The U.S. Postal Inspection Service is warning the public about a new scam criminals are using to commit identity fraud.
It's called quishing, a form of phishing that uses fake QR codes to trick people into revealing their personal information.
The scammers typically initiate the attack by sharing a message with a QR code via social media, posting it in a public location or sending it unsolicited via text or email. The message will likely be enticing, offering a gift or a discount to willing consumers.
When the viewer scans the QR, they will be taken to the scammer's website, and although it will likely appear legitimate, it's just a deception through which the criminal can gain a person's trust. That trust can be used to garner the user's personal information, including their name, address, banking information, passwords and more.
The scammers can then use your personal information to commit identity fraud, which can entail charging purchases to your bank account, opening new credit card accounts in your name, misusing your social security number and fraudulently changing your address on your accounts, to name a few.
To protect yourself, the U.S. Postal Inspection Service has a few tips:
- Verify the source of a QR code before scanning. You can do this by contacting whichever company is advertised directly. This can also help whichever entity the scammer is impersonating know about the issue and act to prevent it.
- Request a block on all spam messages. You can do this by contacting your carrier's customer service and asking for it to block text messages sent to you as an email.
- Keep your technology up to date to have better protection against scams.
The quishing scam notice comes two weeks after the U.S. Postal Inspection Service warned about another form of phishing called smishing in which scammers send a text message disguised as a government agency to gain victims' personal information. These fraudulent texts could indicate you have a USPS delivery requiring a response, but the agency urges the public not to click the link.
Instead, it asks the public to report the issue to USPS and visit its website to check official delivery tracking information.
