What the Tech: Post office security
The US Postal Service’s “Informed Delivery” is the subject of a warning from the Secret Service to law enforcement agencies that it’s being used by criminals to steal credit cards.
As first reported by KrebsOnSecurity, the Secret Service sent an internal alert to law enforcement agencies it works with closely. The alert, according to Krebs, went out
November 6th and referenced a case in Michigan in which 7 people were charged with stealing credit cards after enrolling those residents using Informed Delivery.
Here’s how the crooks do it: they simply visit www.informeddelivery.usps.com and sign up as the homeowner of an address. To sign up they answer a few basic questions that can be easily answered by accessing information somewhere on the internet such as Zillow. The criminals then give the postal service an email where they’ll receive the information.
Once enrolled the criminals receive an email every morning with photos of every piece of mail that will be left in the mailbox later that day. It allows the recipient of the email the opportunity to see packages that will be delivered and even change the address for the packages.
I first told you about “Informed Delivery” in April. Residents enroll in the service on the US Postal Service website and every morning receive photographs of the days mail. I talked with a representative of the USPO to ask specifically about security and the possibility that criminals could use it to be notified when there’s something of value in the mailbox of a resident. I was told there were security measures in place that will prevent information from being stolen, namely, that the homeowner will be sent a letter in the mail notifying them that someone had enrolled in the program for that address.
The Secret Service warns that it’s best for homeowners and residents to sign up for Informed Delivery even if they don’t want to or opt out on the USPS website.