Have you received a package on your doorstep that you didn’t order? It could seem fun to get a free gift or feel like it’s a mix-up but it’s part of a scam known as “brushing”. 

Traditionally, fraudsters send unsolicited packages to people to create fake sales and post glowing reviews on behalf of the recipient to boost product ratings on their shady e-commerce sites. This may sound harmless but it’s dangerous for your personal information. 

The FBI has begun warning about a new and more dangerous variation involving QR codes. Scammers believe you will scan the code out of curiosity to learn where the package came from. The dangerous part of this is that by scanning the unknown QR code, you open the door for malware to be downloaded onto your phone to steal financial and personal information.

How the scam works:

• Scammers set up fake online sites, then use your name and address to create a fake order that looks like a real purchase.
• Ship small, inexpensive items (like beauty products, phone accessories, etc.) to your home.
• The package often arrives without a return address or sender details, only a QR code. Sometimes the QR code will be on a card in the package.
• Scanning the QR code installs malware or directs you to the fake site to gain sensitive or financial details.
• Since this was a “purchase”, the scammer can leave a positive “verified purchase” review under your name to boost their seller ratings.

Unfortunately, if you are receiving these brushing packages, it usually means that your name and address have been compromised.

Signs you might be targeted:

• You receive a package you never ordered, with no obvious sender.
• There’s no return address or only a generic one.
• The package includes a QR code prompting you to scan it.
• You later find a “verified purchase” review under your name on a product you didn’t buy.

Protect yourself – how to avoid brushing scams:

• Don’t scan QR codes on anything you weren’t expecting or are familiar with (packages, emails, texts, posters, etc.).
• Be cautious of packages that arrive without sender information.
• Never assume a package you didn’t order is harmless.

If you think you are a victim of a scam:

• Don’t be afraid or embarrassed – scams and fraud happen often, and we are here to help you.
• Contact your financial institution immediately – the sooner you let them know, the easier it is to help you with your accounts and loans.
• Monitor your credit – enroll in our free Credit Score Solution within our digital banking and review your credit score and report periodically. You can also receive free credit reports once a year from annualcreditreport.com.
• If you think someone might be using your personal information – you can report it at ftc.gov.

Questions? Call/text 503.588.0211 or email creditunion@ourgrovecu.com.

Read more fraud prevention posts:
Fraud Unmasked: How to Recognize and Avoid Common Scams
Passwords 101: What Every Member Should Know
QR Codes: Smart Tips & What to Watch Out For