Phone Return Scams Use Fake Shipping Labels to Divert Phones and Leave Victims With Bills

Summary
The article explains how scammers use spoofed calls and fake return labels to divert phones ordered in a victim’s name, leaving victims facing payments. It advises verifying offers and return destinations directly with providers.
Key points
- The described scam begins with a call offering a phone upgrade; the article says scammers may collect personal information for credit checks before ordering a phone in the victim’s name.
- After a real phone is delivered, a follow-up caller claims there was a shipping mistake and supplies a return label or QR code.
- The supplied return instructions may send the phone to an address chosen by criminals instead of the provider’s returns facility, leaving victims with device payments or a contract.
- The article cites Canadian Anti-Fraud Centre warnings and anonymized Malwarebytes Scam Guard records that include impersonation of Canadian provider Rogers.
- Verify offers and return destinations directly with the provider, and do not share account or financial information with an unexpected caller.
- If a phone was sent back, contact the provider through verified details; change any disclosed password or PIN, and preserve messages, labels, tracking details, bills, and call records.
Article Details
- Defense Focus
- Prevent phone-return scams by independently verifying mobile-provider offers and return instructions before sharing information or sending a device.
- Detection Methods
- Watch for unexpected calls offering a free phone, loyalty reward, or unusually attractive upgrade.
- Treat requests for personal, financial, or account information as suspicious.
- Be alert to follow-up calls claiming a wrong or extra device was shipped and asking you to use a caller-provided return label or QR code.
- Verify the return destination directly with the provider using confirmed contact details.
- Data Sources
- Messages and emails
- Shipping labels and tracking details
- Order confirmations and bills
- Timeline of calls
- Defensive Actions
- Pause the conversation and verify the offer separately through the provider’s official channels.
- Do not rely on a return label or QR code supplied by the caller until the provider confirms the destination.
- If a device was sent, contact the provider using verified contact details, identify the affected orders, and request a fraud investigation.
- If account credentials were shared, change the password or PIN through official provider channels and check for unauthorized transactions.
- Preserve messages, emails, labels, tracking details, order confirmations, bills, and a timeline of calls for billing complaints and fraud reports.
MITRE ATT&CK
Vendors
MalwarebytesThe scam usually starts with a call from a spoofed number. In the US we’re seeing several examples in anonymized Malwarebytes Scam Guard records of the impersonated company being Canadian mobile provider Rogers.RogersThe scam usually starts with a call from a spoofed number. In the US we’re seeing several examples in anonymized Malwarebytes Scam Guard records of the impersonated company being Canadian mobile provider Rogers.
Products
Malwarebytes appAvailable with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android. Malwarebytes Premium SecurityAvailable with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android. Malwarebytes Scam GuardThe scam usually starts with a call from a spoofed number. In the US we’re seeing several examples in anonymized Malwarebytes Scam Guard records of the impersonated company being Canadian mobile provider Rogers.
