WASHINGTON, June 28 (DC Times Online) — If a strange envelope or package lands in your mailbox, federal consumer-protection agencies say the safest move may be the simplest one: do not scan any QR code inside it.
The U.S. Postal Inspection Service says one common explanation is a brushing scam. In that scheme, a seller sends people items they did not order or ask for, often after finding their address online. The goal is not to sell them a product. It is to make it look as if the recipient is a real customer so the seller can post fake positive reviews in that person’s name.
What is a brushing scam?
The Postal Inspection Service says brushing scams are illegal. The packages can contain almost anything, and the item may arrive with no clear reason attached. In some cases, the sender may be a third-party seller, sometimes outside the United States, using the recipient’s address to create the appearance of a verified buyer.
That is why an unexpected package can be more than just a nuisance. It can be part of a fraud scheme built around fake ratings and deceptive online sales.
Why is the QR code risky?
The newer danger is a variation the Postal Inspection Service calls quishing, or QR-code phishing. In that setup, a card or insert with a QR code is included in the package and presented as a way to identify the sender or learn more about the company.
The Federal Trade Commission warns that a QR code on an unexpected package can be a trap. Scanning it could send a phone to a phishing website that steals personal information or installs malware.
QR codes are popular because they are easy to scan. But the FTC says that convenience can also make them a good tool for scammers. If the package was not expected, a code inside it should be treated with caution.
What should you do if one arrives?
The Postal Inspection Service says recipients of unsolicited merchandise should report it to the agency. Federal guidance also says people may keep unsolicited merchandise by law. If the item is unopened and marked with a return address, it can be returned to the sender. If it has been opened and it is safe to do so, it can be thrown away.
If there is any chance your personal information was exposed, the Postal Inspection Service says to change passwords and closely watch credit reports and credit card bills.
The basic rule is simple: do not trust an unknown QR code just because it came through the mail. A real-looking envelope or package can still be part of a scam.
How can people stay safer?
Federal agencies say to slow down before acting on unexpected mail, especially if it asks for a scan, a click, or a login. If the item seems suspicious, do not use the code inside it as a shortcut to learn more. The FTC says the better move is to treat the mailing as untrusted until it is verified by an official source.
For consumers, the warning is less about the envelope itself than about what comes after it. A scammer’s goal is often to get a scan, a click or a confirmation that a real address is active. Once that happens, the next step can be more unwanted mail, fake websites or stolen data.
