Slashdot Mirror
US Secret Service Warns ID Thieves are Abusing USPS's Mail Scanning Service (krebsonsecurity.com)
Brian Krebs reports: A year ago, KrebsOnSecurity warned that "Informed Delivery," a new offering from the U.S. Postal Service (USPS) that lets residents view scanned images of all incoming mail, was likely to be abused by identity thieves and other fraudsters unless the USPS beefed up security around the program and made it easier for people to opt out. This week, the U.S. Secret Service issued an internal alert warning that many of its field offices have reported crooks are indeed using Informed Delivery to commit various identity theft and credit card fraud schemes.
The internal alert -- sent by the Secret Service on Nov. 6 to its law enforcement partners nationwide -- references a recent case in Michigan in which seven people were arrested for allegedly stealing credit cards from resident mailboxes after signing up as those victims at the USPS's Web site. According to the Secret Service alert, the accused used the Informed Delivery feature "to identify and intercept mail, and to further their identity theft fraud schemes."
The internal alert -- sent by the Secret Service on Nov. 6 to its law enforcement partners nationwide -- references a recent case in Michigan in which seven people were arrested for allegedly stealing credit cards from resident mailboxes after signing up as those victims at the USPS's Web site. According to the Secret Service alert, the accused used the Informed Delivery feature "to identify and intercept mail, and to further their identity theft fraud schemes."
They only give you photos of your flat mail. Packages don't seem to get photographed, ever, even just padded envelopes. So the stuff I want most to know about, they don't tell me about.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Ok they get to see the outside of the envelope with your name and address that they already know. Unless the mailboxes are unlocked for them to get the actually mail how does this allow them to commit identity fraud?
So they got to preview mail before it got to unprotected, unlocked mailboxes? If so big deal, they people should have locking mailboxes anyway. It would prevent this from happening.
Ultimately the people are stealing mail, a federal crime. This has absolutely nothing to do with informed delivery.
Groundskeeper Willie says "I warned ya!"
Can someone remind me again why the USPS seems to have a cash flow problem? I mean, if there was plenty of money to around inside the USPS I'm sure that things like this would be more likely to be fixed.
I am Slashdot. Are you Slashdot as well?
I moved a few years ago and haven't updated my address on usps.com. Apparently USPS turned on Informed Delivery automatically for me - so I can see all mail delivered to my old address. How cool and creepy is that!
What prevents me from entering in any random address? Do they send a postcard to the address stating "your mail is being monitored" ??
I used to travel on business a lot and used the website to stop / start my mail when on extended trips. I forgot I had an account until today! How many other people might be in this same situation?
I changed my address online - so we'll see what happens.
The best way to prevent this is to be the first to sign up. That way you are already associated first. If they let allow multiple accounts for one address....well...at least you'll get advance notice when they deliver the activation code for the new account.
What prevents me from entering in any random address?
"knowledge based authentication".
They ask you a question that, supposedly, only the resident of the address can answer. Krebs says that this is pretty weak security.
Article didn't say what kind of question that is, but a hint comes from the fact that if you freeze your Equifax credit rating, they can't ask the question. So it seems to be something that Equifax knows.
Do they send a postcard to the address stating "your mail is being monitored" ??
Didn't you read the article? That was the whole point: no, they don't.
...but we need to actually consider REALLY PUNISHING people?
I mean, these identity thieves, assuming they're of the vanishingly small % that ever get caught or prosecuted, are going to spend maybe 18 months in a relatively cushy orange-is-the-new-black low security facility?:
How is that IN ANY WAY a deterrent? It wouldn't be to me, if I decided that's how I wanted to make $.
And remember, jail isn't just about rehabilitating people (personally, i don't think you can; you can teach them to constrain their behaviors, but the behaviors/drives are still there), it's about PUNISHING and DETERRING crime.
Maybe we should take a nod from Hammurabi: if you're clearly convicted of this, cut off a hand. I guarantee you the incidence would drop.
-Styopa
The program clearly needs:
To either require an in person (with ID) sign up at a brick and mortar POST OFFICE or b) a Certified Mail Receipt delivered by a post man.
Otherwise they are just helping ID thieves to steal rather than preventing it.
As far as the daily email showing your coming mail is concerned, it only shows a portion of it. If you want to see all the photos they have of your mail you have to log in to their website, which IMO misses the point of getting an email showing your incoming mail in the first place. And even if you log in, they often only have photos for half your incoming mail (at our place anyway).
Given that they've also started embedding ads in with the daily email, the service has been losing its appeal to me -- which sucks because in principle it's a very good idea.
www.gaiageek.com
Because the cost of delivery has nothing to do with the price paid.
I like that USPS mail is cheaper to send/receive for letters. I'd be willing to have mail to the house 50% less - every other day.
Bad international agreements for subsidized international mail.
A $1.50 electronic part can be shipped from China to the USA for $1.86 total, in a $0.65 padded envelope. Inside the USA, the real delivery cost would be $3+, just for the mail, not the part, package, tracking, etc.
Should have read. Latin invaders are exploiting the USPS to steal the identity of US citizens so they can take over.
Undocumented migration is the same thing as an invasion. The strong inevitably replace the weak. White and black Americans will be replaced by brown Americans. This is the way of nature. Blacks and whites have been brainwashed into believing it is Noble to let another people take their land and Holmes. I imagine that when the Europeans were taking over the red skinned Americans they told them some shit like it is racist to oppose the usurping of you culture in favor of European culture
Harry the mailman brings us letters soaked with rain,
Jambs the box so full that the mail is crushed,
and then laughs when we complain.
Charlie the milkman is the biggest slob in town,
Seldom leaves the quarts that we've asked him for,
and when he does, they're upside-down
11 months throughout the year
they're as lousy as can be,
but starting December they work with great efficiency.
Charlie and Harry really show they're full of zip
Then they work that way,
every doggone day,
'till they get their Christmas tip!
(Mad magazine circa 1975)
...but we need to actually consider REALLY PUNISHING people?
I had a neighbor once who had dropped a check in a mailbox on the corner. Thieves had put a device on it to let them intercept the mail. They took the check and changed ti to be made out to "Angel Batista" and cashed it.
I am willing to guess that if the cops had realized they were being openly mocked, they would have gone ahead and tracked the responsible party down and started REALLY PUNISHING people. :)
(Angel Batista is the good cop on the television show Dexter.)
I didn’t even know this “service” existed. I just signed up for it - not because I want it, but because I didn’t want somebody else to sign up in my place. I’ll probably never look at it.
#DeleteChrome
A few years back, I ran out of checks and went to a local post office, purchased a postal money order, filled it all out then mailed it at the counter, and it never made it out if that post office. ...and the cherry on top, in filing my lost claim, I had to wait the 30-60 days to even file it. These identity thieves have competition with some rogue Post office workers.