So I began reading and figured, huh, thieves must just stealing be the validation letter USPS would send, and thought, hey, that system which is used in many other places for similar things would be quite vulnerable to that attack, right?
But then I got to this bit:
> KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify residents when someone at their address signs up for Informed Delivery. The USPS addressed that shortcoming earlier this year, announcing it had started alerting all households by mail whenever anyone signs up to receive scanned notifications of mail delivered to their address.
> However, it appears that ID thieves have figured out ways to hijack identities and order new credit cards in victims’ names before the USPS can send their notification
What the actual hell? You can sign up online to get mail scanned… without any physical verification you're at the address, with only a physical notification being sent after-the-fact?
What the hell are USPS smoking?
It makes me wonder what you need to do to sign up for this. I wonder…
goes to website
it seems like the only thing they do is ask for the address, and you check a box to accept the T&Cs. I don't know if there's actual verification beyond that step, but it doesn't sound like there is…
But then I got to this bit:
> KrebsOnSecurity took the USPS to task last year in part for not using its own unique communications method — the U.S. Mail — to validate and notify residents when someone at their address signs up for Informed Delivery. The USPS addressed that shortcoming earlier this year, announcing it had started alerting all households by mail whenever anyone signs up to receive scanned notifications of mail delivered to their address.
> However, it appears that ID thieves have figured out ways to hijack identities and order new credit cards in victims’ names before the USPS can send their notification
What the actual hell? You can sign up online to get mail scanned… without any physical verification you're at the address, with only a physical notification being sent after-the-fact?
What the hell are USPS smoking?
It makes me wonder what you need to do to sign up for this. I wonder…
goes to website
it seems like the only thing they do is ask for the address, and you check a box to accept the T&Cs. I don't know if there's actual verification beyond that step, but it doesn't sound like there is…