The Federal Bureau of Investigation warns the public about a scam variation in which criminals send unsolicited packages containing a QR code that prompts recipients to provide personal and financial information or unwittingly download malicious software that steals data from their phone. To encourage the victim to scan the QR code, the criminals often ship the packages without sender information to entice the victim to scan the QR code. While this scam is not as widespread as other fraud schemes, the public should be aware of this criminal activity, the agency said.
This is a variation of a “brushing scam,” which is used by online vendors to increase ratings of their products, said the FBI. In a traditional brushing scam, online vendors send merchandise to an unsolicited recipient and then use the recipient’s information to post a positive review of the product. In this variation, scam actors have incorporated the use of QR codes on packages to facilitate financial fraud activities.
“Criminals continue to evolve their tactics to target unsuspecting victims,” said the agency. “Precautions should be taken prior to scanning any QR codes received through unsolicited communications or packages.” The FBI suggests the following tips for the public:
- Beware of unsolicited packages containing merchandise someone did not order.
- Beware of packages that do not include sender information.
- Take precautions before authorizing phone permissions and access to websites and applications.
- Do not scan QR codes from unknown origins.
- Those who believe they are the target of a brushing scam should secure their online presence by changing account profiles and request a free credit report from one or all the national credit reporting agencies (Equifax, Experian and TransUnion) to identify possible fraudulent activity.
The FBI requests the public report these fraudulent or suspicious activities to the FBI Internet Crime Complaint Center at www.ic3.gov. Be sure to include as much information as possible:
- The name of the person or company that initiated the contact.
- Methods of communication used, including websites, emails and telephone numbers.
- Any applications downloaded or for which permissions are provided on an electronic device.
Individuals aged 60 or over who need assistance with filing an IC3 complaint can contact the Department of Justice’s elder justice hotline at 833-FRAUD-11 (or 833-372-8311).
