Beware of the latest Brushing Scam

[Dane2]

A “brushing” scam is when someone receives an unexpected gift or item not ordered in the mail from a place like Amazon or another company. Examples of gifts include rings, bracelets, necklaces, Bluetooth speakers, etc. The gift will have the recipient’s address, but not include the sender’s information or be from a known retailer. When the recipient opens the package to see what it is and possibly who sent it, there is a QR code to scan to find out who sent the gift.

Once the code is scanned, all the information from that phone will be sent to scammers. They receive all access to the phone. All personal and financial information is accessible to the scammers and often the victim’s bank accounts are drained.

The gift can be kept or thrown away, but the QR code should NOT be scanned for any reason.

 

[LannyPC]

Thanks for that info. This is the first I've heard of it.

 

[CalGalTraveler]

Good to know. Thanks

 

[clifffaith]

Now if I can just keep Cliff from sending money when our packages “are stuck in customs”. I knew something was going on at dinner Thursday when he pulled a credit card out as we waited for our food, then when we got back to our apartment there was a message from (presumably fake caller ID) Synchrony bank at the exact time asking him to push particular buttons. My suspicion is that he also entered our home phone number when scammers expected him to use cell phone number. This percolated in my mind for a couple hours and when he went to bed I snooped and found the scam message on his phone. I cancelled cards Thursday night and new ones arrived yesterday.

 

[SmithOp]

Seems farfetched that a QR code could completely unlock a phone and send all the data.

the USPS does not mention that.

Brushing Scam – United States Postal Inspection Service

www.uspis.gov

 

[dioxide45]

Seems farfetched that a QR code could completely unlock a phone and send all the data.

the USPS does not mention that.

Brushing Scam – United States Postal Inspection Service

www.uspis.gov

I was thinking the same thing. Just like the supposed "say yes" scam. Not aware of any confirmed reports that anyone has fallen victim to this.

Visiting a malicious website could be a problem, but I don't think a website alone can execute any code like this on a modern smart phone. Perhaps it asks you to install an app? But still, it wouldn't send all your data.

 

[RX8]

Seems farfetched that a QR code could completely unlock a phone and send all the data.

the USPS does not mention that.

Brushing Scam – United States Postal Inspection Service

www.uspis.gov

I was thinking the same thing. Just like the supposed "say yes" scam. Not aware of any confirmed reports that anyone has fallen victim to this.

Visiting a malicious website could be a problem, but I don't think a website alone can execute any code like this on a modern smart phone. Perhaps it asks you to install an app? But still, it wouldn't send all your data.

You are both correct. The below quote is from the website Snopes about the brushing scam. While they confirm the brushing scam is real, they labeled the QR piece of it as false.

“However, specific claims made in some of these warnings exaggerate the capabilities of QR codes. The mere act of scanning a QR code does not by itself trigger immediate consequences such as compromised phones, stolen personal and financial information or drained bank accounts. Typically, scammers require further steps from their victims to acquire personal and sensitive information.”