASHINGTON, June 28 (DC Times Online) — If an unexpected envelope or package shows up in your mailbox, federal consumer agencies say one thing matters most: do not scan any QR code inside it.
The U.S. Postal Inspection Service says the mail piece may be part of a brushing scam, an illegal scheme in which someone sends merchandise or other parcels that were never ordered. The sender is often a third-party seller, sometimes overseas, who has found a recipient’s address online.
What is the scam trying to do? The Postal Inspection Service says the goal is to make the recipient look like a verified buyer so the seller can post fake positive reviews in that person’s name. Those reviews can make the seller’s products appear more trustworthy than they are.
A newer version of the scam uses QR codes. The Postal Inspection Service says some brushing packages now include a card with a QR code and a note suggesting the recipient scan it to identify the sender or learn more about the company. The Federal Trade Commission says that kind of code can be a trap: scanning it may send a person to a fake website that steals personal information or installs malware.
That is why consumer-protection officials say to treat QR codes in unknown mail as suspicious. A QR code is just a shortcut to a web link, and the code itself gives no guarantee that the destination is safe. If the mail was not expected, the safest move is to avoid scanning anything until the source is verified through a trusted channel.
If you receive unsolicited merchandise, the Postal Inspection Service says you can report it to the agency. The service also says recipients may keep unsolicited merchandise under U.S. law, return unopened items if they have a return address, or dispose of opened items if it is safe to do so.
If you think personal information may have been exposed, the Postal Inspection Service advises changing passwords and watching credit reports and credit card statements closely. In short: unexpected mail can be annoying, but a QR code in it can be worse if it leads to a fake site or a malware download.
The bottom line is simple. An unknown envelope or package may be more than junk mail. It may be an attempt to create fake reviews, lure a scan, or pull personal data off a phone.
