A Quick Q&A with Firefighters First Risk Management
You get home, check the mail and find a plain envelope addressed to you. Inside, there’s no letter, no invoice and no explanation. Just a QR code asking you to scan for more information.
It may seem harmless, but it could be part of a scam designed to collect your personal information.
We asked the Firefighters First Enterprise Risk Management team what these mailings are, why they’re being sent and what members should do if one shows up in their mailbox.
Q: An empty envelope showed up at my home. Is it just junk mail?
Joe Boeser, SVP, Enterprise Risk Management: Not necessarily. In many cases, it’s what security professionals call a brushing scam.
A scammer ships an inexpensive item, or even an empty envelope, to a real address so they can generate a legitimate delivery record. They then use that verified shipment to support fake product reviews or other fraudulent activity.
The envelope itself isn’t dangerous. What’s concerning is that someone already has access to your name and mailing address.
Q: What if there’s a QR code inside asking me to scan for more information?
Chantel Perez, Manager, BSA & AML Programs: Don’t scan it.
Scammers know people are naturally curious when something unexpected arrives in the mail. A QR code can redirect you to a fraudulent website designed to collect usernames, passwords, account information or other personal data.
If a mailing claims to be from Amazon, UPS, FedEx or another company, verify the information through the company’s website or mobile app. Never use a QR code from an unexpected mailing.
Q: Why would someone spend money to mail an empty envelope?
Steven Matus, VP, Enterprise Risk Management: Because the potential payoff can be significant.
The cost of an envelope and postage is small compared to the value of obtaining personal information or account credentials. Scammers rely on curiosity and quick reactions. Their goal is to get you to engage before you stop to verify what’s legitimate.
Q: What should I do if I receive one?
Steven Matus: Follow these simple steps:
- Don’t scan the QR code or call any phone numbers included in the mailing.
- Review your online retail accounts such as Amazon, Walmart or eBay for unauthorized activity.
- Remove outdated payment information stored on shopping websites you no longer use regularly.
- Enable multi-factor authentication on your email, financial and other important accounts.
- Monitor account activity for unfamiliar transactions or unexpected credit inquiries.
Q: What’s the most important thing members should remember?
Joe Boeser: Pause before you act.
Most scams succeed because they create a sense of urgency or curiosity. When something unexpected shows up in your mailbox, take a moment to verify it through trusted sources before responding.
And if you ever have concerns about the security of your accounts, contact Firefighters First. We’re here to help.