Scammers are employing a new tactic to steal personal and financial information: unsolicited packages containing QR codes. Authorities are warning consumers to be wary of these packages, which often include a generic credit card replica, and to avoid scanning the QR code under any circumstances.
The scheme, which has gained traction in recent months, involves criminals sending unexpected packages to individuals. These packages contain a QR code and a fake credit or debit card, often branded with a familiar bank logo but lacking any personalized details like a name or card number. The QR code is designed to lure recipients into a phishing scam, leading them to websites that request sensitive information such as banking credentials, credit card numbers, and passwords. This type of scam is often referred to as “quishing,” a portmanteau of “QR code” and “phishing.”
According to the Federal Trade Commission (FTC), receiving an unexpected package should immediately raise a red flag. Sandy Ozier, a senior vice president at Commerce Bank specializing in fraud prevention, emphasizes the danger: Their goal is to entice you to scan the QR Code which will then be followed by prompts for you to enter your personal information.
The FTC issued a consumer alert on , specifically addressing this emerging threat.
The tactic builds on existing QR code scams, where malicious QR codes are placed over legitimate ones – a practice observed on parking meters, restaurant menus, and other public surfaces. The Grand Junction Police Department highlighted this in a Facebook post, noting that scammers are actively pretending to be banks to pressure victims into scanning fraudulent codes. Commerce Bank’s guidance, published on , underscores the importance of checking for any signs of tampering before scanning a QR code.
The rise of QR code scams, including quishing, reflects a broader trend of fraudsters exploiting readily available technology to target consumers. QR codes have become ubiquitous in modern life, used for everything from accessing restaurant menus to making payments. This widespread adoption creates a larger attack surface for criminals.
The United States Postal Inspection Service (USPIS) issued a warning on , defining quishing as an identity fraud scam that utilizes QR codes. The USPIS notes that scammers often post physical images of QR codes in high-traffic locations, but the new tactic of sending them directly to homes represents an escalation in sophistication.
Financial institutions are urging customers to remain vigilant and to report any suspicious activity immediately. If a consumer believes they have fallen victim to a quishing scam, Commerce Bank advises contacting their bank, filing a police report, and changing all relevant passwords. The potential consequences of falling for such a scam can be severe, ranging from financial loss to identity theft.
Beyond the unsolicited package scam, consumers should exercise caution with all QR codes. Key preventative measures include visually inspecting the QR code for any signs of tampering or alteration, and being wary of any urgent requests or pressure to scan a code from an unknown source. Always verify the legitimacy of a website before entering any personal or financial information, even if it appears to be from a trusted institution.
The increasing prevalence of these scams also highlights the need for greater consumer education, and awareness. While QR codes offer convenience and efficiency, they also present a significant security risk if not used responsibly. Staying informed about the latest scam tactics and practicing safe online habits are crucial steps in protecting oneself from financial fraud.
The FTC and USPIS are actively investigating these scams and working to disrupt the criminal networks behind them. However, law enforcement officials emphasize that prevention remains the most effective defense. Consumers are encouraged to report any suspicious packages or QR code scams to the FTC at ReportFraud.ftc.gov and to their local law enforcement agencies.
As debit and credit card fraud continues to evolve, consumers must remain proactive in protecting their financial information. Experts advise regularly monitoring account statements for unauthorized transactions and being cautious about sharing personal details online or over the phone. Understanding the latest scam tactics, like quishing, is a critical component of safeguarding against financial loss.