A caller offers you a free phone upgrade or an exclusive deal from your mobile provider. A new phone arrives at your home. So far, everything seems to check out.

Then comes another call: There’s been a shipping mistake. You received the wrong phone, and the company needs you to send it back. You send it back, but the phone never reaches your provider, leaving you with a large charge or long-term contract to pay.

Now police are warning about this scheme after residents lost devices and were left facing the associated payments.

How phone return scams work

The scam usually starts with a call from a spoofed number. In the US we’re seeing several examples in anonymized Malwarebytes Scam Guard records of the impersonated company being Canadian mobile provider Rogers.

The Canadian Anti-Fraud Centre warns:

“After collecting personal information required for credit checks, they’ll order a new phone in your name.”

Next, a genuine device arrives through a legitimate delivery service. That delivery makes the next part of the story easier to believe.

The caller gets back in touch and claims something went wrong. Perhaps the company sent the wrong device, or an extra phone arrived by mistake. To put things right, you need to send it back using the label or shipping QR code they provide.

The shipping label is the real trick. Rather than directing the package to the provider’s returns facility, it sends the device to an address chosen by the criminals.

The result: You no longer have the phone, but your provider has not received it back. Victims can be left facing a contract, financing agreement, or monthly payments for the missing device.

How to stay safe

The most important protection against most types of scams is having someone you can trust and help you decide whether something is a scam. Malwarebytes Scam Guard can be that partner if you’re on your own.

You don’t need to decide on the spot about whether a caller sounds convincing. Break the conversation and verify the offer separately. Pause and check if you encounter any of the following:

• An unexpected call offering a free phone, loyalty reward, or unusually attractive upgrade.
• A caller asking for personal, financial, or account information to arrange the offer.
• A follow-up call claiming the wrong device was shipped or that another delivery mistake needs correcting.
• Instructions to use a return label or QR code supplied by that caller.
• A return destination that you have not confirmed directly with your provider.

If you’ve already sent a phone, contact your mobile provider immediately using verified contact details. Explain that you believe you were targeted by a phone return scam, identify the affected orders, and ask for a fraud investigation.

If you shared your account password or PIN, change it through the provider’s official channels. Rogers advises customers who disclosed their credentials to reset them and contact customer service to check for unauthorized transactions.

Keep the evidence: messages, emails, the shipping label, tracking details, order confirmations, bills, and a timeline of the calls. These records can help support a billing complaint and fraud report.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Recently, our team exposed sophisticated scam kits designed to steal sensitive data and trick consumers. But underground marketplaces are not just for malware and stolen passwords. They also offer services designed to manipulate your opinion of the products and services you buy every day.

In our latest research, we examined cybercrime forums where sellers advertise illicit “reputation management” services. For the right price, these underground operators offer to flood a product with glowing, five-star ratings or remove negative reviews. This shadowy industry works both ways—artificially boosting reputations and deliberately hiding legitimate complaints.

A major shift we are seeing in this space is the adoption of new technology. We also found that cybercriminals are using AI to automate these fake review campaigns. This could allow them to quickly generate realistic, human-sounding feedback in large volumes without much manual effort.

5 stars as a service

In the first example, discovered on a major English-language underground forum, a seller operating under the handle “aqenova” advertises both five-star review generation and negative review removal services. 

The seller’s operations span widely used platforms, including Google, Trustpilot, Yelp, and various mobile app stores. By simply asking prospective buyers, “Just tell me which platform reviews you need?” the seller presents reputation manipulation as something buyers can just order on demand.

Decoding the seller’s FAQ 

Analyzing another seller’s (TrustForge) “Frequently Asked Questions” section revealed some surprising details about how these operations reportedly run behind the scenes. 

First, the seller emphasizes that real people manually post these reviews, offering a guarantee for both successful delivery and “non-drop”—meaning the platform won’t flag and remove the feedback later. 

Remember, a real person posting a review doesn’t mean they’re a real customer. The important question is whether they actually used the product or service and are describing an honest experience.

Second, it appears this is a well-coordinated team effort rather than a solo operation, as the seller charges an extra fee if a buyer wants the main operator to write the review text personally. 

However, what caught our attention most was their confidence in beating platform checks. The seller guarantees their fake reviews will stay active, claiming they rely on a closely guarded “private method.” According to TrustForge’s own statements, this method has allowed them to post more than 10,000 fake reviews.

The clean-up crew: Making bad reviews disappear

A single negative review is often all it takes to create a bad first impression of a product or service. When those negative comments start to pile up, they can completely ruin a business’s reputation and bottom line.

Recognizing how desperate businesses can be to protect their image, our research team discovered underground services specifically offering to remove “fake” or “unfair” reviews from major platforms like Google and Trustpilot. 

Of course, the boundary between what is genuinely fake and what a business simply considers “unfair” can be blurry. Businesses can legitimately challenge fabricated reviews, but these services raise concerns about whether genuine customer complaints could also be targeted.

If legitimate customer complaints disappear, consumers lose information that could help them decide where to spend their money. 

On average, having a single review removed through these underground services costs between $100 and $200. However, the pricing jumps dramatically depending on the platform.

For instance, one seller advertised Airbnb review removal for around $1,100 per review.

When you check a business’s reviews, you’re looking for patterns in other customers’ experiences. If genuine complaints disappear, you could miss repeated problems with refunds, product quality, or customer service.

Artificial intelligence, artificial reviews

During the last few months, our research team spotted an interesting thread on an underground forum where two users discussed using AI to mimic human E-E-A-T.

E-E-A-T stands for Experience, Expertise, Authoritativeness, and Trustworthiness. It is a quality evaluation framework outlined in Google’s Search Quality Rater Guidelines, which human evaluators use to assess content quality. E-E-A-T itself is not a direct ranking factor.

In the discussion we observed, one user asked the community if it was possible to use AI to effectively fake these qualities when writing product reviews and artificially boost website rankings. The answer was a resounding yes. 

Another user claimed they had never experienced problems getting Google to index their completely AI-generated reviews.

Behind the scenes: The IP addresses for fake reviews

To keep fake reviews from being flagged and deleted, scammers need to look like everyday consumers. To help do this, they can use something called “residential and mobile proxies,” which route their traffic through other internet connections to disguise where it comes from.

Think of an IP address as your computer’s caller ID. When scammers use bulk IP addresses from giant data centers, platforms may spot and block that traffic as coming from commercially hosted infrastructure. Residential proxies, on the other hand, route traffic through real, physical home internet connections—just like the Wi-Fi you use in your living room. Mobile proxies work the same way, but use real cellular networks.

Our team recently discovered a seller on an underground forum acting as a direct supplier of these residential and mobile connections. The seller explicitly advertises them as perfect for running fake review campaigns.

How to avoid being misled by fake reviews

The main goal of this research isn’t to make you panic or stop trusting every online review you read. We want to raise awareness about what happens behind the scenes, so you can make more informed buying decisions.

If a product or offer seems too good to be true, but is backed by a mountain of perfect five-star reviews, take a moment to pause. Scammers often use these artificially boosted ratings to make a bad deal look reassuring.

Read recent reviews and some of the middle-rated ones, rather than relying on the overall score. Look for recurring details about the things that matter to you, such as durability, delivery, or getting your money back.

Look for repeated wording or sudden bursts of glowing feedback. These signs don’t prove a review is fake, but they’re reasons to take a closer look. Check the seller’s contact details and return policy, too.

Malwarebytes Browser Guard can also help block scam, phishing, and malicious websites you may encounter while shopping.

Unsure about an offer, even with glowing reviews? Share the link or a screenshot with Malwarebytes Scam Guard for help checking for signs of a scam before you buy.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →