You may have heard about – or even experienced – a brushing scheme without ever knowing what it was called or what it is. Basically a scam to boost product ratings and sales with falsified verified purchase reviews, a brushing scheme involves sending unsolicited packages to a victim using personal information that a fraudster has stolen or purchased online.
Though it might seem like a harmless scam, and the law states that you are entitled to keep any gifts that arrive at your doorstep even if they’re part of a scam, brushing is an indication that your personal information has been compromised and that you have been potentially exposed to identity theft.
Now though, according to a new warning issued by the Federal Trade Commission (FTC) and reported on by Cybernews, brushing scams have evolved to include a new threat. In addition to the free gifts, the schemes now include cards or notes that instruct victims to scan a QR code to find out who sent the gift or find out how to return the unwanted item.
This QR code is, unfortunately, embedded with malicious code that takes you to a phishing website that will steal your personal information, including usernames, passwords and credit card numbers or infect your devices with malware so hackers can have access to them and the data they contain.
“If you know it's really a gift, you can keep it.’ says the FTC, “but also know that this unexpected package could be a new twist on a brushing scam that could steal your personal information.”
How to protect yourself from brushing and phishing
The FTC encourages anyone who has interacted with suspicious QR codes to take immediate protective steps which include changing your passwords right away if your credentials were compromised. The FTC also says you can report suspected identity theft at identitytheft.gov.
To stay safe from phishing and account takeover, you always want to create strong and unique passwords that are hard to guess, or use a trusted password manager. Likewise, whenever possible turn on multi-factor authentication (MFA) or two-factor authentication for your online accounts.
You can monitor your credit reports at annualcreditreport.com to look for signs of fraud, like open accounts in your name that you don’t recognize, and you should always review credit card bills and bank statements for suspicious activity.
Also, follow best practices, which means never click on QR codes or links from unknown sources – whether that’s an email, text, or card in the mail. You can also protect your devices, both mobile, PCs and tablets, by having one of the best antivirus souftware suites installed which in addition to top notch malware protection, may also inclue a VPN, password manager and more. Some will even have a “rollback” feature that will let you undo any damage done by a malware or ransomware attack.
More from Tom's Guide
