With Black Friday just days away, a sinister new scam is exploiting the UK's parcel delivery chaos, pushing dangerous cyber-attacks straight through people's front doors.
The Perfect Storm for Fraud
As millions of packages surge through the postal network, cybercriminals are capitalising on the confusion. Technology specialist Theodore Ullrich from Tomorrow Lab reports a significant intensification of this threat, precisely because consumers are anticipating numerous deliveries.
He explains that when buyers are tracking multiple orders, they become far more likely to trust an unexpected parcel arriving at their home. "That fleeting moment of confidence is precisely what fraudsters depend upon and represents the most perilous instant of the entire assault," Ullrich warns.
How the QR Code and Brushing Scam Works
This modern attack combines two deceptive techniques: a resurrected brushing scam and the rapidly growing threat of quishing (QR code phishing).
Previously, brushing involved criminals sending unsolicited items to then post fake reviews. Now, a dangerous second layer has been added. "Attackers are placing QR codes in or on the parcels and those codes connect victims to phishing infrastructure," Ullrich clarifies. "It is not about reviews anymore. It is about data and ultimately money."
When a recipient scans the code, believing it to be for tracking or returns, they are directed to a sophisticated fake website designed to steal personal and banking information. "I have seen cases where the victim had money leaving their account before they even realised the page was fake," the expert revealed.
Protecting Yourself This Black Friday
Ullrich emphasises that simply ignoring a suspicious parcel is not enough. He provides a clear action plan for consumers:
- Do not scan any QR codes on unexpected packaging.
- Contact companies through official channels found on their verified website, not using any contact details printed on the suspicious box.
- If a scammer knows your name and address, change passwords for key accounts like email, banking, and shopping sites.
- Enable two-factor authentication and monitor bank statements closely for small, test transactions.
Scammers are increasingly brazen, using easily accessible personal data from past breaches or public directories to make parcels appear legitimate. With the hallways of the nation filling with cardboard, Ullrich urges the public to stay alert. "The way to beat them is to slow down," he advises. "If you did not order it, do not trust it. It is far better to be overly cautious than to discover too late that you have handed over your entire identity."
