This ‘mailbox fishing’ scam could cost you thousands