Received a free package? Someone might be using your personal information for their gain

QUINCY — Have you ever gotten a package you didn’t order? It might seem like a fun surprise, but it might be the setup for a scam known as brushing.

In a brushing scam, you receive a package you didn’t order, often without a return address. This is usually a setup by companies who found your address online. After they ship the product to you, they can post a fake, positive review in your name to improve their store’s ratings and get more sales.

Reports to BBB Scam Tracker during the last few months show a new twist on brushing scams where the package contains a QR code. The code comes with instructions to scan it to find out who sent the package or how to start a return.

Stop before you scan, though. Scanning the QR code can lead to a phishing website or download malware onto your device.

It might seem like there are no downsides to a free package, but it could be a sign that someone is using your personal information for their own gain. If this happens to you, BBB recommends checking the security of your accounts and notifying the retailer who sent you the package.

What to do if you receive a package you didn’t order:

• Don’t scan QR codes. They might take you to a phishing site that steals your personal information or download malware onto your device.
• Protect your identity. If you did scan the QR code and enter personal information, change your passwords for any accounts that may have been compromised, and enable two-factor authentication. Keep a close eye on credit reports and credit card bills after you receive the package.
• Notify the retailer. If you can tell where the package is from, go directly to the retailer’s website to get their contact information and report the package as a scam. Retailers like Amazon have policies banning brushing and fake reviews, and they will investigate your report.
• Check for fake reviews. If you can identify the company that sent you the packages, look for false reviews in your name and report them to the retailer.
• Pause deliveries. One package is no big deal, but some targets of brushing scams are overwhelmed with a floor of unordered packages, creating a serious problem. If this happens, you may want to consider temporarily refusing package delivery at your home address and directing your real orders to a package acceptance service.
• Keep the package. The one silver lining of brushing scams is that you get to keep the gift – the Federal Trade Commission says you have a legal right to keep unordered merchandise. Don’t try to return it, especially if there are instructions to scan a QR code. It could needlessly compromise more personal information.

Don O’Brien is the regional director for the Quincy Better Business Bureau. Contact him at dobrien@quincybbb.org or 217-209-3972