You probably already know you need to worry about thieves stealing packages from your porch, but now you also need to be wary of criminals leaving packages there. This is the surprising first step in a scam you might not have heard of.
You open your front door and -- surprise! There's a package that looks like it was delivered by FedEx or UPS. Your name is even on the label. Inside is a new phone. The only problem? You never ordered one.
It looks like you've just received a free phone, but in all likelihood, you're about to get scammed. This is the first stage of a classic high-tech identity theft scheme, sort of a modern-day Trojan horse. It happened in New York earlier this year, and in Canada and England a few years ago.
The "free phone" scam doesn't seem to happen very often -- it does involve a lot of effort on the scammer's part. But since it begins in the real world rather than with an email, it might be more unexpected than typical scams and therefore easier to fall for.
Although it can happen in a few different ways, there is usually some combination of a seemingly free phone, a front porch and a very real criminal sometimes showing up at your door. We break down three ways this "free phone" scam works, offer tips to help you avoid being taken in by it and explain what steps to take if you are.
How the 'free' phone scam works
The free phone scam has been carried out in three slightly different variations.
The 'free phone on the porch' scam
A free phone arrives on your doorstep, and you figure it's your lucky day. You activate the phone and input your personal information. Then it locks, freezes up and goes dark. You are now a cautionary tale with a useless phone, and some scammer out there has your personal information.
The 'We sent you a phone by mistake and need it back' scam
Sometimes the phone that appears on your porch is one you did order. So it sounds very plausible when you get a call and your "carrier" tells you, whoops, we sent you the wrong phone, and we'll send you a prepaid label so you can send it back to us. Don't worry, we'll send you a replacement phone.
You're a good person, so you comply by mailing your phone or leaving it in a box on your doorstep for a "delivery person" to pick it up. You later learn that you've just given away your brand-new phone to a stranger.
The 'We are meeting on your porch and giving you a free phone right now' scam
This has happened in states like California, and it's pretty nerve-racking. The criminal knocks on your door, posing as a representative of Medicare, and the pitch goes: "Hey, you're going to get this new phone, no strings attached. I just need to scan your insurance card into this phone. OK, great, thanks. Now, here's your insurance card, and I'm going to go to my car with your phone and call this information into my superiors. Then I'll come right back and give you your phone."
Unfortunately, the "Medicare representative" goes back to their vehicle and zooms away. You have no new phone, and some stranger is speeding away with your health insurance information.
Scam prevention tips
Scams are increasingly getting more sophisticated, but it's common to think you will never fall for one. But scams are pretty much everywhere these days. If you don't want to be a victim of the "free phone" scam or other, more common schemes, you'll want to do the following.
Do not open unexpected packages
Ideally, if you get something in the mail that you're certain you didn't order, you would simply not touch it. But we all know that we will. What if it's a gift or something we ordered and forgot about? So, yeah, odds are the average person will open it. If it is something like a phone and something feels off, "don't engage with the contents," says Patrick Coughlin, CEO and a founder of Savi Security, a Los Angeles-based cybersecurity company.
"Engaging means plugging it in, powering it on, scanning a QR code or inserting a SIM card," Coughlin says. "Any one of those can hand a scammer access to your accounts, your identity, or your phone number."
He adds: "We've seen cheap phones preloaded with malware, SIM cards designed to route fraudulent activity through your name and QR codes that drop credential-stealing pages on your device the second you scan them. So leave it alone."
But don't leave a surprise package on your porch
Angelo Kevin Brown, an assistant professor of criminology at Arkansas State University, says that sometimes criminals "will send a new iPhone to a person's house and try to get the package before the person does."
If they've done that, they may have purchased the item with your money, Brown adds.
"So, if it is an expensive item, it is often important to check the credit accounts of those who live in the home to make sure nothing has been opened by them," Brown says.
And you're doing nothing wrong by taking the package sent to you. "Legally, under federal regulation, such as with the FTC, if a package is sent to you by accident, you can keep it, discard it or throw it away," Brown says.
(It's another story if something is delivered to your home by mistake, and it's addressed to another person. In that case, keeping it is considered mail theft.)
When contacting your carrier, always look up their phone number directly on their website. Don't call the number included in an email or in the packaging of an unexpected delivery.
Olena Malik/Getty ImagesContact your phone carrier directly
So you received a free phone? You're suspicious but wonder if it could be real? Call and ask. But be sure to use the official customer service number on your monthly statement. If a phone number is included with this "free" phone, it is likely to be a criminal's number.
Refuse the 'recovery' pickup
If someone shows up at your door claiming there was a shipping error, or they want you to pay a shipping fee for a package they delivered, again, don't engage. (Tell them you'll call the police if you have to.)
"The more you interact with someone trying to get or give a package, the more information they may get from you that can be used against you," Brown says. "Generally, the advice is to never give a stranger a package or information. If it is an official USPS, UPS, FedEx, etc., package, they will be the ones coming to you, not a stranger, and not in a personal vehicle."
Check your accounts regularly
Checking, savings, retirement. We should all be checking those accounts anyway, for instance, to make sure we aren't overspending. But if you aren't checking your accounts routinely, you might not even know when you've been robbed.
Never answer a call that is identified as suspected spam.
Fajrul Islam/Getty ImagesEnable spam/scam call filtering
Your mobile phone should allow you to filter out spam and thus potential scam calls. Your landline likely can as well (try *77, which works on a lot of landlines; it'll block calls that purposefully block your caller ID).
Check out anti-phishing tools
Antivirus software won't help you with these free phone scams. But if your desktop or laptop or devices aren't protected from malware and computer viruses, it's just a matter of time before something infects your hardware.
Look into identity protection services
You've likely heard some of the big names out there -- LifeLock, Aura, IdentityForce. Identity theft protection services monitor your personal information, and if they see a suspicious charge or detect fraudulent activity on your accounts, they'll alert you. They also offer other services, like insurance, to cover expenses you incur, such as restoring your stolen identity.
Look into credit monitoring
Credit monitoring services track your reports from the major credit bureaus -- Equifax, Experian and TransUnion -- and if there are suspicious changes, like a new account opening up in your name, you'll be alerted. Often, the alerts will tell you what you already know, like you took out a car loan in your name. But if a stranger does that, you'll quickly find out.
Some antivirus software, like Malwarebytes, includes services like identity theft protection and dark-web data tracking.
James Martin/CNETConsider dark-web monitoring
These services track and detect personal information being sold on the dark web (it sounds made up, like the lair of a villain in a Batman movie, but it's the term that describes an actual hidden part of the internet where criminals often access stolen information). If your personal information is being sold on the dark web, these services can alert you.
And, yes, many identity theft protection services offer dark-web monitoring -- and credit monitoring -- so you could potentially have one service protecting your personal information rather than multiple services.
Consider data removal services
Data brokers sell our personal information to just about everybody. Data removal services are companies that work to stop data brokers from selling your information, which could make it less likely that you become a target.
Stay alert against evolving scams
Law enforcement and legitimate businesses will never, ever ask for your Social Security number or passwords over the phone to fix a shipping error. Ever. Trust your gut.
Humans vs. software
Antivirus software and identity theft protection services can protect you from many scams, but not all of them. We humans still have to pick up some of the slack. This table shows where antivirus software and identity protection services can help and where you can be your own defense.
Antivirus, ID theft protection and human action, compared
| Antivirus | Identity protection | Humans | |
| Blocks malicious links and phishing sites | ✓ | — | ✓ |
| Detects and blocks malware on a device once installed | ✓ | — | — |
| Alerts you to new accounts opened in your name | — | ✓ | — |
| Monitors credit and dark-web data exposure 24/7 | — | ✓ | — |
| Can refuse to hand over a package to a stranger at the door | — | — | ✓ |
| Can recognize urgency and pressure tactics on a phone call | — | — | ✓ |
| Can decide not to plug in or activate an unknown device | — | — | ✓ |
| Can verify a phone carrier caller by hanging up and finding the carrier's number on their own and dialing the real company | — | — | ✓ |
Essential steps to take if you're targeted by a scam
If you're the victim of a "package on the porch" scam, or any scam involving your money or identity theft, you'll want to take several steps right away:
- Contact law enforcement: Even if you think you'll never get justice, the police may be able to help. They can at least alert the public to be on the lookout for these types of scams.
- File a fraud alert: Fraud alerts mean that the credit bureaus have to check with you before opening an account in your name. Contact the three major credit bureaus (Equifax, Experian, TransUnion) to place an alert on your credit report.
- Change carrier credentials: If you think somebody has access to your phone, update your PIN and password for your cellular service provider immediately.
- Collect evidence for the authorities: If you have home security camera footage, you may have footage of a scammer delivering a package. The police will be interested in that.