U.S. postal regulations explicitly state that if you receive unsolicited goods in the mail, they are yours to do with as you wish - you have no obligation to the sender. The liability is always with the sender. This is to discourage certain obvious scams.
If something is delivered to you which is clearly intended for someone else (i.e., right address, wrong name), things might get more complicated. I don't know the legalities in that case.
My sister was affected by this a few weeks ago, and I wondered that there was nothing on the news about it at the time.
She got a call saying that her account might have been compromised, and that a new card was on the way. Early on the day after she received the replacement card, and before she had even activated it, there was another call telling her that the new account number had already been used to make several purchases.
Clearly this was a serious breach that continued over at least several days, and was not the fault of a merchant, as they tried to claim.
I have had direct personal experience with this. Some guy committed a 'lewd act' in my neighborhood (he left fluids behind; you figure it out) and the police went door to door. I lived a couple of blocks away, was vaguely the right age, and was home alone. Bingo: prime suspect! They wanted a DNA sample, but I refused, which convinced them that I was guilty. I was definitely a suspect, but it was based on the flimsiest of evidence.
(I was able to prove my innocence - an intolerable concept - but it involved public humiliation, and the police didn't bother to communicate that information to my neighbors, some of whom were convinced I was a sex offender because of all the fuss. Good times.)
Cobol programmers are down in the dumps.