Brushing Scam

By Andi Hale

The Postal Service is reminding employees and contractors to beware of brushing scams, which can lead to identity theft, compromised accounts and increased spam.

Brushing is a type of scam where a person receives an unsolicited package that contains various items that they never ordered. While appearing to be a “free gift,” the package is marked with the person’s name and home address (potentially additional information), which could mean their personal information has been exposed online.

Generally, brushing scams are when scammers mail unsolicited packages and then use the recipient’s name/address to post fake positive reviews for their product to inflate their sales and reputation on online shopping sites. The packages usually contain inexpensive items like beauty products, gadgets, or cheap jewelry trying to “brush up” their ratings.

Brushing scammers are now including QR codes in their packages in the hopes that the package recipient will scan it and follow their instructions. This tactic, known as QR Code Phishing or Quishing, is when scammers use QR codes to trick people into navigating to malicious websites that are designed to look legitimate. The QR code provided in the package will redirect the recipient to a malicious website disguised as an authentic business (e.g., Amazon, Walmart, USPS) to trick the recipient into providing additional personal information (e.g., banking numbers, SSN, employment information) or clicking malicious downloads like malware, ransomware, or spyware. The information stolen or malicious files downloaded could leave the victim open to future attacks.

Here’s what you can do if you or someone you know receives an unsolicited package:

• File a report with the Postal Inspection Service
• Change the password for your email and any accounts containing financial data
• Do not engage with the sender of the package or you may inadvertently verify your address, which could lead to more unwanted packages
• Do not scan any QR codes on the packages because this can install malware on your device

The CyberSafe at USPS Blue and LiteBlue pages have more information.