The QR Code You Never Ordered

Episode Description:

In this episode of the CyberBrief Project, we examine a modern twist on the brushing scam — unsolicited packages containing only a printed QR code. This technique uses the physical postal system to bypass traditional detection channels and the familiarity of QR scanning to trigger digital compromise.

Defensive Actions:

• Treat any unexpected package with no return address as suspicious, especially if it contains a QR code.
• Never scan a QR code from an unknown or unsolicited source.
• Use QR scanning apps that display the full destination URL before opening it.
• Ensure mobile devices have up-to-date operating systems and active mobile security software with web protection.
• Educate users that a QR code is essentially a clickable link in disguise and should be treated with the same caution as an unsolicited URL.
• If a QR scan leads to a site requesting sensitive information, close it immediately and do not enter any details.
• Report suspected brushing scams to the FBI’s Internet Crime Complaint Center at ic3.gov, providing full details of the package, QR code, and any related communications.