New scam tricks victims into handing over personal information

A relatively new scam, known as “brushing” is causing victims to be duped into opening their bank accounts and handing over personal identity to scammers. The scam starts off with an unexpected “gift” sent through the United States Postal Service. The item is sometimes sent through Amazon or another familiar company and is usually an inexpensive trinket like a ring, bracelet, necklace or a Bluetooth speaker. It seems innocent enough, at first.

Initially, the victim thinks he or she is receiving a gift, when, in reality, they are receiving a QR code that, if scanned with any cell phone, allows scammers to access all information on the phone. 

Scammers send the inexpensive items to random addresses. Scanning the QR code on the package signals the scammers that a real person lives at the address and, with that, the scam begins.

Since the package does not show the name of the sender, victims are enticed to scan the code with the promise of revealing the name of the individual who sent the gift. Instead, the victim gives scammers unfettered access to all personal and financial information on the phone. In some cases, scammers are able to literally empty a bank account in seconds once the QR code is scanned.

Mary Mathews at Bank of Lovell said local banks are receiving warnings from law enforcement about this particular scam. She expressed concern that, since it’s relatively new, people may let their guard down and, out of curiosity, scan the code to see who sent the gift. She cautions individuals not to scan the code for any reason. As with many scams, once the money is gone from a bank account, it is gone for good.

An FBI warning regarding the brushing scams stated that the scheme is sometimes used by online sellers to artificially inflate online reviews using the victim’s personal information to create fake positive reviews on online selling platforms like Amazon. The FBI warned that scanning the code potentially puts the victim’s identity at risk, since the whole point of the scam is to harvest personal data that can be compromised later. 

Receiving an unexpected package like this may mean an individual’s personal information has already been compromised to some extent, which can lead to identity theft or other fraudulent activities. The FBI warns victims not to engage with the sender under any circumstances and to report any suspicious packages to the relevant online marketplace and authorities.