That Unexpected Package Could Open a Pandora’s Box of Trouble

If you’re like most people, seeing an unexpected package on your doorstep isn’t surprising anymore. With precision marketing and one-click checkout, it’s become incredibly easy to buy something on a whim and forget about it entirely. The habit is now widely known as shopping amnesia.

Kept in alignment with the household budget, this tendency is relatively harmless. At the same time, the now expected nature of unexpected packages is setting online shoppers up for another potentially damaging risk: identity theft. 

According to the U.S. Postal Service, a new scam called “brushing” leverages mystery packages to exploit identities and financial accounts. 

A brushing scam starts with a mystery package on your porch. Shady online sellers use your name and address to stage a phony purchase, then turn around and post a fake, albeit “verified,” review. It’s an easy, affordable — and fraudulent — way to boost their product’s search performance.

How is brushing related to identity theft?

Online crooks are notoriously efficient. When they have access to your personal data, it’s the rare criminal enterprise that would stop at brushing alone. Often, they will look to profit from your private information, selling it on digital black markets or using it themselves for additional phishing or social engineering crimes. 

In other words, if you find yourself on the receiving end of an unexpected package, don’t engage with it. But don’t ignore it either. 

Recognize it for the signal it may very well be; that a nefarious outfit has access to your full name, mailing address, phone number and potentially even your credit card information. All this private data is highly valued by cyber-criminal networks, which assemble and sell identity databases to their networks to extend the profitability of their crimes. 

Steps you can take to protect yourself

So, what should you do if a mystery box makes its way to your porch? U.S. Postal Inspector Kelly McNulty put it best: “Treat your personal information like cash.” If you suspect that someone has your personally identifiable information, follow these steps:

• Ignore the sender. Do not return the package, nor communicate with them. This may verify for the crooks that they have the right information.
• File a report with the U.S. Postal Inspection Service.
• Check your bank accounts for unusual activity. Tell your bank if you find anything.
• Request a credit report to look for anything strange; report any errors or anomalies directly to the credit bureau.
• Update your passwords using a password manager app. If you don’t have an app like this, consider getting one.  

Bank Iowa’s fraud team is always available to you, as well. Visit our fraud resources page if you suspect your personal information has been stolen.