Slashdot Mirror
US Secret Service Warns ID Thieves are Abusing USPS's Mail Scanning Service (krebsonsecurity.com)
Brian Krebs reports: A year ago, KrebsOnSecurity warned that "Informed Delivery," a new offering from the U.S. Postal Service (USPS) that lets residents view scanned images of all incoming mail, was likely to be abused by identity thieves and other fraudsters unless the USPS beefed up security around the program and made it easier for people to opt out. This week, the U.S. Secret Service issued an internal alert warning that many of its field offices have reported crooks are indeed using Informed Delivery to commit various identity theft and credit card fraud schemes.
The internal alert -- sent by the Secret Service on Nov. 6 to its law enforcement partners nationwide -- references a recent case in Michigan in which seven people were arrested for allegedly stealing credit cards from resident mailboxes after signing up as those victims at the USPS's Web site. According to the Secret Service alert, the accused used the Informed Delivery feature "to identify and intercept mail, and to further their identity theft fraud schemes."
The internal alert -- sent by the Secret Service on Nov. 6 to its law enforcement partners nationwide -- references a recent case in Michigan in which seven people were arrested for allegedly stealing credit cards from resident mailboxes after signing up as those victims at the USPS's Web site. According to the Secret Service alert, the accused used the Informed Delivery feature "to identify and intercept mail, and to further their identity theft fraud schemes."
They only give you photos of your flat mail. Packages don't seem to get photographed, ever, even just padded envelopes. So the stuff I want most to know about, they don't tell me about.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It makes it easier to know when you should pilfer the mail of your victim.
The majority of rural delivery boxes can't be locked, because the rural carrier would not be able to open them to deliver mail. And locked group mailboxes are only as secure as the keyed-alike master key.
I've never seen a locked mailbox anywhere but apartment buildings. I guess the theory is the thieves get the pictures so they know when the real mail is arriving. Good luck with that in my neck of the woods. My mailman is an old decrepit piece of shit who sometimes doesn't show up for a week at a time. When he isn't working it's some other minimum wage flunkies.
On a side note I always wondered if the feds tracked where all the mail was going.
Only the State obtains its revenue by coercion. - Murray Rothbard
Ok they get to see the outside of the envelope with your name and address that they already know.
As far as I can tell, what they are doing is looking at the scans to know when credit cards are being delivered. If you get a new credit card on the average of once a year, this means that they only have to steal your mail once a year, and don't have to steal it the other 313 days a year that there ISN"T a credit card in the mail.
Unless the mailboxes are unlocked for them to get the actually mail how does this allow them to commit identity fraud?
Most people in the U.S. don't have locked mailboxes.
Groundskeeper Willie says "I warned ya!"
Ok they get to see the outside of the envelope with your name and address that they already know.
As far as I can tell, what they are doing is looking at the scans to know when credit cards are being delivered. If you get a new credit card on the average of once a year, this means that they only have to steal your mail once a year, and don't have to steal it the other 313 days a year that there ISN"T a credit card in the mail.
You missed the point. Thieves are signing up for NEW credit cards. Then watching when the card arrives and intercepts it before the homeowner. They wont know until the following month when a bill shows up for the max limit of the card. They don't have to wait for that once a year replacement card.
Can someone remind me again why the USPS seems to have a cash flow problem? I mean, if there was plenty of money to around inside the USPS I'm sure that things like this would be more likely to be fixed.
I am Slashdot. Are you Slashdot as well?
The USPS has been taking a picture of every piece of mail that passes through it for a decades. In some ways this should not be surprising - most mail sorting is automated, using machine vision to read the address labels (either hand-written, or barcode). In fact, the USPS was a strong investor in optical character recognition decades ago, because they recognized they could get much greater throughput this way. Previously, each letter would go past a human worker that would read the address and type in the ZIP code with a specialized keyboard.
More recently, the USPS has started retaining these images for a period of time. This has, for instance, been helpful in law enforcement - see the recent case of Cesar Sayoc. But I don't know how long the images are kept for, or what other legitimate uses there may be for it.
I moved a few years ago and haven't updated my address on usps.com. Apparently USPS turned on Informed Delivery automatically for me - so I can see all mail delivered to my old address. How cool and creepy is that!
What prevents me from entering in any random address? Do they send a postcard to the address stating "your mail is being monitored" ??
I used to travel on business a lot and used the website to stop / start my mail when on extended trips. I forgot I had an account until today! How many other people might be in this same situation?
I changed my address online - so we'll see what happens.
The best way to prevent this is to be the first to sign up. That way you are already associated first. If they let allow multiple accounts for one address....well...at least you'll get advance notice when they deliver the activation code for the new account.
What prevents me from entering in any random address?
"knowledge based authentication".
They ask you a question that, supposedly, only the resident of the address can answer. Krebs says that this is pretty weak security.
Article didn't say what kind of question that is, but a hint comes from the fact that if you freeze your Equifax credit rating, they can't ask the question. So it seems to be something that Equifax knows.
Do they send a postcard to the address stating "your mail is being monitored" ??
Didn't you read the article? That was the whole point: no, they don't.
USPS has special locks that you can buy an assortment of mailboxes with already installed it if you're handy you could buy the locking mechanism and install it your self, I'm sure that would depend on the type of box you have but its still possible. You don't think they carry a special key for every apartment complex do you?
You mean just like how they can't lock postal drop boxes?
They sell mailboxes that operate the same way. You put the mail in, it drops down to a place that you can unlock.
"Single-house locked mail boxes do exist. "
Yes, the rest of the planet uses them exclusively.
...but we need to actually consider REALLY PUNISHING people?
I mean, these identity thieves, assuming they're of the vanishingly small % that ever get caught or prosecuted, are going to spend maybe 18 months in a relatively cushy orange-is-the-new-black low security facility?:
How is that IN ANY WAY a deterrent? It wouldn't be to me, if I decided that's how I wanted to make $.
And remember, jail isn't just about rehabilitating people (personally, i don't think you can; you can teach them to constrain their behaviors, but the behaviors/drives are still there), it's about PUNISHING and DETERRING crime.
Maybe we should take a nod from Hammurabi: if you're clearly convicted of this, cut off a hand. I guarantee you the incidence would drop.
-Styopa
More recently, the USPS has started retaining these images for a period of time. This has, for instance, been helpful in law enforcement - see the recent case of Cesar Sayoc.
The answer is that the data is being handed off to the DHS or similar...
But I don't know how long the images are kept for,
...and therefore it is being stored forever and ever, amen.
or what other legitimate uses there may be for it.
There's no end of potential legitimate uses for that data. There's also no end of potential illegitimate ones, either. Sadly, the feds will store it for all eternity, so that it can be used by friend and foe alike.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I'd be happy if the mail carrier would just close the fucking mailbox when it's raining. She somehow manages to close it when it's not raining, so I presume she just does it for spite.
Nothing like soaking wet mail stuffed in a box when you've been out of town for a week. I have complained, but that seems to make it worse. They all look out for each other.
I'd just attach a spring to close it.
Only the State obtains its revenue by coercion. - Murray Rothbard
Lol, it would never make it.
Only the State obtains its revenue by coercion. - Murray Rothbard
As far as the daily email showing your coming mail is concerned, it only shows a portion of it. If you want to see all the photos they have of your mail you have to log in to their website, which IMO misses the point of getting an email showing your incoming mail in the first place. And even if you log in, they often only have photos for half your incoming mail (at our place anyway).
Given that they've also started embedding ads in with the daily email, the service has been losing its appeal to me -- which sucks because in principle it's a very good idea.
www.gaiageek.com
Harry the mailman brings us letters soaked with rain,
Jambs the box so full that the mail is crushed,
and then laughs when we complain.
Charlie the milkman is the biggest slob in town,
Seldom leaves the quarts that we've asked him for,
and when he does, they're upside-down
11 months throughout the year
they're as lousy as can be,
but starting December they work with great efficiency.
Charlie and Harry really show they're full of zip
Then they work that way,
every doggone day,
'till they get their Christmas tip!
(Mad magazine circa 1975)
I didn’t even know this “service” existed. I just signed up for it - not because I want it, but because I didn’t want somebody else to sign up in my place. I’ll probably never look at it.
#DeleteChrome
Then the mail carrier will destroy your mailbox out of spite.