This lovely little gift arrived in my inbox this evening - apparently it's been making the rounds since at least January, and possibly last fall:
QUOTE
Dear customer!
Unfortunately we were not able to deliver your postal package sent on the 26th of December in time
because the addressee's address is erroneous.
Please print out the invoice copy attached and collect the package at our office.
United Parcel Service of America.
Accompanying the email was an attachment labeled "UPS invoice_523.zip"
Truly a lame attempt (UPS doesn't send "postal packages", they don't address their customers using "Dear customer!" and they don't have "offices" where you collect your package. Nor do they let things wander around for well over 2 months...etc. etc.) And they don't send you things purportedly from a rogers.com account (my ISP) but actually from New Zealand.
Last time I checked, they had their own domain.
Apparently the payload is something known as TrojanDownloader: Win32/Bredolab.A. I think we'll just leave it zipped up nice and tight in its little "UPS" package and dump it in the nice round filing cabinet in the sky. 
Now...if I could just figure out the source of the slight uptick in spam lately (none to about 3-4 a week)....
QUOTE
just leave a big visible note on the door to leave it on the back porch
And, don't forget to note how expensive the item/items is/are. It's a big help for busy thieves.