U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right?<p>But then I got to this bit:<p>> KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify residents when someone at their address signs up for Informed Delivery. The USPS addressed that shortcoming earlier this year, announcing it had started alerting all households by mail whenever anyone signs up to receive scanned notifications of mail delivered to their address.<p>> However, it appears that ID thieves have figured out ways to hijack identities and order new credit cards in victims’ names before the USPS can send their notification<p>What the actual hell? You can sign up online to get mail scanned… without <i>any</i> physical verification you're at the address, with only a physical <i>notification</i> being sent <i>after-the-fact</i>?<p>What the hell are USPS smoking?<p>It makes me wonder what you need to do to sign up for this. I wonder…<p><i>goes to website</i><p>it seems like the only thing they do is ask for the address, and you check a box to accept the T&Cs. I don't know if there's actual verification beyond that step, but it doesn't sound like there is…