Slashdot Mirror
US Secret Service Warns ID Thieves are Abusing USPS's Mail Scanning Service (krebsonsecurity.com)
Brian Krebs reports: A year ago, KrebsOnSecurity warned that "Informed Delivery," a new offering from the U.S. Postal Service (USPS) that lets residents view scanned images of all incoming mail, was likely to be abused by identity thieves and other fraudsters unless the USPS beefed up security around the program and made it easier for people to opt out. This week, the U.S. Secret Service issued an internal alert warning that many of its field offices have reported crooks are indeed using Informed Delivery to commit various identity theft and credit card fraud schemes.
The internal alert -- sent by the Secret Service on Nov. 6 to its law enforcement partners nationwide -- references a recent case in Michigan in which seven people were arrested for allegedly stealing credit cards from resident mailboxes after signing up as those victims at the USPS's Web site. According to the Secret Service alert, the accused used the Informed Delivery feature "to identify and intercept mail, and to further their identity theft fraud schemes."
The internal alert -- sent by the Secret Service on Nov. 6 to its law enforcement partners nationwide -- references a recent case in Michigan in which seven people were arrested for allegedly stealing credit cards from resident mailboxes after signing up as those victims at the USPS's Web site. According to the Secret Service alert, the accused used the Informed Delivery feature "to identify and intercept mail, and to further their identity theft fraud schemes."
They only give you photos of your flat mail. Packages don't seem to get photographed, ever, even just padded envelopes. So the stuff I want most to know about, they don't tell me about.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It makes it easier to know when you should pilfer the mail of your victim.
The majority of rural delivery boxes can't be locked, because the rural carrier would not be able to open them to deliver mail. And locked group mailboxes are only as secure as the keyed-alike master key.
"that lets residents view scanned images of all incoming mail"
I've never seen a locked mailbox anywhere but apartment buildings. I guess the theory is the thieves get the pictures so they know when the real mail is arriving. Good luck with that in my neck of the woods. My mailman is an old decrepit piece of shit who sometimes doesn't show up for a week at a time. When he isn't working it's some other minimum wage flunkies.
On a side note I always wondered if the feds tracked where all the mail was going.
Only the State obtains its revenue by coercion. - Murray Rothbard
Ok they get to see the outside of the envelope with your name and address that they already know.
As far as I can tell, what they are doing is looking at the scans to know when credit cards are being delivered. If you get a new credit card on the average of once a year, this means that they only have to steal your mail once a year, and don't have to steal it the other 313 days a year that there ISN"T a credit card in the mail.
Unless the mailboxes are unlocked for them to get the actually mail how does this allow them to commit identity fraud?
Most people in the U.S. don't have locked mailboxes.
Groundskeeper Willie says "I warned ya!"
Ok they get to see the outside of the envelope with your name and address that they already know.
As far as I can tell, what they are doing is looking at the scans to know when credit cards are being delivered. If you get a new credit card on the average of once a year, this means that they only have to steal your mail once a year, and don't have to steal it the other 313 days a year that there ISN"T a credit card in the mail.
You missed the point. Thieves are signing up for NEW credit cards. Then watching when the card arrives and intercepts it before the homeowner. They wont know until the following month when a bill shows up for the max limit of the card. They don't have to wait for that once a year replacement card.
Can someone remind me again why the USPS seems to have a cash flow problem? I mean, if there was plenty of money to around inside the USPS I'm sure that things like this would be more likely to be fixed.
I am Slashdot. Are you Slashdot as well?
The USPS has been taking a picture of every piece of mail that passes through it for a decades. In some ways this should not be surprising - most mail sorting is automated, using machine vision to read the address labels (either hand-written, or barcode). In fact, the USPS was a strong investor in optical character recognition decades ago, because they recognized they could get much greater throughput this way. Previously, each letter would go past a human worker that would read the address and type in the ZIP code with a specialized keyboard.
More recently, the USPS has started retaining these images for a period of time. This has, for instance, been helpful in law enforcement - see the recent case of Cesar Sayoc. But I don't know how long the images are kept for, or what other legitimate uses there may be for it.
I moved a few years ago and haven't updated my address on usps.com. Apparently USPS turned on Informed Delivery automatically for me - so I can see all mail delivered to my old address. How cool and creepy is that!
What prevents me from entering in any random address? Do they send a postcard to the address stating "your mail is being monitored" ??
I used to travel on business a lot and used the website to stop / start my mail when on extended trips. I forgot I had an account until today! How many other people might be in this same situation?
I changed my address online - so we'll see what happens.
The best way to prevent this is to be the first to sign up. That way you are already associated first. If they let allow multiple accounts for one address....well...at least you'll get advance notice when they deliver the activation code for the new account.
What prevents me from entering in any random address?
"knowledge based authentication".
They ask you a question that, supposedly, only the resident of the address can answer. Krebs says that this is pretty weak security.
Article didn't say what kind of question that is, but a hint comes from the fact that if you freeze your Equifax credit rating, they can't ask the question. So it seems to be something that Equifax knows.
Do they send a postcard to the address stating "your mail is being monitored" ??
Didn't you read the article? That was the whole point: no, they don't.
Single-house locked mail boxes do exist. Here is one. They basically function just like the classic blue bins that you drop mail at and later the USPS picks up from.
USPS has special locks that you can buy an assortment of mailboxes with already installed it if you're handy you could buy the locking mechanism and install it your self, I'm sure that would depend on the type of box you have but its still possible. You don't think they carry a special key for every apartment complex do you?
Almost all new housing developments in the past decade or two (single family homes) have centralized boxes with keys. I've seen multiple news stories on thieves cracking them open to get to mail for all the residents. Post Office has some stronger structures they can deploy. But then the thieves get bigger hammers. And yes the feds do scan every piece of mail for years to try to backtrack package bombs etc.
You mean just like how they can't lock postal drop boxes?
They sell mailboxes that operate the same way. You put the mail in, it drops down to a place that you can unlock.
"Single-house locked mail boxes do exist. "
Yes, the rest of the planet uses them exclusively.
...but we need to actually consider REALLY PUNISHING people?
I mean, these identity thieves, assuming they're of the vanishingly small % that ever get caught or prosecuted, are going to spend maybe 18 months in a relatively cushy orange-is-the-new-black low security facility?:
How is that IN ANY WAY a deterrent? It wouldn't be to me, if I decided that's how I wanted to make $.
And remember, jail isn't just about rehabilitating people (personally, i don't think you can; you can teach them to constrain their behaviors, but the behaviors/drives are still there), it's about PUNISHING and DETERRING crime.
Maybe we should take a nod from Hammurabi: if you're clearly convicted of this, cut off a hand. I guarantee you the incidence would drop.
-Styopa
More recently, the USPS has started retaining these images for a period of time. This has, for instance, been helpful in law enforcement - see the recent case of Cesar Sayoc.
The answer is that the data is being handed off to the DHS or similar...
But I don't know how long the images are kept for,
...and therefore it is being stored forever and ever, amen.
or what other legitimate uses there may be for it.
There's no end of potential legitimate uses for that data. There's also no end of potential illegitimate ones, either. Sadly, the feds will store it for all eternity, so that it can be used by friend and foe alike.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I'd be happy if the mail carrier would just close the fucking mailbox when it's raining. She somehow manages to close it when it's not raining, so I presume she just does it for spite.
Nothing like soaking wet mail stuffed in a box when you've been out of town for a week. I have complained, but that seems to make it worse. They all look out for each other.
I'd just attach a spring to close it.
Only the State obtains its revenue by coercion. - Murray Rothbard
Lol, it would never make it.
Only the State obtains its revenue by coercion. - Murray Rothbard
The program clearly needs:
To either require an in person (with ID) sign up at a brick and mortar POST OFFICE or b) a Certified Mail Receipt delivered by a post man.
Otherwise they are just helping ID thieves to steal rather than preventing it.
As far as the daily email showing your coming mail is concerned, it only shows a portion of it. If you want to see all the photos they have of your mail you have to log in to their website, which IMO misses the point of getting an email showing your incoming mail in the first place. And even if you log in, they often only have photos for half your incoming mail (at our place anyway).
Given that they've also started embedding ads in with the daily email, the service has been losing its appeal to me -- which sucks because in principle it's a very good idea.
www.gaiageek.com
Because the cost of delivery has nothing to do with the price paid.
I like that USPS mail is cheaper to send/receive for letters. I'd be willing to have mail to the house 50% less - every other day.
Bad international agreements for subsidized international mail.
A $1.50 electronic part can be shipped from China to the USA for $1.86 total, in a $0.65 padded envelope. Inside the USA, the real delivery cost would be $3+, just for the mail, not the part, package, tracking, etc.
They've been doing it since the 9/11 anthrax attacks. Most people have forgotten about those, but they pushed the post office into upgrading their systems to be able to track every thing. At least this slippery slope had a good reason behind it.
Back in the trusting 1970s i remember rural mailboxes had a pulley and weight to keep the box closed. But now my parents just keep a PO box in town (and i send packages to my sister instead, cos couriers hate PO boxes).
The majority of rural delivery boxes can't be locked, because the rural carrier would not be able to open them to deliver mail.
Why would the carrier need to unlock to box to push envelopes through the slot? Mine's been doing that for years and never complained about it being particularly challenging. Maybe yours needs remedial training.
Should have read. Latin invaders are exploiting the USPS to steal the identity of US citizens so they can take over.
Undocumented migration is the same thing as an invasion. The strong inevitably replace the weak. White and black Americans will be replaced by brown Americans. This is the way of nature. Blacks and whites have been brainwashed into believing it is Noble to let another people take their land and Holmes. I imagine that when the Europeans were taking over the red skinned Americans they told them some shit like it is racist to oppose the usurping of you culture in favor of European culture
Harry the mailman brings us letters soaked with rain,
Jambs the box so full that the mail is crushed,
and then laughs when we complain.
Charlie the milkman is the biggest slob in town,
Seldom leaves the quarts that we've asked him for,
and when he does, they're upside-down
11 months throughout the year
they're as lousy as can be,
but starting December they work with great efficiency.
Charlie and Harry really show they're full of zip
Then they work that way,
every doggone day,
'till they get their Christmas tip!
(Mad magazine circa 1975)
"Single-house locked mail boxes do exist. "
Yes, the rest of the planet uses them exclusively.
Yeah, in the US having one of those is code for "You should steal this entire mailbox"
...but we need to actually consider REALLY PUNISHING people?
I had a neighbor once who had dropped a check in a mailbox on the corner. Thieves had put a device on it to let them intercept the mail. They took the check and changed ti to be made out to "Angel Batista" and cashed it.
I am willing to guess that if the cops had realized they were being openly mocked, they would have gone ahead and tracked the responsible party down and started REALLY PUNISHING people. :)
(Angel Batista is the good cop on the television show Dexter.)
Then move out of your crime infested, meth ravaged, rural community to a civilized location. Or, here is a thought, clean up your community. Or just put out a fake box with a bear trap inside.
I didn’t even know this “service” existed. I just signed up for it - not because I want it, but because I didn’t want somebody else to sign up in my place. I’ll probably never look at it.
#DeleteChrome
Yes rural mailbox that are lockable do indeed exist and have been for many years, they all have a slot in the front for the mailman to insert the letters/notices. Mailboxes for as long as I can remember have a little hole in the "lip" you grab to open them it was made for a lock to be used if desired, but as time progressed they started installing simple cheap locks in them. Even with old mailboxes that don't have a slot can still be locked all you have to do is give the mailman a key.
We have more of a problem with kids riding down the road and throwing empty beer bottle at them.
A few years back, I ran out of checks and went to a local post office, purchased a postal money order, filled it all out then mailed it at the counter, and it never made it out if that post office. ...and the cherry on top, in filing my lost claim, I had to wait the 30-60 days to even file it. These identity thieves have competition with some rogue Post office workers.
Then the mail carrier will destroy your mailbox out of spite.