Spotting a ‘Brushing’ Scam This Christmas: 6 Ways to Stay Safe

Spotting a ‘Brushing’ Scam This Christmas: 6 Ways to Stay Safe

• An online expert warns of the ‘brushing’ scam ahead of the last-minute Christmas rush and shares key tips on how to avoid it
• A traditional ‘brushing’ scam involves unsolicited packages sent to your address, often labeled with your name but lacking a return address
• To stay safe, update your passwords, avoid scanning unverified QR codes, and monitor your financial accounts

With Christmas just days away, many shoppers are gearing up to take advantage of the last-minute online sales.

However, as consumers grow more cautious of online scams, cybercriminals are devising increasingly sophisticated methods to exploit them.

One emerging threat is the ‘brushing’ scam, where unsuspecting individuals receive unsolicited packages containing QR codes. Scanning these codes directs them to phishing websites designed to steal personal information.

Kushal Tantry, CEO of QR Code Developer, sheds light on the mechanics of QR code brushing scams and shares practical tips on how to spot and avoid falling victim to these schemes.

What is a ‘brushing’ scam? 

A traditional ‘brushing’ scam is when an individual sends an unsolicited package to a person’s home address, containing an item that they didn’t order. These packages will often be labeled with your name and home address but will contain no return address. 

This can be done by third-party sellers, who sell products on sites such as Amazon. The fraudster will obtain your name and home address from a data breach, social media, or a public directory and then use this to set up an Amazon account in your name. They will then purchase the product from their store using your credentials and ship it to your home address. 

Once you have signed to confirm receipt of the parcel, the scammer then writes a positive verified review for the product in your name, to help improve their seller rating and to help drive more sales. 

What is a QR code ‘brushing’ scam? 

Scammers have begun to take this a step further by including a QR code inside the package, which instructs you to register your new product online or scan to access more details on who sent you the package. 

In reality, the QR code will then direct you to a phishing website, which will ask you to fill in more of your personal information such as your banking details, which the scammer will then have access to. 

What to do if you encounter a QR code ‘brushing’ scam? 

If you receive an unexpected package that is addressed to you, it is up to you whether you keep or throw away the item inside. If the package contains a QR code, however, do not scan it. 

You should contact your local authority to report this scam, so they can put out a warning, if necessary, to prevent other recipients from falling victim. 

Make sure to inform the company that allegedly sent the package through their official contact details and don’t use any contact information provided on the package itself. You can notify Amazon that you have received an unwanted package here: https://account-status.amazon.com/report-unwanted-packages 

How to protect yourself from future scams? 

The first thing to do after receiving an unexpected package is to check your existing accounts and change any passwords, in case the scammer has direct access to your online account. If you received an unsolicited package, the scammer is likely to only know your name and home address, but make sure to monitor your bank accounts in case you spot any strange activity. 

Any suspicious QR codes should be treated with caution, especially if the webpage asks you to enter personal information after scanning it. As a general rule, avoid scanning any QR codes sent to you via packages, emails, and text messages unless you can confirm the source as legitimate.

story credit: https://qrcodeveloper.com