A couple of months ago my wife fell for a similar scam. Caller on her cell phone said he was from our cellular carrier. She was sent a text message with a code, which she read back to him. Caller proceeded to access our on-line account at the carrier, using her cell phone number as the user ID, and purchased two top of the line iPhones, to be shipped to a hotel a couple of blocks from our house under her name and, of course, billed to us.
Fortunately, the carrier put the order on hold and sent her a text message asking her to confirm the order, so I was able to regain access to the account and reverse the purchase.
I called the carrier's security, told them the story and gave them the address of the hotel where the scammer would be picking up the phones he had ordered, but they were not interested in following up.
Why would they be? All they're interested in is avoiding transactions that might be marked as fraudulent, they're not interested in actually fixing the issue. Thats the polices issue, not your carrier.
Following up and putting the scammer in legal trouble means he's no longer going to be around to retry the scam on the next victim (who might actually fall for it).
Fortunately, the carrier put the order on hold and sent her a text message asking her to confirm the order, so I was able to regain access to the account and reverse the purchase.
I called the carrier's security, told them the story and gave them the address of the hotel where the scammer would be picking up the phones he had ordered, but they were not interested in following up.