USPS Slammed for Security Flaw That Scammers Love—Is Your Mail in Danger?

Our mail can be a gold mine for criminals, as it can help them get their hands on some pretty important things, from our personal information to cold, hard cash. The U.S. Postal Service (USPS) has long warned about the many mail schemes scammers might try to use, including fake emails and unsolicited texts. But now the USPS itself is being blamed for a security flaw that could also be putting customers in harm's way. Read on to find out if your mail may be in danger.

READ THIS NEXT: USPS Is "Holding Mail Hostage," Customers Say in New Complaints.

If you plan to move soon, you can file a Change of Address (COA) request with the USPS to get your mail rerouted to your new place. But you may not be the only one trying to take advantage of that.

An April 2022 report from the USPS Office of the Inspector General (OIG) discovered that fraud surrounding the agency's change of address process has been rising significantly. There were more than 23,600 cases of fraudulent online COA requests and attempted identity theft in 2021, according to the report. That is a 167 percent jump from 2020, when just 8,857 cases were reported.

Scott Shackelford, the director for Indiana University's cyber security program, told CBS-affiliate WTTK in Indianapolis that the increase in COA fraud coincided with an overall increase in cybercrime during the COVID pandemic.

"My guess is what we're seeing in these data is just one aspect of this much bigger trend that unfortunately has been going on for a few years now," he said.

Tacoma resident Travis Palmer is one of many who had his mailing address changed by a scammer, CBS-affiliate KIRO in Seattle reported in Oct. 2022. Travis' mother, Carra Palmer, told the news outlet that the scam had left Travis without some of the vital equipment he needs for his rare metabolic disorder.ae0fcc31ae342fd3a1346ebb1f342fcb

"It's been a nightmare," Carra said.

A former Microsoft executive faced a similar situation last fall as well, TechCrunch reported. The former executive, who was not named, told the news outlet that someone had filed a COA form in his name at a post office in Nov. 2022. This quick scheme allowed scammers to gain access to his mail and his finances.

In fact, a letter from one of his banks showed that it had made the fraudulent address change in its systems "as a result of data received from the United States Postal Service (USPS) indicating that an address change had occurred," TechCrunch reported.

The former Microsoft executive told the news outlet that it took him weeks to return his accounts and get his correct home address back on file.

RELATED: For more up-to-date information, sign up for our daily newsletter.

The USPS processed nearly 36 million COA requests in 2021 alone, the OIG reports. This can be done by either submitting a request online or filing an in-person paper form. When using the online COA form, customers do have to pay a security fee.

"For your security, we need to verify your identity using a valid credit or debit card. You will be charged $1.10 for this service," the USPS states on its website.

But a loophole may allow scammers to file PS Form 3575, which is the paper request, without providing proof of identity. This COA form has to be requested in-person at a post office, and once someone fills it out with their name, old address, new address, and how long they want to reroute their mail, all they have to do is hand it back to a postal worker or drop it in the facility's letter mail slot, TechCrunch reported.

If they're not asked to verify their identity, there is no paper trail, as there is "no fee required" to file a change of address at the post office, according to the USPS.

As TechCrunch notes, although there is a warning on the form that filling it out with false information could lead to criminal charges, the USPS doesn't offer any assurance that it's checking the identity of the person filing the COA form. Critics say that makes it all too easy for scammers to reroute people's mail, and then steal everything from credit cards to bank account information.

Best Life reached out to the USPS about the alleged COA flaw, but has not yet heard back. These are not necessarily new concerns, however.

In a 2018 audit report, the OIG expressed concerns about the agency's identity verification policies for its COA service. "The Postal Service lacks a control requiring customers to present a government-issued form of identification for review when submitting a hardcopy COA request at a retail facility or to their letter carrier," the report concluded.

As a result of this audit, USPS OIG spokesperson Bill Triplett told TechCrunch that the USPS "provided documentation demonstrating sales associates require identification to process change of address requests in person."

But when asked if the agency is actually enforcing this policy, the OIG spokesperson said that "once we close a recommendation based on supporting documentation provided by the Postal Service, we do not complete follow-up work to check whether they continue to implement it."