Brushing Scams With a Twist: What to Do When an Unexpected Package Asks You to Scan a QR Code

The FTC has reissued a consumer alert notifying people of potential new twists on brushing scams and how scammers may attempt to capitalize on your lack of awareness.

Imagine this: you receive a package addressed to you, but you have no idea who sent it. Inside is a note claiming it’s a gift, but there’s no sender information. The note asks you to scan a QR code to discover who sent the package or to get return instructions. It may sound intriguing, but it could also be the opening act of a scam.

Here’s your friendly reminder to always stay vigilant and inquisitive when dealing with unexpected correspondence, even if it comes by mail.

Could It Really Be a Gift?

Yes, it could. But if you weren’t expecting a package, you might be dealing with a new twist on a brushing scam. Scammers send out low-cost items to unsuspecting recipients, often purchased with stolen personal information. These scams are designed to manipulate e-commerce systems or boost seller ratings with fake reviews. In some cases, the unexpected package may not cost you anything, but it could signal that your personal information has been compromised.

Read more about brushing scams in this dedicated article: Brushing scams: What to do if you receive ‘free’ goods in the mail without ordering them

The Danger of Scanning QR Codes

The QR code inside the package might seem like a convenient way to find out more, but it could also lead to:

1. Phishing Websites: These fake sites might request personal information like usernames, passwords, or credit card details.

2.      Malware Downloads: Scanning the code could trigger a download that installs malware on your device, potentially giving hackers access to your phone or other personal data.

How to Stay Safe

To avoid falling victim to scams like these:

• Be skeptical of unexpected deliveries: If you didn’t order something, question its legitimacy. Don’t pay for packages you did not personally order.
• Avoid scanning QR codes: Unless you’re absolutely sure of their source, don’t scan them.
• Don’t share personal information: If prompted for sensitive details, think twice before responding.
• Use Scamio to quickly check if a QR code is potentially malicious or a scam. Scamio is available on WhatsApp, Facebook Messenger, web browser or Discord for free! Simply scan the QR code with Bitdefender Scamio, which will analyze it and provide you with the result. You can also help others stay safe by sharing the localized versions of Scamio in France, Germany, Spain, Italy, Romania, Australia, and the UK.
• Protect your phone and accounts. Use a security solution on your devices to prevent compromise and protect your online accounts with strong passwords and multi-factor authentication.

If  you’ve scanned the QR code and entered personal information, take immediate action:

• Change your passwords for any accounts you may have compromised. Use a strong, unique password for each account.
• Enable two-factor authentication (2FA) to add an extra layer of security.

What If Your Personal Information Has Been Stolen?

If you’re worried your personal information has been compromised, here are the next steps:

1. Get your free credit report: Visit AnnualCreditReport.com to check your credit report for any unauthorized accounts or activities. You can access a free report every week.
2. Monitor your financial accounts: Review your credit card and bank account statements for transactions you don’t recognize.
3. Consider placing a credit freeze and setting up fraud alerts.

For more peace of mind, consider using an identity protection solution from Bitdefender. We’ve got you covered, whether you’re looking for digital identity monitoring, data breach alerts, or more comprehensive identity theft protection solutions.

Check out plans for Bitdefender Digital Identity Protection and Bitdefender Identity Theft Protection (US only)