Fraudsters are using the U.S. Postal Services’ (USPS’) Informed Delivery service to perpetrate a multitude of identity theft and credit card fraud schemes, according to an alert the Secret Service sent its law enforcement partners on Nov. 6. The Informed Delivery service, which debuted last year, allows most residential postal customers to digitally preview their mail the morning of delivery. To sign up for the service, USPS requires customers to provide their name, address, and email. USPS further validates a customer’s identity by asking them four multiple-choice knowledge-based authentication (KBA) questions. However, the answers to KBA questions are typically available through either online data brokers, social media sites, or from information leaked in data breaches. Criminals are using the data to make fraudulent accounts “to identify and intercept mail, and to further their identity theft fraud schemes.” In Sept. 2018, seven individuals were arrested with an 18-count indictment–including aggravated identity theft, possession of stolen mail, access-device (credit or debit card) fraud and conspiracy to commit fraud, and aggravated identity theft–stemming from their use of Informed Delivery to open and steal fraudulent credit cards.
