Who doesn't love the thrill of finding an unexpected package at your door? While surprises can be fun, those "free" items from companies or retailers might not be as harmless as they seem. These unsolicited gifts are often part of a "brushing scam,” a trick to gain personal information.
How it works.
A person receives packages containing item(s) that were not ordered or requested by the recipient. While the package may be addressed to the recipient, there is no return address, or the return address may be that of a retailer. Once the recipient opens the package to try to figure out what the gift is and where it’s from, inside is a QR code with a prompt for the recipient to scan. Scammers may use the QR code to access personal financial information, try to move money from your CoVantage account, or take over your identity. This may include your online banking username/password or credit card numbers stored on your phone. These criminals may also try to gain access to your digital wallet or a payments app installed on your phone. Finally, they may also ask for payment for the item and prompt you to enter your debit or credit card numbers.
What to do if you receive a package you didn’t order.
If you receive a package like this, the best course of action is to simply not scan the QR code. To further protect yourself, change your account passwords and closely monitor your credit report, financial statements, and credit card bills. If you haven’t already, consider setting up two-factor authentication on your online banking and shopping accounts. As for the package, according to the United States Postal Service, unsolicited merchandise is yours to keep and you are under no obligation to pay for it. However, just because you can keep it, does not mean you shouldn’t be suspicious about the item you receive and how it got to you. Trust your instincts when deciding whether to keep or discard an item from an unexpected package.