If a company sends unsolicited merchandise and asks for payment, the recipient does not have to pay and can retain the merchandise. If this was the result of carding, then it is receipt of stolen property; granted, it may be entirely innocent, but the potential difficulty and expense of proving that is not worth a stack of video cards. Personally, I'd contact Nvidia and offer to send 10 back at my expense. (And yes, I get that it's not real; but, it is a fun hypothetical!)