Authorities are issuing a stern warning about a growing scam involving unsolicited packages arriving at homes, many of which contain QR codes. These seemingly innocuous codes are a new tactic in "brushing" scams, designed to compromise personal information and potentially install malware on unsuspecting recipients’ devices. Consumers are urged to exercise extreme caution and avoid scanning these codes.
Key Takeaways
- Unsolicited packages with QR codes are part of a "brushing" scam.
- Scanning these QR codes can lead to phishing websites or malware.
- Authorities advise against scanning the codes and recommend security measures if a code has already been scanned.
The "Brushing" Scam Evolves
The "brushing" scam, a long-standing tactic, involves sellers sending un-ordered items to consumers. They then use the recipient’s information to post fake positive reviews, artificially boosting their product ratings and sales. The latest iteration of this scam introduces QR codes into the packages, often with instructions to scan them to identify the sender or arrange a return.
The Dangers of Scanning QR Codes
Experts, including the FBI and the Better Business Bureau, strongly advise against scanning these QR codes. When scanned, these codes can redirect users to malicious websites designed to steal personal and financial data through phishing attempts. In some cases, they can also trigger the download of malware onto smartphones or computers. Unlike web links, QR codes offer little visual clue about their destination, making it difficult for users to discern a legitimate code from a malicious one.
Protecting Yourself
If you receive an unsolicited package containing a QR code, do not scan it. Legitimate businesses typically include return addresses, so any mystery package lacking sender information should be treated with suspicion. If you have already scanned a QR code and entered personal information, it is crucial to take immediate action. This includes changing passwords for all online accounts, enabling two-factor authentication wherever possible, and closely monitoring bank and credit card statements for any suspicious activity. Consumers are also advised to keep their devices updated with the latest security patches and consider using mobile security apps with web protection features. The Federal Trade Commission notes that while consumers are legally allowed to keep unsolicited merchandise, vigilance is key to avoiding further compromise.
Reporting Suspicious Activity
Authorities encourage individuals to report any instances of brushing scams to the FBI’s Internet Crime Complaint Center (IC3.gov). Providing as much detail as possible, including sender information, communication methods, and any downloaded applications or granted permissions, can aid in investigations.