The U.S. Secret Service is warning of cybercriminals using the U.S. Postal Service (USPS) “Informed Delivery” feature to commit various identity theft and credit card fraud schemes.
The features sends a scanned image of incoming mail to the recipients email address before it arrives later that day.
An internal alert obtained by KrebsOnSecurity and sent by the Secret Service on Nov. 6 to its law enforcement partners nationwide referenced a recent Michigan case in which seven were arrested for allegedly stealing credit cards from resident mailboxes after signing victims up for the service.
The case refers to a Sept. 21, 2018, incident in which a group accused of stealing main allegedly bought nearly $400,000 in gift cards and merchandise at Meijer Inc. stores and other retailers.
“Fraudsters were also observed on criminal forums discussing using the Informed Delivery service to surveil potential identity theft victims,” the Secret Service memo said. While the USPS alerts all households by mail whenever someone signs up to receive the scanned notifications, the ID thieves appear to have figured out a way to hijack identities and order new credit cards in victims’ names before the USPS can send their notification.
This may have been done by waiting for the cards to approve before signing the victims up for the service.
