Follow ZDNET: Add us as a preferred source on Google.
ZDNET’s key takeaways
- A phone call telling you to return a new phone may be a scam.
- The scammer simply keeps your phone instead of replacing it.
- Hang up on such calls and contact the carrier directly.
The next time you receive a new mobile phone through the mail, be wary if someone calls claiming that you were sent the wrong device and that you need to return it. That could be a scammer looking to get their hands on your expensive new gadget.
This scam has hit close to home, as one of our editors here at ZDNET was almost a victim. The day after getting a new phone from Spectrum through the mail, she received a call that was tagged as legitimate. Claiming to be from Spectrum, the person on the other end knew her name, address, and the type of phone she had ordered.
The alleged representative told her that a mix-up had occurred with the phone and that she would need to send it back. Heading into a meeting, our editor said she’d call back later to discuss the issue. The rep insisted that he would call her back, which is when she realized this was a scam.
Also: How to turn ChatGPT into a scam detector using the new Malwarebytes integration – for free
Upon calling Spectrum, our editor found out that this is a common swindle making the rounds. The scammer tells you to ship the phone, promising that they’ll send you the correct one in exchange. But of course, the scammer just keeps your phone, which can then be sold or set up using your name and number as a precursor to identity fraud.
In the following days, our editor started getting dozens of spam calls every 15 minutes or so, which could be related to the attempted scam. The concern here is that the scammer was not only aware of her name and address but also knew the exact model phone she had ordered. She asked the Spectrum agent how this might have happened, a question the agent avoided answering.
In a Reddit post that our editor found, an Xfinity customer ran into a similar situation. The poster said that they had just received a new phone through FedEx when, an hour later, someone kept calling from the same number. After the customer finally answered the call, the male voice on the other end identified himself as an Xfinity agent. The rep claimed that the customer was sent the wrong phone and that it would need to be returned.
Also: How to easily add a backup carrier to your phone – for free or cheap
After some pushback, the customer was told to take the phone to a FedEx location and scan the QR code they would receive to generate a mailing label. Smelling something fishy, the customer asked the agent to confirm the account number. After the alleged agent couldn’t answer, the customer finally hung up. Calling the real Xfinity, the customer verified that nothing was wrong with the phone or delivery and that this was a scam.
What’s the story behind this kind of crime?
“This is a classic social engineering scam that’s been adapted for mobile device purchases,” Kern Smith, senior VP of Global Solutions Engineering at mobile security provider Zimperium, told ZDNET. “Attackers impersonate a carrier, claim there’s an issue with a newly delivered phone, and try to convince the customer to return it using a QR code or alternate shipping instructions. It’s designed to exploit trust and urgency at the exact moment someone receives a new device.”
Also: This IRS text message scam keeps fooling people – 3 ways security experts avoid it
Though the tactic itself isn’t new, both the timing and level of detail have evolved, Smith said. The attackers contact their victims almost immediately after they receive a new device. They cite the specific model or carrier for the phone, making the scam more believable. But how do they find those details?
“That kind of information can come from data breaches, compromised email accounts, exposed shipping data, or even malware that monitors notifications,” Smith explained. “Attackers don’t necessarily need full access to a carrier’s systems. Sometimes leaked order confirmations or tracking information are enough to build a convincing story.”
How to protect yourself
To protect yourself against this specific scam, Smith offers some simple advice.
Also: The iPhone’s new call screening feature makes updating to iOS 26 totally worth it for me
“Consumers should never act on an unsolicited call about a delivery issue,” Smith cautioned. “If someone claims there’s a problem, hang up and contact the carrier directly using the official number or app. Be especially cautious of QR codes sent by text or email, as they can redirect to fraudulent sites.”
