WASHINGTON, June 28 (DC Times Online) — A mystery envelope or package in the mail can be more than a nuisance. Federal consumer-protection agencies say some unsolicited mailings are part of a brushing scam, and some now include QR codes that can send people to fake websites.
Here is what the term means, why it matters, and what to do if one shows up at your home.
What is a brushing scam?
The U.S. Postal Inspection Service says brushing scams are illegal and involve people receiving packages or parcels they did not order or request. The sender is often an international third-party seller that found the recipient’s address online.
According to the Postal Inspection Service, the goal is to make the recipient look like a verified buyer so the seller can post a fake positive review in that person’s name. The agency says that lets the seller appear more trustworthy on online marketplaces.
Why are QR codes part of the warning?
The Federal Trade Commission says an unexpected package with a QR code could be a new twist on brushing. The agency warns that scanning the code could send a person to a phishing website designed to steal personal information or install malware.
The Postal Inspection Service says this newer variation is sometimes called quishing. In those cases, cards with QR codes may be included inside the unsolicited package under the pretense that the recipient should scan the code to identify the sender or learn more about the company.
What should you do if a package or envelope shows up unexpectedly?
The Postal Inspection Service says to report unsolicited merchandise to the agency. It also says recipients may keep unsolicited merchandise by law. If the item is unopened and has a return address, it may be sent back to the sender. If it has already been opened, it can be discarded if it is safe to do so.
The agency also advises people who think their personal information may have been compromised to change passwords and watch credit reports and credit card statements closely.
Consumer advice quoted in coverage of a USPS warning adds one more step: do not contact the sender. Officials say that could confirm your address and lead to more unwanted packages.
How can people stay safe?
The simplest rule is not to scan QR codes from mail you were not expecting. The Postal Inspection Service says never scan untrustworthy QR codes or click unknown links.
If the mail piece looks suspicious, treat it like a fraud attempt, not a gift. The FTC says a legitimate present should not come with pressure to scan a code to claim it or identify it.
Why federal agencies are paying attention
The Postal Inspection Service, the FTC and, in warnings summarized by other outlets, the FBI have all flagged unexpected mail as a possible fraud vector. The concern is not just unwanted junk mail. It is that scammers may use ordinary-looking envelopes or packages to push people toward fake websites, steal data or spread malware.
For that reason, officials say the safest response is simple: do not scan the code, do not trust the package at face value, and report the item through the proper federal channels if needed.
