You probably already know to worry about thieves stealing packages from your porch, but now you also need to be wary of criminals leaving packages there. This is the surprising first step in a scam you may not have heard of.
You open your front door and… surprise! There is a package that appears to have been delivered by FedEx or UPS. Your name is even on the label. Inside is a new phone. The only problem? You’ve never ordered one.
It looks like you just got a free phone, but in all likelihood, you’re about to get scammed. This is the first step in a classic high-tech identity theft scheme, a sort of modern-day Trojan horse. This happened in New York earlier this year, and in Canada and England a few years ago.
The “free phone” scam doesn’t seem to happen very often: it involves a lot of effort on the part of the scammer. But because it starts in the real world rather than with an email, it can be more unexpected than typical scams and therefore easier to fall for.
While this can happen in many different ways, there is usually some combination of a seemingly free phone, a front porch, and a very real criminal who sometimes shows up at your door. We break down three ways this “free phone” scam works, offer tips to help you avoid falling for it, and explain what to do if you are.
How the “free” phone scam works
The free phone scam was carried out in three slightly different variations.
The “Free Porch Phone” Scam
A free phone arrives at your door and you think it’s your lucky day. You activate the phone and enter your personal information. Then it locks up, freezes and darkens. You are now a warning with a useless phone and a scammer has your personal information.
The “We sent you a phone by mistake and we need it back” scam
Sometimes the phone that shows up on your porch is the one you ordered. So it seems very plausible when you get a call and your “carrier” says, oops, we sent you the wrong phone, and we’ll send you a prepaid label so you can send it back to us. Don’t worry, we will send you a replacement phone.
You’re a good person, so you comply by sending your phone in the mail or leaving it in a box outside your door for a “delivery guy” to come pick it up. You later learn that you just gave your brand new phone to a stranger.
The “We Meet on Your Porch and Give You a Free Phone Right Now” Scam
This has happened in states like California, and it’s pretty distressing. The criminal knocks on your door, posing as a Medicare representative, and the pitch is: “Hey, you’re going to get this new phone, no strings attached. I just need to scan your insurance card into this phone. OK, great, thanks. Now, here’s your insurance card, and I’m going to go to my car with your phone and relay this information to my superiors. Then I’ll come right back and give you your phone.”
Unfortunately, the “Medicare representative” returns to his vehicle and drives away. You don’t get a new phone and a stranger runs off with your health insurance information.
Scam Prevention Tips
Scams are becoming more and more sophisticated, but it’s common to think you’ll never fall for them. But scams are everywhere these days. If you don’t want to fall victim to the “free phone” scam or other more common schemes, you should do the following.
Do not open unexpected packages
Ideally, if you receive something in the mail that you’re sure you didn’t order, you simply won’t touch it. But we all know we will. What if it’s a gift or something we ordered and forgot? So yes, there is a good chance that the average person will open it. If it’s a phone and something’s wrong, “don’t worry about the content,” says Patrick Coughlin, CEO and founder of Savi Security, a Los Angeles-based cybersecurity company.
“Getting involved means plugging it in, turning it on, scanning a QR code or inserting a SIM card,” says Coughlin. “Any of these can give a fraudster access to your accounts, your identity or your phone number.”
He adds: “We’ve seen cheap phones preloaded with malware, SIM cards designed to route fraudulent activity through your name, and QR codes that display credential-stealing pages on your device as soon as you scan them. So forget it.”
But don’t leave surprise packages on your porch
Angelo Kevin Brown, an assistant professor of criminology at Arkansas State University, says that sometimes criminals “will send a new iPhone to a person’s home and try to get the package before that person does.”
If they did, they may have purchased the item with your money, Brown adds.
“So if it’s a big-ticket item, it’s often important to check the credit accounts of the people who live in the house to make sure they haven’t opened anything,” Brown says.
And you are not doing anything wrong by accepting the package sent to you. “Legally, under federal regulations, like the FTC, if a package is sent to you by accident, you can keep it, throw it away, or throw it away,” Brown says.
(It’s a different story if something is delivered to your home by mistake and it’s addressed to someone else. In that case, keeping it is considered mail theft.)
When contacting your carrier, always look for their phone number directly on their website. Do not call the number provided in an email or in the packaging of an unexpected delivery.
Oléna Malik/Getty ImagesContact your telephone operator directly
So you received a free phone? Are you suspicious but wondering if it could be real? Call and ask. But make sure to use the official customer service number on your monthly statement. If a phone number is included with this “free” phone, it is likely a criminal’s number.
Refuse “salvage” pickup
If someone shows up at your door claiming there was a shipping error, or they want you to pay shipping for a package they delivered, again, don’t engage. (Tell them you will call the police if necessary.)
“The more you interact with someone who is trying to get or give a package, the more information they can get from you that can be used against you,” Brown says. “In general, it is advisable to never give a package or information to a stranger. If it is an official USPS, UPS, FedEx, etc. package, they will be the ones coming to you, not a stranger and not in a personal vehicle.”
Check your accounts regularly
Checking, savings, retirement. We should all check these accounts anyway, for example, to make sure we’re not spending too much. But if you don’t check your accounts regularly, you may not even know when you’ve been robbed.
Never answer a call identified as suspected spam.
Fajrul Islam/Getty ImagesEnable spam/scam call filtering
Your mobile phone must allow you to filter spam and therefore potential fraudulent calls. Your landline probably can too (try *77, which works on many landlines; it will block calls that deliberately block your caller ID).
Discover anti-phishing tools
Antivirus software will not help you against these free phone scams. But if your desktop, laptop, or devices aren’t protected against malware and computer viruses, it’s only a matter of time before something infects your hardware.
Explore identity protection services
You’ve probably heard some of the big names: LifeLock, Aura, IdentityForce. Identity theft protection services monitor your personal information and if they see a suspicious charge or detect fraudulent activity on your accounts, they will alert you. They also offer other services, like insurance, to cover expenses you incur, like restoring your stolen identity.
Review Credit Monitoring
Credit monitoring services track your reports with the major credit reporting agencies – Equifax, Experian and TransUnion – and if there are any suspicious changes, such as a new account opening in your name, you will be alerted. Often the alerts will tell you what you already know, such as whether you have a car loan in your name. But if a stranger does this, you will quickly find out.
Some antivirus software, like Malwarebytes, includes services like identity theft protection and dark web data tracking.
James Martin/CNETConsider dark web monitoring
These services track and detect personal information sold on the dark web (it sounds made up, like a villain’s lair in a Batman movie, but it’s the term that describes a real, hidden part of the Internet where criminals often access stolen information). If your personal information is sold on the dark web, these services can alert you.
And yes, many identity theft protection services offer dark web monitoring – and credit monitoring – so you could potentially have a single service protecting your personal information rather than multiple services.
Consider Data Removal Services
Data brokers sell our personal information to almost everyone. Data removal services are companies that work to prevent data brokers from selling your information, which could make it less likely that you will become a target.
Stay Vigilant for Ever-Evolving Scams
Law enforcement and legitimate businesses will never ask you for your Social Security number or passwords over the phone to correct a shipping error. Never. Trust your instincts.
Humans versus software
Antivirus software and identity theft protection services can protect you from many, but not all, scams. We humans still have to pick up some of the slack. This table shows where antivirus software and identity protection services can help you and where you can defend yourself.
Comparison between antivirus, identity theft protection and human action
| Antivirus | Identity protection | Humans | |
| Blocks malicious links and phishing sites | ✓ | — | ✓ |
| Detects and blocks malware on a device once installed | ✓ | — | — |
| Alerts you to new accounts opened in your name | — | ✓ | — |
| Monitors credit data and dark web exposure 24/7 | — | ✓ | — |
| May refuse to hand over a package to a stranger at the door | — | — | ✓ |
| Can recognize urgency and pressure tactics during a phone call | — | — | ✓ |
| Can decide not to plug in or activate an unknown device | — | — | ✓ |
| Can verify a phone carrier’s caller by hanging up, finding the carrier’s number themselves, and dialing the real company. | — | — | ✓ |
Essential steps to take if you are targeted by a scam
If you are the victim of a “porch package” scam, or any scam involving your money or identity theft, there are several steps you should take immediately:
- Contact law enforcement: Even if you think you will never get justice, the police may be able to help you. They can at least alert the public to be on the lookout for these types of scams.
- File a fraud alert: Fraud alerts mean that credit bureaus must check with you before opening an account in your name. Contact the three major credit reporting agencies (Equifax, Experian, TransUnion) to place an alert on your credit report.
- Edit operator credentials: If you think someone has access to your phone, update your PIN and password from your cellular service provider immediately.
- Collect evidence for authorities: If you have home security camera footage, you may have footage of a scammer delivering a package. This will interest the police.
