The Delivery You Didn't Order: Breaking Down the 'Free Phone' Scam

A phone you didn't order arrives on your doorstep. That's not a free gift — it's the first move in a fast-growing identity theft scam that preys on curiosity and trust. Here's what you need to know to protect yourself and your finances.

The 'free phone' scam, also known as the unsolicited package scam, has surged in recent years as fraudsters exploit online ordering systems and stolen personal information. Victims receive a smartphone — often a mid-range Android model — they never purchased. The scam works like this: criminals use a real person's name, address, and sometimes Social Security number to open a cellphone account or order an expensive device using stolen credit card details. The phone arrives at the victim's home, the scammer intercepts it (or the victim unknowingly activates it), and the fraudster gains access to the victim's accounts, credit lines, and personal data. The Federal Trade Commission (FTC) reported a 78% increase in unsolicited package complaints between 2021 and 2023, totaling over 400,000 reports last year. Losses per incident averaged $1,200, with older adults disproportionately targeted.

The scheme exploits a common human reaction: curiosity. Many people open the package, plug in the phone, or attempt to contact a 'customer service' number printed on a fake invoice — all of which can lead to malware installation, phishing, or confirmation of the victim's identity as a valid target. Scammers often use information from recent data breaches (such as those affecting AT&T or T-Mobile) to personalize the delivery. In some variants, the phone arrives with a prepaid return label that leads to a scammer's address, or the packaging mimics a trusted carrier like Apple or Samsung. Security researchers at CNET have documented at least five distinct attack patterns tied to these deliveries, including 'brushing' (creating fake reviews) and 'phishing prep' (setting up a fake carrier login page).

Experts warn that the threat extends beyond the phone itself. Activating the device can give scammers access to your mobile number, enabling SIM-swapping attacks that drain bank accounts and hijack two-factor authentication codes. 'This is a low-cost, high-reward operation for criminals,' says cybersecurity analyst Lisa Forte. 'They spend $50 on a burner phone and potentially steal thousands.' The Better Business Bureau has flagged similar schemes involving tablets, smartwatches, and even smart home speakers.

To combat the trend, the FTC advises consumers to never open unsolicited packages unless they have explicitly ordered an item. If a phone arrives, take a photo of the package, write 'RETURN TO SENDER' on the label, and drop it at a carrier facility. Then file a report with the FTC at ReportFraud.ftc.gov and freeze your credit with all three major bureaus. The agency has also urged wireless carriers to improve order verification — for example, requiring a one-time passcode sent to an existing account before shipping a device. As holiday shopping surges, the free phone scam is expected to spike. Consumers should stay alert: if you didn't order it, don't touch it.