Brushing Scams: Protect Yourself from This Sneaky Threat Involving Unexpected Packages & QR Codes

If you’ve ever received a package you didn’t order, you might assume it’s a mistake—or even a pleasant surprise! But if that package contains an unexpected gift with no clear sender and a QR code inside, it could be part of a brushing scam, a deceptive tactic that scammers use to steal personal and financial information.

Brushing scams have been popping up across the country, and they often involve small but enticing items like jewelry, Bluetooth speakers, or other inexpensive products. While it may seem harmless to keep the freebie, interacting with the QR code inside can put your private data at serious risk.

How Does a Brushing Scam Work?

1. An Unexpected Package Arrives: You receive a package from a company like Amazon or another retailer, but you never ordered the item.
2. No Clear Sender Information: The package may have your name and address but no return label or clear details about who sent it.
3. A QR Code Inside: The package often includes a note with a QR code, claiming you can scan it to find out who sent the gift.
4. Data Theft Begins: If you scan the code, scammers gain access to your phone, including personal and financial information. Victims have reported drained bank accounts and compromised personal data after scanning fraudulent codes.

How to Protect Yourself

• Never scan an unknown QR code. These scams aren’t just in packages—QR code fraud is appearing on fake parking meters, restaurant tables, and emails as well.
• Ignore and discard the package. While you can keep or throw away the unsolicited item, avoid interacting with any instructions or QR codes included.
• Monitor your financial accounts. If you suspect your information has been compromised, check your bank and credit card statements for any unauthorized transactions.
• Report suspicious activity. If you receive an unexpected package or suspect a scam, report it to the Federal Trade Commission at reportfraud.ftc.gov.

→ Learn more about brushing scams on the United States Postal Inspection Service website.

Stay Vigilant, Stay Safe

Brushing scams are designed to trick you into handing over sensitive information without realizing it. By staying informed and cautious, you can avoid falling victim to this and other deceptive tactics. Always think twice before scanning an unknown QR code—it’s better to be safe than sorry!

3Rivers members, we highly encourage you use our digital banking tools to monitor your accounts and receive activity alerts. If you notice what appears to be fraudulent activity on your 3Rivers accounts, report it to us immediately. Check out this page for more details on reporting fraud.

Stay aware and stay safe out there!