‘Let’s see what happens’: NYC store goes viral for selling $4 ‘mystery boxes’ — but some packages come with an extra shocking surprise. Here’s what you need to know to protect yourself

Are these sales legal?

Almonte insisted to WABC 7 Eyewitness News that he’s just trying to run a fun, affordable business. Still, he’s aware there may be legal or ethical lines he doesn’t want to cross.

“I’m going to do an investigation to see, because I don’t want to do anything illegal that hurts myself,” Almonte said.

To test the process, reporter Kemberly Richardson purchased one of the returned items and discovered the original buyer’s full name, phone number and home address were still on the box.

She called the phone number, and the stunned buyer confirmed they had returned what was supposed to be a yoga mat. They were shocked to hear their personal information was still floating around on a resold package.

Almonte said he normally uses a marker to obscure personal information and is willing to go further if needed.

“I scratch the name dark that way nobody sees,” he said, adding that if that’s not enough, he’ll remove items from the packaging altogether.

Walmart told Eyewitness News it requires all its liquidators to remove personal customer information before resale. Amazon said it's now investigating the matter, including “the possibility that these products may have been delivered to customer addresses, were stolen and are now being resold by unauthorized third parties.”

Dave Ramsey’s plan has people crushing debt fast

Drowning in debt? Dave Ramsey’s viral 7-step method is helping people wipe it out and finally build real savings. No gimmicks—just a clear plan that works. Moneywise breaks it down so you can get started in minutes. If you’re serious about getting ahead, don’t miss this.

See the steps

What happens to those Amazon packages you return?

Returned Amazon packages don’t always go back on the digital shelves. Many are routed to liquidation warehouses where they’re bundled into pallets and auctioned off to resellers. These buyers — like Almonte — often have no idea what’s in each box until it’s opened.

While this resale model isn’t new, the viral popularity of $4 “mystery boxes” is raising fresh concerns about data privacy and consumer protection.

If you return items online, you might assume your personal data is wiped — but that’s not always the case. In rare instances, as this story highlights, packaging labels with full names, phone numbers and addresses can end up in the hands of strangers.

To protect yourself, make sure to:

• Remove or deface shipping labels before returning items, when possible.
• Avoid returns that include sensitive items or personal documents.
• Monitor your accounts and credit reports for unusual activity, especially if you’ve recently made several returns.

This incident doesn’t necessarily mean you need to stop shopping online, but it’s a reminder that once you send a package back, what happens next is often out of your control.

Major retailers like Walmart and Amazon allow third-party liquidation of returns, and they typically have policies in place to protect customer privacy. But as this case shows, gaps can occur — especially when items move through multiple hands.