Hilary Smith opened the front door of her St. Paul home and expected to find a package.

Instead, she found a neatly folded handwritten note on the steps right where the Amazon package had been delivered a few hours earlier.

"So just a quick little thank you for leaving me the opportunity of stealing your package," the note read. "Very nice of you. Thank you, the new owner of your package."

Dumbfounded, she thought a neighbor had played a joke. But no, the box holding a phone charger — a gift for her boss — was gone, another example of thieves taking advantage of the avalanche of online holiday orders. More deliveries left at homes unattended means more opportunities for thieves playing the part of the Grinch.

"It's creepy and I'm mad," Smith said Friday, a day after her package was swiped. "It's brazen and arrogant."

St. Paul police have taken 94 reports of stolen packages since Oct. 1, but the numbers are likely much higher since thefts are not always reported, said police spokesman Sgt. Mike Ernster.

The problem isn't confined to one city, of course. In Hopkins, police Monday had three reports of packages stolen on the same block around the same time. Sgt. Mike Glassberg said thieves often follow delivery trucks and hit several houses in the same area.

With the convenience and prevalence of online shopping, "it has become a big opportunity for thefts," Glassberg said.

Nationwide, 11 million homeowners have had a package stolen in the past year, according a study from research firm Edelman Intelligence. The firm found that 74% of packages are stolen from homes during the day when homeowners are at work. The average value of the stolen packages? About $50 to $100.

Until this week, Smith had never had a package stolen — maybe, she said, because she usually has packages sent to a secure address.

Police, the post office and shipping companies suggest requiring a signature upon delivery or having packages delivered to a workplace or a trusted neighbor who is home. The U.S. Postal Service says recipients can have parcels held at the post office or customize a delivery to be left at a specified location. Amazon has a real-time tracking service that allows recipients to track packages, even detailing how many stops a driver will make, so they can be home when deliveries get there.

Several companies also will deliver packages to lockers in grocery stores, shopping malls, office buildings and apartments.

Around the country, as many as 1.7 million packages are stolen or go missing every day — adding up to more than $25 million in lost goods and services, says José Holguín-Veras, an engineering professor at Rensselaer Polytechnic Institute and director of the Center of Excellence for Sustainable Urban Freight Systems.

Holguín-Veras, who collects data about deliveries, estimates that about 490,000 deliveries are made in the Twin Cities area each day, giving porch pirates ample opportunity to engage in an activity he said is "tantamount to shoplifting."

Police say they are working hard to find and arrest thieves, but it's difficult to catch them.

In Minneapolis a few years ago, a frustrated victim left boxes of dog poop as payback for would-be thieves — a move Smith said she copied after her package was stolen.

In St. Paul, police have put out bait packages in hopes they will be stolen as police watch. They also collect videos from victims' doorbells and surveillance cameras and post them online to generate leads and "put a face to the crime," Ernster said. Images posted online have led to some arrests, he said.

Ernster said the thank-you note was "unbelievable."

The Police Department tweeted: "Porch pirates are the scourge of the holiday season, creeping around neighborhoods at all hours of the day, tiptoeing up to homes, stealing packages that don't belong to them. And now they're leaving thank you notes?"

Smith reluctantly laughed it off and mockingly said she appreciated the crook's thoughtfulness.

"I do like a well-crafted thank-you note," she said, "but that's when I give a gift."