A thief filled out an on-line form at the Best BUY web site to finance the purchase of a new phone.  They financed it with AT&T.  Apparently, no money down so no credit card info was required.  Phone was never activated with AT&T.  Regardless of that, the first payment came due - after about 30 days and we received the AT&T bill today.   They knew our snail mail address and SS#, which is the scary part.  

So, how can this happen when the on-line information from Best Buy asks for a drivers license ID?  Well, the thief provided Shar's SS# instead.   Best Buy did not review this number, it just accepted it (it doesn't even fit).  Best Buy ships the phone (AT&T doesn't know where to because transaction was not theirs).  No immediate billing occurs because phone was never activated.  Why?  Because AT&T chip was removed and thief probably sold iPhone 10 to some unsuspecting person as an unlocked phone.   This is of course where he makes his money.  

So here are some conclusions:
1.  Best Buy fraud security sucks.  No credit check was done.  (We've opted to lock our credit - in 2017)
2.  Best Buy on-line sales programs sucks.  
3.  Best Buy doesn't even know - AT&T will tell them.  That really sucks.
4.  Best Buy will suffer the loss because of #1&2.  

We all lose as they'll just raise prices to cover their losses.