Beware of Brushing Scams

Beware of the Unsolicited Package Brushing Scam

You come home to find a package on your doorstep that you didn’t order. There’s no return address, no sender information—just your name, your address, and a QR code printed on top. What should you do?

Don’t scan the QR Code

Unless you know and trust the source, avoid scanning any QR codes included with unsolicited packages. Scammers can use these codes to direct you to fake websites that collect sensitive information or infect your device with malware. This is called a Brushing Scam.

What is a Brushing Scam?

Brushing scams are a sneaky tactic scammers use to manipulate online reviews. By obtaining your name and address—often through data breaches—they send you unsolicited packages. The goal? To use your information to create fake “verified user” reviews for their products.

At first glance, brushing may seem harmless. You receive free items—sometimes as small as socks or as large as an electronic device. But there’s more to the story.

Recently, scammers have upped their game by including QR codes in these packages. Scanning those codes can open the door to more trouble, potentially exposing your phone or personal data, including financial information.

How to protect yourself

The good news? By law, you can keep any unsolicited items sent to your address. The bad news? Brushing scams mean your information is already in the wrong hands. Here are steps to protect yourself:

Verify the package isn’t a gift

Before taking further action, confirm with friends or family that the package wasn’t a delayed gift. Sometimes well-meaning surprises for birthdays or holidays arrive much later than expected.

Notify the retailer or manufacturer

If the package came from a recognizable retailer, such as Amazon, contact their customer service. Many retailers have processes in place to report brushing scams.

Change your passwords

Since scammers likely obtained your information through a data breach, it’s crucial to update your passwords. Focus on your most sensitive accounts—banking, retail, utilities, and medical portals—and use strong, unique passwords for each.

Consider freezing or locking your credit report

If you have reason to believe that somebody found your information in a data breach and sold it to a scammer, you may want to consider a credit freeze or lock to prevent anyone else from trying to open new credit accounts in your name. You can remove these locks and freezes whenever you need to apply for credit.

Report the fraud to the FTC

Reporting identity theft and scams to the FTC can help law enforcement fight these types of crime. The FTC also offers additional information about how to recover from identity theft and news about scams to be aware of.

Stay vigilant

Brushing scams highlight how scams are evolving to exploit our digital habits. A package on your doorstep may seem harmless, but these “free” deliveries can cost you valuable personal information.

By avoiding unverified QR codes, verifying the source of unexpected packages, and securing your accounts, you can stay a step ahead of these schemes. And always remember: if something seems too good to be true, it probably is.

At Universal 1 Credit Union, your financial security is our priority. Stay informed, stay cautious, and don’t hesitate to reach out if you have questions about protecting your personal information. 

memberservices@u1cu.org | Call Us 937-431-3100 opt. 0 or 800-543-5000 opt. 0