# What is the scam here? **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [March 29, 2024, 12:16am UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534 "2024-03-29T00:16:48Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![batsto](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@batsto](https://boards.straightdope.com/u/batsto)\ **Post date:** [March 29, 2024, 12:16am UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/1 "2024-03-29T00:16:48Z")
So we found a small charge on a credit care we rarely use from [Hallmark.com](http://Hallmark.com) (for an order placed at 1AM, when we were definitely asleep). Called the credit card company, cancelled the card. A few days later, a package comes from Hallmark with a single package of Harry Potter candy in it. We definitely didn’t order it…but what is going on? If they have our CC #, why order something small _and have it shipped to us_? I’ve had a card stolen before, and seen where they make a small transaction I guess to verify the card works, but I’ve never had an item shipped to us. And when we search the order #, we can’t find it associated with any of our e-mail addresses. And then my wife went to [yahoo.com](http://yahoo.com) (she has a Yahoo email she rarely uses), and she’s logged into an account—on her phone—that was just created 2 weeks ago. With a username and password she definitely did not create. She’s never without her phone, it’s hard to conceive of how someone could have created this new account on her phone (we can see welcome to your new e-mail message and nothing else in that account, so we know she was home here when it happened). So are these two events related? And what could the scam possibly be? (customer service at Hallmark is closed now so we can’t call until tomorrow at least) but I’m curious if anyone out there has any insight as to what the heck we could be witnessing. ---
**Author:** ![snfaulkner](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snfaulkner/32/433_2.png) [@snfaulkner](https://boards.straightdope.com/u/snfaulkner)\ **Post date:** [March 29, 2024, 12:20am UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/2 "2024-03-29T00:20:47Z")
ChatGPT is lonely and getting a bit bold? ---
**Author:** ![batsto](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@batsto](https://boards.straightdope.com/u/batsto)\ **Post date:** [March 29, 2024, 3:03pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/3 "2024-03-29T15:03:03Z")
Hah. Maybe. I just don’t see how someone could have logged into a brand new account on her phone while she was in possession of it…nor _why_ someone would do that. ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [March 29, 2024, 3:16pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/4 "2024-03-29T15:16:12Z")
> [@batsto](#): > > Hah. Maybe. I just don’t see how someone could have logged into a brand new account on her phone while she was in possession of it…nor _why_ someone would do that. - Have you had the phone serviced anywhere recently? Any links in emails/texts that got clicked on? ---
**Author:** ![batsto](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@batsto](https://boards.straightdope.com/u/batsto)\ **Post date:** [March 29, 2024, 4:57pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/5 "2024-03-29T16:57:03Z")
Definitely hasn’t been serviced. She hasn’t _knowingly_ clicked any suspicious texts or e-mails. ---
**Author:** ![gnoitall](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@gnoitall](https://boards.straightdope.com/u/gnoitall)\ **Post date:** [March 29, 2024, 5:32pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/6 "2024-03-29T17:32:25Z")
Has she handed the phone to anyone else to use for a few minutes? The least spooky explanation for a new account appearing in a browser in jer phone (assuming the browser configuration isn’t being synced with another computer) is that someone uses that phone long enough to set up a login on that account at that website. ---
**Author:** ![batsto](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@batsto](https://boards.straightdope.com/u/batsto)\ **Post date:** [March 29, 2024, 5:55pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/7 "2024-03-29T17:55:07Z")
Nope. We can see when the account was created, and we were home alone just the two of us all night. ---
**Author:** ![Gatopescado](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gatopescado/32/5711_2.png) [@Gatopescado](https://boards.straightdope.com/u/Gatopescado)\ **Post date:** [March 29, 2024, 7:15pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/8 "2024-03-29T19:15:46Z")
Time for a LifeLock account! ---
**Author:** ![EddyTeddyFreddy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eddyteddyfreddy/32/18796_2.png) [@EddyTeddyFreddy](https://boards.straightdope.com/u/EddyTeddyFreddy)\ **Post date:** [March 29, 2024, 7:25pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/9 "2024-03-29T19:25:37Z")
The phone is tied into an online account where you pay the bills for it, isn’t it? I’d expect that’s where the breach happened. ---
**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\ **Post date:** [March 29, 2024, 7:43pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/10 "2024-03-29T19:43:54Z")
> [@batsto](#): > > Nope. We can see when the account was created, and we were home alone just the two of us all night. We traced the call, it’s coming from inside the house! 😲 ---
**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\ **Post date:** [March 29, 2024, 8:01pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/11 "2024-03-29T20:01:14Z")
The yahoo situation could be because of some mixed up cookies. Those are what the browser and server use to know who you are after you log in. If the backend cookie database on yahoo got messed up, perhaps the cookie that was in her browser got accidentally duplicated for the cookie of someone else’s login. So it could be a coincidence like that perhaps. ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [March 29, 2024, 8:08pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/12 "2024-03-29T20:08:29Z")
Might the Yahoo account be somehow tied to another email account she has, as a backup account for her regular email or something? Still doesn’t explain why her phone was already logged in to it, but maybe if her regular email (that she accesses on her phone) has been compromised… just guessing, anyway. The Hallmark charge: dunno, but maybe it was a test charge, and the scammers made a small purchase, sent to the known address on record to avoid any kind of cross-checking / fraud detection processes, and they were getting set to make other purchases. I’d definitely recommend that she change passwords on pretty much everything, just in case there was some sort of compromise. ---
**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\ **Post date:** [March 29, 2024, 8:16pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/13 "2024-03-29T20:16:47Z")
She can view the recent activity on that yahoo account to see what other IP addresses are accessing it. That may help to figure out where the person is. > **[Find and remove unusual activity on your Yahoo account...](https://help.yahoo.com/kb/SLN2073.html)** > > Monitoring your recent login activity can help you find out if your account has been accessed by unauthorized users. Learn how to view recent sign-in locations and what to do if you see anything suspicious. ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [March 29, 2024, 8:23pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/14 "2024-03-29T20:23:20Z")
There’s a common scam where a thief will order something using a stolen credit card and have it shipped to the cardholder’s address, or some third party’s address, with the intention of grabbing it from the porch before the resident brings it inside. This is safer for the thief than shipping it to the thief’s own address if the fraudulent purchase gets investigated. But normally it’s a high value item like a computer, not a box of candy. ---
**Author:** ![batsto](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@batsto](https://boards.straightdope.com/u/batsto)\ **Post date:** [March 29, 2024, 9:44pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/15 "2024-03-29T21:44:16Z")
> [@Mama\_Zappa](#): > > Might the Yahoo account be somehow tied to another email account she has, as a backup account for her regular email or something? Still doesn’t explain why her phone was already logged in to it, but maybe if her regular email (that she accesses on her phone) has been compromised… just guessing, anyway. We did check all of the other accounts to see if it was linked. This is a _brand new account_ that was just created–the only e-mail in it was the ‘welcome to your new inbox’ e-mail. And the account is a person’s name and a year, like “MarySmith2013” or something like that. We did change all her other passwords. ---
**Author:** ![batsto](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@batsto](https://boards.straightdope.com/u/batsto)\ **Post date:** [March 29, 2024, 9:46pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/16 "2024-03-29T21:46:11Z")
> [@EddyTeddyFreddy](#): > > The phone is tied into an online account where you pay the bills for it, isn’t it? I’d expect that’s where the breach happened. But why would someone create a new Yahoo account ? And log into it on her phone? And there’s no other suspicious activity on the bank account or credit cards, etc. I don’t even know if the two incidents are related, I can’t come up with a scenario where any of this make sense. ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [March 29, 2024, 10:03pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/17 "2024-03-29T22:03:37Z")
Yeah - what I was thinking was: when I set up a yahoo email account, I was able to list my gmail address associated to it for recovery purposes. And I’m signed in to my gmail account on my phone. So a scammer sets up MY gmail as the recovery address, and somehow having that association would let the phone be signed in on the new account. Just grasping at straws here. I have roughly zero idea as to whether that scenario would have that effect. Has your wife checked the account (the yahoo, and the regular) to see if any oddball forward-and-delete rules were set up? I’ve heard that scammers who’ve hacked email may do that. How did she get the password to the new account? The timing of the two events is definitely suspicious. Has she checked that the various online accounts still have the correct email, and ONLY the correct email, associated? ---
**Author:** ![batsto](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@batsto](https://boards.straightdope.com/u/batsto)\ **Post date:** [March 30, 2024, 12:17am UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/18 "2024-03-30T00:17:16Z")
> [@Mama\_Zappa](#): > > Has your wife checked the account (the yahoo, and the regular) to see if any oddball forward-and-delete rules were set up? I’ve heard that scammers who’ve hacked email may do that. How did she get the password to the new account? Whoever set up the account actually saved the password (which we have since changed). There are no rules set up, and no e-mails have come in or out of it (that we can see). ---
**Author:** ![EddyTeddyFreddy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eddyteddyfreddy/32/18796_2.png) [@EddyTeddyFreddy](https://boards.straightdope.com/u/EddyTeddyFreddy)\ **Post date:** [March 30, 2024, 12:44am UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/19 "2024-03-30T00:44:38Z")
If you hadn’t checked your credit statement, spotted the odd little transaction, and deep-sixed card, I’ll bet not too long after the intruder would have proceeded to charge a whole lot of stuff, using the fake Yahoo account to hide their true identity. Probably would have had the goods shipped as a “gift” to some address where they could pick it up and vanish; it’s a thing for scammers like that to have it sent to a real address, have delivery alerts sent to their fake account in the scammee’s name, and swoop in to grab the delivery as soon as it gets dropped off. ---
**Author:** ![batsto](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@batsto](https://boards.straightdope.com/u/batsto)\ **Post date:** [April 1, 2024, 1:24pm UTC](https://boards.straightdope.com/t/what-is-the-scam-here/999534/20 "2024-04-01T13:24:42Z")
Maybe. But why just a single package of candy? And I get making up a fake e-mail address–but why (or how) sign into said account on her phone? Or are these two somehow unrelated events?