Greg's Corner

The Mystery Package Scam

By Greg Collier

Getting an unexpected package can feel like a pleasant surprise. Maybe someone sent you a gift. Maybe a retailer made a mistake. Or maybe you simply forgot about something you ordered.

But sometimes that package is not a gift at all.

The New York State Sheriffs’ Association is warning residents about a scam known as a brushing scam, where people receive inexpensive merchandise they never ordered. While the package itself might contain nothing more than a cheap product, the real purpose can be what happens after it arrives.

What Is a Brushing Scam?

Brushing scams have been around for years, particularly as online shopping has exploded. The basic idea is simple. A seller sends merchandise to someone who never purchased it, then uses the recipient’s information to make it appear that a legitimate customer bought and reviewed the product.

The fake review can make the seller’s merchandise look more popular and trustworthy than it really is.

The person receiving the package may have no idea that their name or other information is being used.

That is concerning enough, but there can be another problem.

An unsolicited package can also be a warning sign that some of your personal information has been exposed.

That does not necessarily mean your bank account has been compromised. It does mean you should take the opportunity to look around and make sure nothing else is wrong.

The QR Code Could Be the Real Trap

One of the most important warnings from the Sheriffs’ Association is not to automatically follow the instructions that come with an unexpected package.

That includes scanning QR codes.

QR codes have become so common that people barely think twice about scanning them anymore. Restaurants use them for menus. Businesses use them for promotions. Retailers use them for customer service.

Scammers know this.

A QR code inside an unsolicited package could direct you to a website designed to steal information or trick you into taking some other action. The same applies to phone numbers and website addresses printed on paperwork inside the package.

The fact that the information is printed on something that looks official does not make it legitimate.

If you have no idea why you received the package in the first place, there is no good reason to immediately follow instructions from the person who supposedly sent it.

Don’t Let Curiosity Make the Decision

This is one of the things that makes scams like this effective. People are naturally curious.

You open the box and find something you never ordered. There may be a note telling you that you have received a special gift, asking you to scan something, or directing you to a website for more information.

It is tempting to find out what is going on.

Instead, stop.

If the package is genuinely legitimate, you can investigate it through a company or retailer using contact information you find independently. You do not need to use the phone number, website, or QR code supplied by the mystery package.

That distinction is important because scammers can make almost anything look legitimate.

Check Your Accounts

An unexpected package should also be a reminder to check your online shopping and financial accounts.

Look for purchases you do not recognize. Check your recent transactions. Pay attention to unusual activity.

If you have reason to believe that one of your accounts has been compromised, change the password.

And don’t reuse the same password across multiple accounts. If a criminal obtains one password and you use it everywhere, a relatively small security problem can quickly become a much bigger one.

The New York State Sheriffs’ Association specifically recommends checking shopping and financial accounts and changing passwords when there is reason to believe an account may have been compromised.

The package may be nothing more than a brushing scam. But there is little downside to making sure your accounts are secure.

What If the Package Belongs to Someone Else?

There is another possibility that people should not overlook.

Sometimes a package really was intended for another person.

If the name on the package is not yours, don’t simply assume the merchandise belongs to you because it showed up at your house.

Check with the delivery company or retailer about the situation rather than opening the package and trying to figure it out yourself.

The same basic rule applies: when something unexpected shows up, slow down before taking action.

Scammers Don’t Need Your Money Immediately

One reason brushing scams can be overlooked is that the victim may not lose any money.

There may be no demand for a payment. Nobody may threaten you. You may not even notice anything suspicious about the package.

But scams don’t always begin with someone asking for money.

Sometimes criminals are trying to collect information. Sometimes they are trying to manipulate a company’s review system. Sometimes they are testing whether information connected to a particular person is accurate.

And sometimes the package is simply the first step toward getting someone to interact with a scammer.

That is why an unexpected package deserves a little more attention than it might normally receive.

Scammers Are Always Looking for New Ways In

The lesson behind the brushing scam goes beyond packages.

Scammers are constantly looking for ways to get people to click, call, scan, respond, or provide information. They take ordinary things that people trust and turn them into opportunities.

An unexpected package is normally something you might associate with a mistake or a surprise.

A QR code is normally just a convenient way to open a website.

A phone number printed on a piece of paper normally looks like a way to contact customer service.

But none of those things are automatically trustworthy.

The safest response to something you did not order is to take a step back and verify what is happening independently.

If you receive an unsolicited package, don’t scan the QR code. Don’t call the number printed inside. Don’t visit the website provided in the package simply because the instructions tell you to.

Check your accounts. Secure your passwords if necessary. Report suspicious packages to the retailer or delivery company.

The package sitting on your doorstep may be harmless.

But when you didn’t order it, don’t let curiosity decide what happens next.