Tread Lightly
A sneaky type of online scam has been making waves — brushing scams. While you may not have heard the term, there’s a chance you’ve encountered one without even realizing it. Brushing scams involve receiving packages, often of low-value items, that you didn’t order. The prospect of receiving “free” products definitely get individuals excited enough to get individuals to drop their guards. People might assume the item is a gift or a promotional giveaway. Unfortunately these random packages are not as innocent as they seem and can lead to serious privacy risks.
This is how it works...
The sender is typically an international third party seller who finds their victims information online. They then send packages containing various items of low value never ordered or requested. While the package is addressed to a recipient, there often will no other information but a QR code. The goal is to make it appear as though the recipient is a verified buyer who has left positive online reviews for the items. In reality, the seller is writing fake reviews under the recipient’s name. These fraudulent reviews help artificially boost product ratings and sales numbers, with the aim of driving future sales. Since the items are usually cheap and inexpensive to ship, scammers see it as a worthwhile investment.
First off, don’t scan the QR code. Never scan QR codes unless you’re certain they come from a verified source. Imagine this: you receive a small, unexpected package on your doorstep. Inside is a random item—a pair of cheap earbuds or a trinket you didn’t order. Attached to the package is a QR code, tempting you to scan it to “learn more” or “claim a reward.” At first glance, it may seem harmless, but that’s exactly where the danger lies.
QR codes hide their true destination until they’re scanned. Scammers know this, which is why they embed malicious links behind the code. Once you scan it, you could be directed to a website that looks legitimate but is really designed to compromise your information. It might ask you to log in or provide personal details, tricking you into thinking it’s part of a normal shopping or delivery process.
In brushing scams, these QR codes are often a way for scammers to further exploit the situation. Beyond fake reviews and boosting product rankings, scanning these codes can lead to phishing sites that collect your data or download malware onto your device. This malware can steal sensitive information, track your online activity, or even allow scammers to take control of your device remotely. Brushing scams use these tactics to not only deceive e-commerce platforms but also to pull recipients deeper into their schemes, often without them realizing it until it’s too late.
What Should You do?
The good news is that anything sent to your address is yours to keep. However, the key is not to let your curiosity lead you into compromise your information.
Check your orders:
Review your recent orders on e-commerce platforms to confirm that you didn’t accidentally order the item. If you have accounts with any retailers, check for unauthorized purchases.
If the package contains a QR code, do not scan it, as it may lead to a malicious website or phishing page.
Share information about brushing scams and other types of fraud with friends, family, and colleagues. Raising awareness can help others avoid similar situations.
