Garbage is a goldmine for criminals who know where to look
En el gesto más cotidiano —abrir un paquete y tirar la caja— se esconde una vulnerabilidad que los ciberdelincuentes explotan con una técnica tan antigua como los basureros: el 'trashing'. Las etiquetas de envío, con nombre, dirección y teléfono, se convierten en llaves maestras para el robo de identidad y el fraude financiero. Autoridades españolas e institutos de ciberseguridad llevan años advirtiendo que la prevención no requiere tecnología, sino conciencia y un marcador permanente.
- Millones de etiquetas con datos personales se desechan intactas cada día, ofreciendo a los delincuentes un acceso directo a la identidad de sus víctimas sin necesidad de hackear nada.
- Con solo un nombre y una dirección, un criminal puede suplantar identidades, solicitar préstamos no autorizados, generar llamadas de fraude y vender los datos a redes criminales más amplias.
- La Guardia Civil y el Incibe han elevado el nivel de alerta pública, documentando cómo una simple etiqueta de cartón puede convertirse en el punto de partida de un perfil delictivo completo.
- La solución existe y está al alcance de cualquiera: destruir etiquetas antes de tirar los paquetes, triturar documentos sensibles y pedir a las empresas de mensajería que omitan datos adicionales en el exterior.
- Quienes adoptan estas medidas mínimas se vuelven objetivos menos rentables; los delincuentes, pragmáticos por naturaleza, simplemente buscan el siguiente blanco más fácil.
Cada vez que alguien abre un paquete y tira la caja al reciclaje sin retirar la etiqueta, está dejando su nombre, dirección y teléfono a disposición de cualquiera que se tome la molestia de mirar. Esta rutina, repetida millones de veces al día, es el punto de partida de una técnica criminal conocida como 'trashing' o 'dumpster diving': recuperar paquetes desechados para extraer datos personales y usarlos en fraudes de identidad.
Lo que hace especialmente peligrosa esta práctica es su simplicidad. No requiere conocimientos técnicos ni herramientas sofisticadas. Basta con acceder a un contenedor y saber qué buscar. A partir de una etiqueta, un delincuente puede hacerse pasar por el banco de la víctima, solicitar créditos a su nombre o vender sus datos a terceros. Si en la misma bolsa de basura hay recibos, extractos bancarios o facturas, el criminal obtiene un perfil completo.
La Guardia Civil española publicó un vídeo de advertencia específicamente sobre este riesgo, y el Instituto Nacional de Ciberseguridad (Incibe) ha documentado qué tipo de información buscan los delincuentes en los residuos: números de tarjeta, contraseñas, correos electrónicos. La Universidad Autónoma de Chihuahua define formalmente el trashing como la obtención de información en archivos desechados con fines de fraude y robo de identidad.
Las medidas preventivas son accesibles y concretas: despegar o destruir la etiqueta antes de tirar la caja, tachar los datos con un marcador permanente si no es posible retirarla, triturar documentos con información sensible y solicitar a las empresas de mensajería que no incluyan datos adicionales en el exterior del paquete. Son acciones que cuestan minutos. No tomarlas puede costar meses de recuperación, cuentas bloqueadas y el agotador proceso de demostrar la propia identidad ante instituciones que dudan de ella.
You buy something online. It arrives at your door. You tear open the box, pull out what you ordered, and toss the cardboard into the recycling bin. The label is still stuck to it—your name, your address, your phone number, all of it readable to anyone who looks. This ordinary moment, repeated millions of times a day across the world, is the opening move in a crime that security experts have been quietly warning about for years.
The practice has a name: trashing, or dumpster diving. It sounds quaint, almost nostalgic, but it is a straightforward criminal technique. Someone retrieves discarded packages from trash bins or recycling centers, reads the label, and now they have your personal information. What happens next is where the real damage begins. They call you pretending to be from your bank. They apply for loans in your name. They request services you never authorized. They sell your data to other criminals. The label on a cardboard box becomes the skeleton key to your financial life.
Spain's Guardia Civil released a video warning citizens about exactly this vulnerability, emphasizing that shipping labels must be destroyed before disposal. The Spanish National Institute of Cybersecurity, known as Incibe, has documented what criminals actually hunt for in discarded packages: credit card numbers, email addresses, passwords, anything that moves money or opens doors. The label is just the beginning. If your documents are also in that bin—receipts, account statements, old bills—the criminal now has a complete profile.
The University of Autónoma de Chihuahua defines trashing formally as obtaining information from discarded files and documents for the purpose of committing fraud and identity theft. It is not sophisticated. It does not require hacking skills or expensive tools. It requires only access to garbage and the willingness to sort through it. This is what makes it so effective and so hard to stop at scale.
The defenses are simple but require discipline. Remove the label entirely before throwing away the box—peel it off, cut it out, or if the adhesive makes that impossible, obscure it completely. Use a permanent marker, paint, rubbing alcohol, spray paint, anything that renders the text unreadable. Shred documents that contain sensitive information: tickets, receipts, bank statements, anything with your name and a number. When you order something, ask the delivery company not to write additional information on the box—no apartment numbers, no gate codes, no notes about where to leave the package. If someone else receives the package on your behalf, make sure their name and details are not written on the exterior. Remove tape and labels that might identify the retailer or the contents.
These are small actions, almost trivial in isolation. But they accumulate. A criminal looking through a bin full of boxes where every label has been destroyed, where no documents remain, where no identifying marks are visible, will move on to the next bin. They are looking for easy targets. Make yourself a harder target, and you become someone else's problem. The cost of prevention is measured in minutes and the price of a marker. The cost of not preventing it is measured in months of fraud recovery, frozen accounts, and the slow, grinding work of proving you are who you say you are.
Notable Quotes
Trashing is the practice of obtaining information from discarded files and documents for the purpose of committing fraud and identity theft— University of Autónoma de Chihuahua
Cybercriminals search discarded boxes and envelopes for passwords, credit card numbers, email addresses, and other sensitive information— Spain's National Institute of Cybersecurity (Incibe)
The Hearth Conversation Another angle on the story
Why does a shipping label matter so much? It's just a piece of paper with a name and address.
Because it's a complete map. Your name, your address, your phone number—that's enough to impersonate you to a bank or a loan officer. They don't need to hack anything. They just need what you threw away.
But who actually goes through trash looking for packages?
People who understand that garbage is a goldmine. It's not random. Criminals know that discarded boxes contain not just labels but often documents, receipts, statements. One box can give them everything they need.
What's the worst thing they can do with that information?
Take out loans in your name. Open credit cards. Drain accounts. The label is the entry point, but if they also find your statements or old bills, they have enough to convince institutions they are you.
So it's not just about spam calls?
Spam calls are the least of it. Those are annoying. Identity theft is financial devastation. It can take months or years to untangle.
Why isn't this more widely known?
It is known, but people don't think it applies to them. Throwing away a box seems harmless. The connection between that moment and fraud feels distant. But the connection is direct.
What's the easiest thing someone can do right now?
Destroy the label before the box leaves your house. A marker, a knife, a lighter—any of those work. It takes thirty seconds and closes the door.