The U. S. Postal Service (USPS) allows residents to view scanned images of all their incoming mail via a service called Informed Delivery. This week, the U.S. Secret Service issued an internal alert warning that Informed Delivery is being used by cybercriminals to commit identity theft and credit card fraud.
Nationwide Lookout for ID Thieves Latest Scam
The notice went out on November 6 to the law enforcement partners nationwide. In the internal alert stated a recent case of seven people who signed up for stealing credit cards from resident mailboxes after signing up as those victims in Michigan.
The Secret Service alert faults the Informed Delivery feature of “identity and intercept mail, and to further their identity theft fraud schemes…Fraudsters were also observed on criminal forums discussing using the Informed Delivery service to surveil potential identity theft victims…”
These criminals found a way to intercept the USPS notification process by waiting for the cards that are already approved and ordered before signing up for Informed Delivery in the victim’s name.
Credit Card Fraud
There was an incident reported last month that Florida residents began receiving excessive bills for credit cards that had no recollection of having. In one situation, a lady claimed that she had a bill for $2,000 in charges on a card she has never seen before. The only notice she received from USPS is stating that she signed up for Informed Delivery, which she never enrolled herself in.
“According to a police report, someone opened fraudulent credit card accounts and charged more than $14,000 and signed her neighbors up for Informed Delivery, too,” a similar report states. “Photos of what would be in their mail were going to someone else.”
Texas residents had a similar experience. One victim, Chris Torraca, a retired federal bank regulator shares his story.
“Chris discovered it after someone created an account in his name at usps.com,” The Watchdog states. “The thief began receiving photos of Chris’ mail and also opened a bank credit card in Chris’ wife’s name. Postal officials promote the program as a great way to prevent ID theft, but for Chris, that’s what led to it.”
Informed Delivery Issues
The major weaknesses with Informed Delivery are how USPS validates new accounts. They require eligible residents to create a free user account on USPS.com where the user fills out their name, address, and email address. The final step for validation is to answer four “knowledge-based authentication” questions, which are your typical social media multiple-guess questions.
By placing a security freeze on your credit file should be enough to prevent someone from registering an Informed Delivery account in your name, since the USPS validates new users by asking them a series of multiple-guess questions chosen by the big-three credit bureaus. Some state that even with a credit freeze, they were still able to sign up for Informed Delivery.
A safeguard against this attack could be to opt-out of Informed Delivery by emailing the “eSafe Team” at USPS through eSafe@usps.gov.
Be Aware of Phishy Emails
One person emailed informeddelivery@custhelp-dot-com requesting that USPS remove her address from the eligibility for Informed Delivery. In response, they replied asking the resident to answer some of her knowledge-based authentication questions and if anyone had previously signed up for the service at her address.
The USPS is now processing about 20,000 new Informed Delivery account registrations each day and they are deleting new account registrations that they believe may be fraudulent.
Original Article Found Here.