Danger, Junk Mail

The nice lady in the card store told me I didn’t need to give her any information because it was on my coupon. I left the store wondering exactly what information that was.

According to Jose Lejin, a technical expert I contacted, I needn’t have worried. The barcode with my information told her the coupon belonged to me and might have been tied to a specific promotion. There is a privacy issue here in that the retailer may know the time and place I redeemed their offer.

In our correspondence, Jose assumed that this was probably a mass-distributed coupon and not a major concern. A barcode is a concern when it is linked to a loyalty account, such as at your grocery store or country club. If your name and address are attached, someone could copy it, perhaps reuse it, or become too familiar with your shopping habits.

The bigger concern here is the pharmacy receipt. The stickers contained on them are a key to your prescription file. Consider all your pharmacy receipts like you would private mail and destroy them appropriately.

What about QR Codes? Here, both the experts I spoke with say caution is necessary. Mona Rajhans at Palo Alto Networks defined a QR code as a URL in disguise. When you scan it, your phone follows a link which could reach a fake login page, and in that instant your credentials are gone. She relates that her company catches 11,000 malicious QR codes in a single day.

QR codes are most problematic on a parking meter or in a restaurant. A fake code could have been put over the original one, and your money could go to someone else entirely.

The best way to protect yourself is to look at the code you are shown before you enter any information. Let’s say you’re standing in front of your favorite restaurant. If what you’re seeing is a shortened link, has random characters, or the name of the restaurant is misspelled, leave. The code is harmless. What you point to is not.

There are instances where correspondence from a retailer contains both a barcode and a QR Code and an order number with your name. I red flag those as providing just enough information for a phone call to a retailer that could lead to an unwanted purchase.

If you’re like me, you probably are in the habit of “junking’ your junk mail. I hope I’ve caused you to step back and think about the proper disposal method.