Possible scam

Have you shared personal info ? Do you see any update that were made to your account? This sounds and looks like a scam. 

When handling an unsolicited device, don't use it or follow any return instructions included in the package since they might be fraudulent. Contact Koodo directly to see if the shipment is actually legitimate. If it's not, they'll tell you whether to discard the device or return it to the sender without using the address provided in the box. Also, never give out personal info like your PIN to a caller claiming to be from Koodo unless you started the call yourself. Always verify offers by scheduling an official callback with Koodo before you do anything. Still, if you're unsure, just assume it's a scam and protect your info.

Hi ​@Lualvert 

This was definitely a scam tentative, so you did very well by checking the address, thank you for sharing!

The correct address for returns is always printed on the original shipping box and in case of a return, the phone should be returned only to that address indicated on the yellow imprint displayed on the original box the device was shipped in.

We recommend updating your Koodo self serve credentials and choose a stronger password.

For the phone that you received, you can definitely return it and once returned and the tab balance reversed, you can place the order for the correct one. More about the return process can be found here https://www.koodomobile.com/en/help/article-categories/returns-and-exchanges

Here is a list of Known scams and fraud and steps to take in case you disclosed any personal information to the scammer/fraudster

Glad to hear that you were able to double check before you went ahead! It is a new tactic to target unsuspecting customers.

I would suggest you to report this incident to your local police and the Canadian Anti-Fraud Centre and set up fraud alerts with Equifax and TransUnion.

100% a scam. I wish Koodo would stop their cold calling practices as it opens the door for scammers which leads customers to think they are talking to Koodo. Anyway from web search:

This is a well-known fraud technique where scammers use your personal information to upgrade a line or open a new account in your name. They intercept the device or, more commonly, have it delivered to your actual address so you receive it. 

Once it arrives, they impersonate your carrier (e.g., Rogers, Bell, Telus) claiming the wrong phone was sent by mistake, and ask you to ship it back to a specific address using a prepaid label. If you comply, the scammer receives the device, and you are left with the debt for the phone. 

Protect yourself and resolve this issue with the following steps:

• Do not ship the phone: Never mail devices to random residential addresses, and do not follow the return instructions provided by an unsolicited caller. 
• Contact your carrier directly: Call your provider using the official, verified phone number from their website (e.g., Rogers, Bell, Telus, or Fido). Ask the fraud department to investigate the shipment and flag your account.
• Secure your accounts: Change your online account passwords and enable Two-Factor Authentication (2FA). Check if unauthorized address or plan changes were made. 
• Report the fraud: File a report with your local police and submit it to the Canadian Anti-Fraud Centre. 
• Protect your credit: Contact credit bureaus like Equifax Canada and TransUnion Canada to place a fraud alert on your profile.