Bamboozled: Why a mystery package delivery could mean ID theft (2024)

-43f1fa86a8431078.JPG

Howard Fredrics of Park Ridge, a victim of identity theft, stands outside the Best Buy store in Paramus, NJ. 09/17/2015 (Steve Hockstein | For NJ Advance Media)

What happened to Howard Fredrics could happen to you.

It's a case we've been following since the summer, and now that the holidays are here -- with lots of online shopping and brown boxes arriving on doorsteps -- we expect cons like this to blossom.

The scary part is there's not much you can do to stop it from happening to you, even if you don't shop online. And even when law enforcement makes an effort, catching the scammer is near impossible.

Here's what happened.

Fredrics purchased a $50 Cuisinart coffee maker on eBay from a seller who had a perfect feedback rating. Fredrics used PayPal for the Aug. 12 purchase.

The item arrived at Fredrics' Park Ridge home on Aug. 15.

All was well.

In the early evening of Aug. 19, two more deliveries came to the home. The packages were from Best Buy, and Fredrics' wife, who took in the packages, figured they were items her husband ordered.

But Fredrics wasn't expecting any packages.

"When I opened the larger of the two packages, I discovered to my puzzlement that it contained the identical model of Cuisinart coffee maker that I had recently purchased via eBay, and which I had received a few days previously," Fredrics said.

His first instinct was that he may have inadvertently entered an eBay auction bid on a second coffee maker sold by Best Buy, so he checked his recent eBay, PayPal and bank account activity.

"The results of my thorough search reflected no additional transactions that could have possibly corresponded to the purchase of an additional coffee maker," he said.

Next, he opened the smaller package.

It was a lightning cable for Apple products.

But Fredrics didn't use Apple products, so he didn't understand how the packages came to him. He figured it was somehow a processing mistake by Best Buy, so he did a little more sleuthing.

The two packing slips showed both purchases were made on Aug. 13 -- the same date he made the eBay purchase. They included Fredrics' name and address, but used a telephone number that wasn't his. He traced the phone number online and found it was registered to someone in Rockaway.

A light bulb went off. The notion that a seemingly random order for a lightning cable could have been sent by mistake from Best Buy was possible, but the fact that a second order containing the identical coffee maker he purchased on eBay seemed entirely too coincidental to be a mere order processing error.

"Rather, it suggested something more deliberate and possibly nefarious was going on, perhaps involving the eBay seller or some other unrelated individual who found out that I had purchased that particular coffee maker," Fredrics said.

Something fishy was going on.

DIVING DEEPER

Next, Fredrics used the order numbers and telephone number found on the packing slips to log in as a guest on the Best Buy web site. He saw two orders there, and both used a Gmail email address that used a version of his name -- but wasn't one that matched his actual email.

The order also showed the last four digits of a Visa card that didn't belong to Fredrics.

In addition to the packages he received, the account showed orders for a two-year Geek Squad warranty and an additional cable, which was ready to be picked up at the Paramus Best Buy.

The purchases totaled $104.82.

Fredrics thought his identity had been stolen.

He filed a complaint with the Federal Trade Commission (FTC), and then he contacted Park Ridge police.

Fredrics said the officer he spoke to was very helpful, and he advised Fredrics to contact Best Buy and eBay.

"He also explained to me that in all likelihood, the perpetrator(s) intended to perform a test to see if I would quickly retrieve items shipped to my address and left on my doorstep, in order to locate an address where they could have larger and more expensive fraudulently-obtained merchandise shipped, which could, in turn, be retrieved from the doorstep by someone connected to the perpetrators, when they thought I wasn't at home," Fredrics said.

Fredrics called Best Buy that afternoon.

The rep said that the card used to make the purchases was indeed in Fredrics' name, and Best Buy had access to the credit card number, the I.P. address used to make the purchases, and other data that might help police locate the scammer.

The rep said she couldn't release the information to Fredrics directly, but Best Buy would share it with police upon request. She gave Fredrics specific instructions to share with police so they could make the request.

Lastly, the rep cancelled the store pickup item, and advised Fredrics to return the other items using a pre-paid label the rep would ship to him.

After contacting Equifax to request a 90-day fraud alert on his credit report, Fredrics contacted the police with the information provided by Best Buy.

A few weeks later, Fredrics heard from a detective, who said the prosecutor's office in Bergen County sent a subpoena to Best Buy.

Best Buy responded, saying it didn't have any information relevant to the case.

This made no sense, Fredrics said, because the rep was very detailed about the information Best Buy had and what the police had to do to request it.

"By refusing to cooperate with police investigations, and by instead denying in their response to the subpoena that they even had any relevant information, Best Buy is enabling the perpetrators of identity theft against its customers to continue their activities without being apprehended by law enforcement," he said.

Police had no choice to close the investigation, and that's when Fredrics contacted Bamboozled.

THE NITTY GRITTY

We sent Best Buy the details, including the case numbers and the order numbers.

While it reviewed the case, we reached out to police in Park Ridge.

They couldn't discuss Fredrics' case specifically, but Capt. Joseph Rampolla said identity theft cases happen every day, even a small town like Park Ridge.

Then we heard from Best Buy, and what it shared was a surprise.

Was Best Buy withholding information? Nope. Had the info vanished from its servers? Nope.

The reason it didn't comply with the subpoena was much simpler.

When Best Buy compared the notes and numbers sent by Bamboozled, it realized that the order numbers on the subpoena were missing a digit. That's why Best Buy believed it had no records to share.

So Best Buy asked for prosecutor to re-file the subpoena. It did.

And Best Buy handed over some important information, but it wasn't enough to catch the perpetrators.

The I.P. address used for the fraudulent purchases came from a New Jersey location, said Park Ridge Det. Michael Babco*ck.

He said he sent a detective from that jurisdiction to interview the holder of the address. They learned the household's Wi-Fi wasn't password protected.

Babco*ck said he's seen this happen before, when scammers piggyback on open I.P addresses to commit fraud.

"That's why it's hard to pin it on these people," he said, noting that the Gmail account used for the purchase was a fake.

Babco*ck said he's seen as many as 100 identity theft fraud complaints this year.

That's a hefty number for a town with 8,645 people and 3,283 households, according to the 2010 Census.

Babco*ck said what happened to Fredrics is relatively common. The thief will receive an email about when a package will be delivered, and then they just go pick it up.

He said while police would love to track down the scammers, it's often impractical.

"It ties up a lot of time and to look further than we did, it's tough," he said. "Unless there is a money loss and we catch them red-handed, catching them on a Wi-Fi account is near impossible."

At least Fredrics didn't have a financial loss, but the status of his credit is still unknown.

He's keeping an eye on his credit report. To date, no record of a new Visa card has shown up on his file.

If any unexpected packages end up at your door, remember Fredrics' experience, and know that scammers could be stealing your identity. And if you think your identity has been compromised, follow these stepsto protect yourself.

Have you been Bamboozled? Reach Karin Price Mueller at Bamboozled@NJAdvanceMedia.com. Follow her on Twitter @KPMueller. Find Bamboozled on Facebook. Mueller is also the founder of NJMoneyHelp.com. Stay informed and sign up for NJMoneyHelp.com's weekly e-newsletter.