New ‘Brushing’ Scam Hits Mailboxes: QR Code Can Drain Your Bank Account

What you need to know if you see this

SAGINAW, Mich – A new scam is appearing across several states, leaving unsuspecting recipients at risk of financial and personal data theft. Known as a “brushing” scam, individuals receive unsolicited packages in the mail containing items they did not order, such as rings, bracelets, necklaces, or Bluetooth speakers. While the package may display the recipient’s address, it typically does not include the sender’s information or appear to come from a known retailer.

The scam becomes dangerous when the recipient opens the package and discovers a QR code, often labeled as a way to identify the sender or learn more about the gift. Scanning the QR code is where the trouble begins. Once scanned, the code grants scammers access to all data on the recipient’s phone, including personal information, financial details, and bank accounts. Victims often report their accounts being drained shortly after scanning the code.

Authorities are advising consumers to avoid scanning any unknown QR codes, especially those included in unsolicited packages. While the items themselves may be harmless and can be kept or discarded, the QR code poses a serious risk.

Scammers have used QR code schemes before, appearing in unexpected places such as parking meters or fraudulent online links. Experts urge residents to inform family members about this scam and exercise caution with any unknown or unrequested packages. If you receive such a package, do not interact with the QR code, and report suspicious activity to local authorities.