You've probably moved at least once in your life and had to fill out the Change of Address form at the U.S. Postal Service (USPS). The USPS makes it easy to change your address or temporarily forward mail to a different address. Forms are available at your local post office, or you can make the necessary changes online.
Maybe it's too easy.
Identity thieves can potentially redirect your mail by filling out a change of address form in your name. If they succeed, they can receive bills, bank statements, and other mail with sensitive information. That information can then be used to open new credit accounts in your name and drain existing ones. Identity thieves who already have your information may use a change of address form to divert bills from fraudulent accounts away from your address.
The USPS requires a valid credit or debit card as an identity check for online changes of address, charging a nominal $1 fee. The agency also requires a valid e-mail address for confirmation purposes. This should stop most fraudulent applications, but if an identity thief already has a fraudulent card in your name or access to your accounts, it's easy to bypass this protection.
Ironically, it may be easier to commit a fraudulent change of address at the Post Office than it is online. To change your address at a local Post Office, pick up a Mover's Guide Packet that contains a copy of PS Form 3575. The Post Office no longer posts downloaded forms and only gives out PS Form 3575 upon request.
Fill out the form and submit the form at any post office or give it to any mail carrier. However, unless you are immediately filling out the form you just received and handing it back to a postal clerk, there's no good way to verify who filled out the form.
A moving validation letter (MVL) is supposed to be sent to the old address to confirm intent to move – but if this letter is not sent or missed, your mail may be redirected without your knowledge. Even if everything works as expected, it still takes a few days for that MVL to arrive at the old address.
Greg Scott, cybersecurity expert and author of Bullseye Breach: Anatomy of an Electronic Break-In, explains the process. "Let's say I want to steal from, say, John Smith, who lives in Houston, Texas. I can walk into a post office in, say, Newport, Minnesota, rent a PO box with cash, fill out the form, put a stamp on it, and give it to the guy behind the counter. That's it. A few days later, mail for John Smith starts coming to me. This actually happened to a friend of mine. I tested it myself, and wrote it up on my blog."
According to National Public Radio, investigative work by the San Francisco CBS affiliate KPIX found that the Postal Inspection Service fielded over 17,000 complaints in the previous year concerning fraudulent address changes. According to the reply from the USPS, many of those complaints turned out to be unrelated to fraud – mostly disputes or misunderstandings between friends and families.
Even so, some cases of fraudulent address changes have been verified – including a staggeringly obvious corporate example. A Chicago man managed to use a change of address form to redirect mail from the UPS corporate headquarters in Atlanta to his home address. Before being charged with mail theft and mail fraud, he deposited around $58,000 in forwarded checks. He received so much UPS mail for almost three months that a USPS tub had to be placed outside his door!
If anyone can reroute mail from a major corporation to their home address for months without getting caught, there are clearly gaps in the USPS identity verification process. Like any form of identity theft, the key is to notice changes and act on them. The UPS case clearly shows that you can't count on mail carriers or other parties to spot oddities for you. If no one at USPS thought it strange that one guy was getting huge quantities of a billion-dollar corporation's mail forwarded to his apartment, they're probably not going to notice when someone changes your home address.
If you're missing certain letters or bills that you expected to receive, or you don't receive any mail for several days when you normally do, notify the USPS right away. You may be able to stop a fraudulent redirect of your mail before thieves get bills or other sensitive information and put them to use.
If you would like to prevent identity theft, check out Identity Protector by MoneyTips.
Photo ©iStockphoto.com/krblokhin
Advertising Disclosure
