X

Post office mail preview gives fraudsters a boost

The Informed Delivery program's apparent unintended consequence: crime.

Laura Hautala Former Senior Writer
Laura wrote about e-commerce and Amazon, and she occasionally covered cool science topics. Previously, she broke down cybersecurity and privacy issues for CNET readers. Laura is based in Tacoma, Washington, and was into sourdough before the pandemic.
Expertise E-commerce, Amazon, earned wage access, online marketplaces, direct to consumer, unions, labor and employment, supply chain, cybersecurity, privacy, stalkerware, hacking. Credentials
  • 2022 Eddie Award for a single article in consumer technology
See full bio
Laura Hautala
2 min read
A blue mailbox with a red flag pointed down.

Fraudsters could see what mail you're receiving before you do if they abuse the USPS' Informed Delivery service.

 Getty Images

Fraudsters are making good use of the US Postal Service's Informed Delivery program.

According to cybersecurity expert Brian Krebs, the US Secret Service issued an internal advisory on Tuesday warning that criminals could use the program to target people for credit card fraud. A Secret Service spokeswoman confirmed to CNET Friday that the agency communicated internally with its field offices about this issue.

The service, which has 13 million users, is supposed to work like this: Post office customers sign up online for Informed Delivery, and then they receive a scan of all incoming mail before it's delivered to their addresses. But thieves have apparently turned that on its head, signing up for Informed Delivery using other people's names. That lets criminals see when credit cards are en route to the homes of postal customers, for example, which they can then go steal from their mailboxes before the real customers retrieves them.

That's what happened in a Michigan case that led to the arrest of seven people, Krebs reported. The USPS said in a statement that the problem has arisen in a small number of cases.

"Unfortunately, in very few cases, an individual's identity has already been compromised by a criminal who then has used it to set up an Informed Delivery account," the USPS said in its statement. Postal customers who find an Informed Deliver account has been set up fraudulently in their name can report the issue at https://uspshelp.custhelp.com/app/ask_id or by calling 1-800-344-7779.

The problem might be more widespread than the one case in Michigan. The reported Secret Service memo warned that identity thieves are sharing techniques for how to use the service for crime. 

"Fraudsters were also observed on criminal forums discussing using the Informed Delivery service to surveil potential identity theft victims," the reported Secret Service memo reads.

In February, the USPS started notifying customers by mail when someone signed up for the Informed Delivery service at their address. 

"Informed Delivery is on the cutting edge of communication trends by helping people manage their mail and make the most of it," the USPS said in its statement. 

First published Nov. 9 at 2:46 p.m. PT.
Updated at 3:07 p.m.: Adds comment from the US Secret Service.

Security:  Stay up-to-date on the latest in breaches, hacks, fixes and all those cybersecurity issues that keep you up at night. 

Taking It to Extremes: Mix insane situations -- erupting volcanoes, nuclear meltdowns, 30-foot waves -- with everyday tech. Here's what happens.