WASHINGTON (CBS) The United States Postal Service expects to deliver more than 900 million packages this holiday season. But some criminals have found a new way to try to steal your mail. They are taking advantage of a USPS digital notification system that gives an early look at what's coming in the mail.
You've got mail! -- that's the message each morning in the e-mail inbox of 13 million people who signed up with the post office for "Informed Delivery."
Wherever you are, an e-mail arrives with a scan of any mail on its way that day. The post office asks people to verify their identity with questions like:
- past cities and streets where they've lived
- and the sale price of their home
"The information could be on the Dark Web. It's being collected by companies that collect and sell data. This kind of information also is oftentimes available on social media," said Adam Levin, founder of CyberScout.
That can allow scammers to sign up with your name and address, but their e-mail. And now the Secret Service warns that criminals can take advantage of informed delivery to "intercept mail and to further their identity theft fraud schemes."
"It enables a fraudster to commit the fraud," said Chris Torraca, who had his identity stolen in a 2015 database breach. He says a scammer used that hacked data to sign up for informed delivery in his name and swipe a credit card from his mail. "Someone was receiving images and was monitoring I guess the neighborhood, and when they saw that the credit card came in the mail, they then proceeded to follow the postal delivery person."
The Postal Service says households can opt-out online from informed delivery, and they warn their inspectors are watching.
"Informed Delivery is a criminal's worst nightmare because we are continually monitoring for any suspicious behavior, and anyone who misuses our products, we're going to detect that," said Carroll Harris with U.S. Postal Inspection Service.
The United States Postal Service stresses that the actual informed delivery database has never been hacked, and the best way to protect yourself from someone spying on your mail may be to sign up for the service with your own e-mail address before someone else signs up as you.