What would you do if you opened the door and found an unexpected package? You’d probably be excited – after all, who doesn’t like a surprise?

But what if that “surprise” was actually part of a scam that could compromise your identity and potentially cost you big bucks?

That’s just what’s involved in a scam that’s known as “brushing.” While not new, it appears the scam is making its rounds once again, according to a recent warning from the U.S. Postal Service.

How does brushing work?

Here are the elements of a brushing scam, according to the United States Postal Inspection Service:

• A person received packages containing various sorts of items – typically low cost, or worthless things that don’t cost much to send- that were not ordered. The package may be addressed to the recipient but there is not a return address, or, if there is, it is an international third-party company.
• The package is sent to give the impression the recipient is a verified buyer. After the package is received, a fake review is posted using the recipient’s name on a website. The fake review helps fraudulently boost or inflate a product’s ratings and sales numbers, USPIS said, which could lead to more sales.
• There’s a new version of the scam that also involves quishing, or phishing scams using a QR code. The QR code that accompanies the unsolicited package directs you to scan to learn who sent the gift or to get more information, but instead sends you to a fake website when you scan it. The websites often look legitimate and appear to be a bank, government organization or other institution. Instead, the sites are designed to secure your personally identifiable information, or PII.

What’s the big deal?

So you receive an unsolicited package? Toss it in the trash – no harm, no foul, right?

Wrong, post officials said.

“These packages are often sent by online retailers or third parties who use compromised personal information to create fake transactions. The goal is to inflate product reviews and sales rankings,” U.S. Postal Inspector Kelly McNulty told KOB 4 News in Albuquerque, New Mexico. “If customers receive brushing packages, it’s important to report them to the U.S. Postal Inspection Service and make a plan to review and protect your personal data.”

“This is about more than just a package,” she added. “Treat your personal information like cash.”

Brushing scams can be an indication your personal details – things like your full name, phone number and address – have been compromised. That information can then be used by thieves to steal your identity and your money.

How to protect yourself from brushing scams

Advice from USPIS on how to protect yourself from brushing scams:

• Don’t pay for the merchandise, even if you are contacted and pressured by the sender.
• Return package to sender. If your package has a return address and it is unopened, mark it “return to sender” and it will be returned at no charge.
• If you’ve opened it and don’t want to keep it, throw it out. If it’s something you want to keep, you are allowed to do so and don’t have to pay for it.
• Change your passwords on your accounts. Your PII may have been compromised.
• Closely monitor your credit reports and bills.
• Notify authorities if the merchandise is organic (seeds, foods or plants) or an unknown liquid.
• If the unsolicited merchandise comes from Amazon, eBay or another third-party company, go to that company’s website and file a fraud report. Also, ask the company to remove any fake reviews under your name.