Consumers are being targeted by a new scam involving unsolicited packages arriving in the mail, containing QR codes that lead to malicious websites. The FBI is urging the public to exercise extreme caution and avoid scanning these codes, as they can be used to steal personal data, financial information, or install malware on devices. This tactic represents a modern evolution of ‘brushing’ scams, where fake reviews are generated using unsuspecting recipients’ information.
Key Takeaways
- Unsolicited packages containing QR codes are being sent through the mail.
- Scanning these QR codes can lead to phishing sites, malware installation, or financial fraud.
- This is a variation of ‘brushing’ scams, used to generate fake reviews.
- The FBI advises against scanning QR codes from unknown packages.
The Evolving Scam
Scammers are increasingly using physical mail to distribute malicious QR codes. These packages often arrive without sender information, aiming to pique recipients’ curiosity. Once scanned, the QR codes can redirect users to fake websites designed to harvest sensitive personal and financial details. In some cases, they can even trigger the download of malware onto a user’s device. This method leverages the common use of QR codes in legitimate transactions, making it harder for consumers to distinguish between safe and dangerous codes.
How to Protect Yourself
To avoid falling victim to this scam, the FBI and consumer protection agencies recommend several precautions:
- Do Not Scan Unknown QR Codes: If you receive a package you did not order and it contains a QR code, do not scan it. Treat any mystery package without clear sender information with suspicion.
- Be Wary of Unexpected Packages: Unexpected deliveries, especially those lacking sender details, should be viewed with caution.
- Verify Website Links: When scanning QR codes, use apps that display the destination URL before opening it, allowing you to check for suspicious links.
- Keep Devices Updated: Ensure your mobile devices and computers are running the latest software versions to patch security vulnerabilities.
- Use Security Software: Employ up-to-date mobile security and web protection software.
- Enable Two-Factor Authentication: Activate 2FA on all online accounts to add an extra layer of security.
- Monitor Accounts: Regularly check bank statements, credit reports, and online accounts for any suspicious activity.
Reporting Scams
If you believe you have been targeted by this scam or have lost money, it is crucial to report it immediately. You can report brushing scams and other cybercrimes to the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. For individuals aged 60 and older, the Department of Justice Elder Justice Hotline is available at 1-833-FRAUD-11.