WASHINGTON, June 28 (DC Times Online) — An unexpected envelope or package in the mail can be more than a nuisance.
The U.S. Postal Inspection Service says one common scheme behind mystery mailings is a brushing scam, a fraud that uses items people did not order or request. The agency says the goal is to make the recipient look like a verified buyer so a seller can post fake positive reviews in that person’s name.
A newer twist, the Federal Trade Commission says, can involve a QR code inside the mailing. The FTC warns that scanning that code could send a person to a phishing website or trigger malware.
What is a brushing scam?
The Postal Inspection Service says brushing scams are illegal in the United States. In its guidance, the agency says the mailings are often sent by an international third-party seller that found a recipient’s address online.
The idea is simple: if the seller can send a real item to a real address, it can make the online account look like it belongs to a genuine customer. The seller then uses that address to help publish fake positive reviews.
That is why the scam is called brushing. The seller is trying to brush up its reputation without a real customer behind the review.
Why is a QR code risky?
A QR code is a square code that can be scanned with a phone camera. In a normal setting, it may open a menu, a website or payment page.
But the FTC says an unexpected package with a QR code can be a phishing trap. Phishing is a fraud scheme that tries to trick people into giving away personal information, such as passwords, credit card numbers or account logins.
The FTC warns that scanning a code from a surprise mailing could also download malware, which is harmful software that can steal data or damage a device.
The Postal Inspection Service says this QR-code version is a newer variation of brushing sometimes called quishing.
What should you do if you get one?
The Postal Inspection Service says recipients of unsolicited merchandise should report it to the agency.
It also says people may keep unsolicited merchandise by law. If the item is unopened and has a return address, the agency says it can be returned to the sender. If it has already been opened, it can be disposed of if it is safe to do so.
The agency also advises people to change passwords and closely watch credit reports and credit card bills if they think personal information may have been exposed.
Another warning from consumer guidance: do not contact the sender. In guidance quoted in later consumer coverage, USPS warned that reaching out could confirm your address and lead to more unwanted packages.
And most important, do not scan an unfamiliar QR code just because it arrived in the mail.
Is every mystery envelope a scam?
Not every unexpected envelope is fraudulent. Some mailings may be harmless mistakes or legitimate items sent by a company.
But federal consumer warnings say a surprise package, especially one that asks you to scan a code or visit a website, should be treated with caution.
The basic rule is to slow down. Do not scan the code, do not click unknown links, and do not give out personal information unless you can confirm the mailing is legitimate.
If the envelope or package seems suspicious, the Postal Inspection Service says to report it and protect your accounts right away.
