The FBI is alerting the public to a sophisticated "brushing" scam that leverages QR codes found on unexpected packages. These unsolicited deliveries, often appearing to be from major retailers like Amazon, contain a QR code that, when scanned, can lead to malicious websites designed to steal personal information or install malware on devices. This evolving scam poses a significant risk to consumers nationwide.
Key Takeaways
- Do not scan QR codes on unexpected packages.
- Never enter personal or financial information on sites linked from these codes.
- Report suspicious packages to the retailer and the FBI.
The Evolving Brushing Scam
Brushing scams are not new, but the integration of QR codes represents a concerning escalation. Traditionally, scammers send low-cost items to unsuspecting individuals and then use the recipient’s information to post fake positive reviews for their products or businesses. The new tactic involves including a QR code within these packages, often with a misleading prompt to "find the sender" or "claim a prize."
How QR Codes Enable Scams
Cybercriminals are exploiting the convenience and widespread adoption of QR codes. When scanned, these codes can direct users to phishing websites that mimic legitimate login pages for online retailers or financial institutions, aiming to capture usernames, passwords, credit card details, or social security numbers. In some cases, scanning the code can directly download malware onto a user’s mobile device, which is particularly vulnerable as many users neglect to install robust security software on their phones.
Protecting Yourself
Authorities strongly advise consumers to take the following precautions:
- Do Not Scan: If you receive a package you did not order and it contains a QR code, do not scan it under any circumstances.
- Verify Sender: Legitimate businesses typically include return addresses. Treat any mystery package without sender information with extreme caution.
- Avoid Data Entry: If you accidentally scan a code and land on a website asking for personal or financial information, do not enter any details. Close the page immediately.
- Secure Accounts: If you believe you may have scanned a suspicious QR code or entered information, change your passwords for affected accounts, monitor your bank and credit card statements for unauthorized activity, and consider placing a credit freeze.
- Report Suspicious Activity: Report any suspected brushing scams to the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. Provide as much detail as possible.
- Keep Devices Updated: Ensure your devices are running the latest software updates, as these often patch security vulnerabilities that scammers exploit.
- Use Security Software: Employ up-to-date mobile security and web protection software.
- Enable Two-Factor Authentication: Utilize two-factor authentication (2FA) wherever possible to add an extra layer of security to your online accounts.
By remaining vigilant and following these guidelines, consumers can better protect themselves from this evolving threat.