14 ms·

Man Allegedly Used Change of Address Form to Move UPS Headquarters

RcouF1uZ4gsC 8y ago
From the article > Henderson-Spruce now faces federal charges of mail theft, which carries a maximum sentence of five years, and mail fraud, which can be up to 20. While a lot of current government processes aren't secure, they come with pretty hefty penalties that dissuade most people from messing around with them.
- _bxg1 8y ago
  Same with banks/credit card companies. Credit cards are hilariously insecure, but you'll get sued/prosecuted out the wazoo if you steal someone's info and make fraudulent charges.
  - rosege 8y ago
    I would hope so but im not 100% sure - the reason is because I've had a credit card been used fraudulently in the past and I got a notification about it very quickly so could alert the bank and merchants - but the things they bought would be so easy to track to someone - e.g. Pizza delivered, online clothing sent to a house.
    - therein 8y ago
      Pizza delivery was probably done to check if the card works and also throw the trail off, and the online clothing sent to a house was probably a shipping drop.
  - shyn3 8y ago
    The credit card statement may be incorrect [1]. [1] https://torontolife.com/city/crime/name-johnson-chrome-hes-citys-wanted-identity-thief/ https://torontolife.com/city/crime/name-johnson-chrome-hes-c...
  - deleted 8y ago
    [deleted]
- underwater 8y ago
  Laws being the Terms of Service you didn’t read and can’t opt out of.
  - azernik 8y ago
    This guy knew very well that what he was doing was illegal.
    - gknoy 8y ago
      Yeah. If I had forwarded Company X's mail to my house, I might be able to argue that I thought it was just a prank, and planned to contact their legal team about it (and give them the (sealed) mail). That is still probably illegal, but it's believable that someone might not realize that. If I start opening the mail and cashing the checks? WTF, I don't see how anyone could confuse that for ethical or legal behavior.
    - sowbug 8y ago
      I believe the comment you replied to was making a sovereign-citizen argument, questioning whether one is subject to rules one never consented to. https://en.wikipedia.org/wiki/Sovereign_citizen_movement https://en.wikipedia.org/wiki/Sovereign_citizen_movement
- electricslpnsld 8y ago
  > While a lot of current government processes aren't secure, they come with pretty hefty penalties that dissuade most people from messing around with them. Do they actually investigate mail theft if it isn't at a huge scale like this? Someone got a hold of the USPS skeleton keys in our medium sized city (Oakland) and has raided the mail in our building multiple times, and we have them clearly on video for the multiple break ins, and the postal inspector in charge of the case just kind of shrugged it off as no big deal.
  - anubisresources 8y ago
    Postal investigators have a reputation for taking any violation of the mail system extremely seriously. It seems like yours in Oakland is breaking the stereotype. Have you reached out to his higher ups?
  - caro_douglos 8y ago
    This person go a hold of new skeleton keys multiple times? Would switching to a fob system that identifies who has access be the way to go?
marme 8y ago
The change of address form at USPS is laughably unsecure. All it takes is $1 and anyone can write any address and forward all the mail for 1 year to any other address. There is no verification of ID and the only warning you get is a post card at the original address telling you the mail is being forwarded but by then it is already too late as mail is already being routed to the new address. Even if you called immediately to stop it some of your mail would end up at the new address
- koboll 8y ago
  There's a new feature they just rolled out that emails you images of the mail whenever it comes. Just as little security. You can spy on someone's mail indefinitely and they'd be none the wiser.
  - reaperducer 8y ago
    Yep. I get e-mail every few days with pictures of the mail headed for the people who now live in an apartment in another city I haven't lived in for close to 10 years. I've tried to get it fixed online, but so far no results.
  - craftyguy 8y ago
    My favorite part of this feature is that I now get to see images of junk mail before it is delivered to my mailbox. Too bad the USPS is so serious about maintaining their leadership as the 'leading deliverer of junk mail' to offer a way for recipients to reject it since they can literally see it in transit.
    - tetrep 8y ago
      If you could reject junk mail, junk mail senders wouldn't pay to, well, send it. And the USPS would lose a lot of money. Imagine how terrible GMail's spam filters would be if spammers paid Google for delivery... Oh wait, Google literally has a dedicated tab for that! For those that find it useful (and I don't doubt it is), imagine what the alternative would be for the spammers, you'd be 100% ignoring it by unsubscribing or filtering it as spam. Now that it's corralled off, you can look at it at your leisure, and Google can keep advertisers happy by offering them a non-zero chance you'll look at their spam.
mjevans 8y ago
I would /really/ like for national ID numbers to be public, and usable //as// 'addresses' for sent items. The owner of such a national ID address could update their preferred physical location (preferably also have different delivery locations and instructions for mail / packages / 'legal documents'). Maybe even electronic delivery addresses as well. I think the best way of preventing abuse for such a system would be to include a lookup fee for it's use (part of normal postage for mailed items).
- jopsen 8y ago
  In Denmark we have electronic national ID with one-time tokens on a small piece of paper. You can use for: government interaction, banks, utilities, health records, and lots of other things. They also made a digital secure mailbox, where you can receive PDFs from government, banks, utilities, doctors, etc. You can also send replies. It sucks that all of this is point-and-click web apps without a standardized API. I'm sure other countries have similar things, but most implementations are probably snowflakes. Whereas email is universally integrated everywhere, it's not trusted for personal sensitive information. I hope one day secure webauthn and secure email will replace all these snowflakes. But as much as I hate to admit it, the non-standard walked gardens does do a better job, with higher security than the old paper world ever did.
  - mercurial 8y ago
    I don't know what it's worth in terms of security, but it's really convenient. And Danish bureaucracy is the smoothest I've seen yet.
  - foepys 8y ago
    > They also made a digital secure mailbox, where you can receive PDFs from government, banks, utilities, doctors, etc. You can also send replies. Does that mean one has to constantly monitor this mailbox and is liable if something is left unanswered?
    - jopsen 8y ago
      Yes! This sucks... You can get text or email notifications. Like I said, I hate these systems with passion, but as much as I hate to admit it they are more secure than paper ever was. Probably also more convenient, as things moving fast compared to snailmail.
emodendroket 8y ago
This is an amusing story, but how in the world could he have expected to get away with this scheme?
- ozten 8y ago
  As an American entrepreneur, he could have protected this revenue stream with a consulting agreement with Essential Consultants LLC. Currently this government program is in a closed beta, AFAIK.
eof 8y ago
Somewhat related to this, you can submit an "informed delivery" for any address; and they will send you photos of every piece of mail being sent to that address. For free! I found this out on accident when I forwarded my mail somewhere else while I was traveling and they prompted me to sign up. I immediately started receiving emails with photos of all the mail going to this address.
- crazygringo 8y ago
  I signed up for it for my apartment... and starting getting e-mails with images of the envelope for every single piece of mail for every resident of the whole building to me. Huge privacy fail. (And yes, the USPS knows about each individual apartment, delivering mail into a separate USPS box per apartment...)
  - perl4ever 8y ago
    I was trying it out and it seems to be sort of the inverse for me - it showed only one piece of mail on a day when there were several.
- amorphid 8y ago
  I get this, too. It's pretty neat.
- rossdavidh 8y ago
  This also helps if you worry about the "postman who stops delivering most mail" kind of problem. Not that I've ever had an issue. I mostly use it as a "you should actually go pick up your mail today, there's something worth getting in it for a change" reminder.
Paul-ish 8y ago
I've had a similar issue where a stranger put a hold on the mail to my house. Took me a while to figure out, and I'm still not sure why it happened. If I had been expecting critical mail such as bills, things could have gone worse than they did. Fortunately it just delayed some packages and spam.
- leephillips 8y ago
  About 20 years ago I had the bright idea of saving trips to the pharmacy by having them mail me my medicine. After it was a week late, I noticed that I hadn't been getting any other mail for a week, either. I went to the post office and learned that my mail was on a vacation hold. Another tenant living in my small building had filed a legitimate hold, and the P.O. decided that it applied to the whole building, instead of just his unit. That was the last time I entrusted anything important to the USPS.
newobj 8y ago
How did he cash all the checks???
- chrischen 8y ago
  You just take it to the bank. One time my friend wrote the amount in the name field and the name in the amount field and they still cashed it. They did contact me about a week later, but by that time I could have just walked away with the cash.
  - gowld 8y ago
    You're going to need some kind of ID to cash a large amount of checks. (Sure, it could be fake ID)
    - icedchai 8y ago
      He probably just put it in the ATM, deposited it to his account. Eventually someone will notice, of course... but it will take weeks, longer than it takes for him to cash out his accounts.
      - pwg 8y ago
        If you are depositing into your own account you could even take it to a human teller and likely get it deposited without so much as a raised eyebrow. Of course, depositing it into your own account creates a "paper trail" that will eventually lead to some law enforcement officer discussing your activities with you at some time in the future.
louprado 8y ago
The article doesn't mention, but the USPS no longer allows you to submit a change of address from a commercial address. I tried to do this last September when my business moved and I received a letter from the USPS denying my request. This included any personal mail that was being sent to the commercial address even if it didn't have my business name. I am not sure when the above restriction went into effect. It appears the crime mentioned in the article was in 2016, so perhaps it is recent.
- _d8fd 8y ago
  This happened to me, too. I lived in a hotel, moved out, and was unable to forward my mail. My hotel room was considered to be a commercial address. I think this was in 2011.
trisimix 8y ago
This is so dumb. You cant be arsed to create a more secure form of this process so you made it illegal. All he did was fill out the paperwork lol.
- IncRnd 8y ago
  He filled out the paperwork AND CASHED CHECKS.
- jedberg 8y ago
  Being illegal is what makes it secure.
- kchr 8y ago
  Security by obscurity. The latter being money in this case...
princekolt 8y ago
> "Henderson-Spruce did not identify himself on the one-page form. At first, the initials 'HS' were written on the signature line, but the initials were then scratched out and replaced with 'UPS,' according to the charges" Come on, this guy is a genius. The fact he managed to pull it off by literally using cartoon-level forgery is nothing but remarkable.
- ktta 8y ago
  >Come on, this guy is a genius I don't it takes a genius to recognize the fragile parts of a seemingly secure system we live in. I'm sure there are people in every industry that know things that can be easily exploited for profit.
  - TeMPOraL 8y ago
    Of course it is. It's also easy to make money, if you're a total sociopath with no conscience. Fortunately, most people aren't like that.
  - jandrese 8y ago
    It's fragile because the penalties for mail fraud are so steep. Only an absolute blockhead would attempt it.
    - ktta 8y ago
      That is a poor reason for such a glaring hole. Your argument is okay for how easy it is to steal from a mailbox. This is about affecting businesses worth billions of dollars. Couldn't the same have happened to a Fortune 500 company?
- make3 8y ago
  "I'll have thousands of letters delivered to my own house, I'm sure no one will notice" - Genius Guy, apparently
  - rmason 8y ago
stretchwithme 8y ago
I find it hard to believe that the post office would actually start forwarding somebody's mail.
- pugworthy 8y ago
  That's... literally what the form is for.
  - stretchwithme 8y ago
    It just hasn't been my experience that they actually do it.
ggm 8y ago
"what we need, is a computer network, because this kind of over-the-counter social engineering attack would never work online" oh. hang on...
matte_black 8y ago
When I was young I “hacked” the USPS to send free mail by putting the return address as the address I wanted to send to and leaving the actual address blank or as some invalid address. Then I would deposit the letter somewhere without a stamp and it would be sent across the country for free (but very slowly). Was this actually a felony?
- CamTin 8y ago
  Yes, and a federal one.
  - matte_black 8y ago
    So what would I be looking at, prison time?
- niij 8y ago
  Yes, that's quite obviously fraud.
- jedberg 8y ago
  Besides being a crime, it doesn't work anymore (you weren't the only one to think of that). Now, if the return address on unstamped mail isn't within the local delivery area, it just goes to the dead letter pile.
deleted 8y ago
[deleted]
macintux 8y ago
To request a new social security card online, it takes your credit report information. Thanks, Equifax data breach. Good news: the SSA will only send your new card to your current address as reported in your credit report. Thanks, USPS. So, in summary, sounds like getting someone else’s social security card is pretty easy. Admittedly there’ll be a nifty paper trail, but I’m sure that’s solvable too.
Overtonwindow 8y ago
Now that’s some tenacity!
iambateman 8y ago
UPS should play this by sending the guy a package, addressed to UPS, at his jail cell, thanking him for the service he provided them. Pretty funny way to go to jail.
msravi 8y ago
Wait... how did he manage to cash checks that were made out to UPS? Doesn't the bank verify the beneficiary when cashing a check?
- fyfy18 8y ago
  This was the most concerning thing to me too. How do cheques in the US work in terms of verification?
  - pwg 8y ago
    There is essentially none. You could write a check out to "Mickey Mouse" and deposit it into your bank account and I doubt anyone would notice. If there is any verification, it occurs after the fact when someone complains that a payment got lost. Then the banks start looking to see what happened.
    - peterkelly 8y ago
      That seems like something they should probably fix
      - pwg 8y ago
        You would normally think so, but they (the banks) likely have a different viewpoint. They could either, for deposits into accounts in the bank: 1) slow down every deposit by an order of magnitude or more in order to perform careful identity verification, when the vast majority are correct and honest or 2) expend effort, afterward, cleaning up, the very few that are doing something illegal using the records they keep on what happened, and the fact that they can simply reverse the transactions when they do find something amiss. For them, the cost of #2 is likely still lower than the costs of #1. Now, the situation is different if you go in with a check and try to negotiate it for cash in hand right then and there. They will do the full identity verification at that time, massively slowing down your one-time action of converting a check into US Dollars in your pocket. This of course makes sense, there is no way to reverse a transaction that involves handing someone a stack of fifty dollar bills that they stick in their pocket. But in this case, just the one individual that did need to be triple checked before the action completed had their time extended by the verification process.
magicbuzz 8y ago
Laughable that he could do this!
exabrial 8y ago
The unionized idiots that allowed this should also be investigated. I'm a little surprised this -could- be pulled off, I think it'd be worthwhile to check for inside help. Then again, maybe the USPS is in fact, just that incompetent
HaifaHacker 8y ago
And the Post Office says it's our fault for not monitoring our mail.
benmarks 8y ago
I just CTRL+F'ed and am pleasantly surprised that no one has blah-blah-blockchained in this thread. Perhaps we've turned a corner.
itronitron 8y ago
I see a small business opportunity hear offering a service of sending weekly letters to a person's postal address just so they can be assured that their address hasn't been changed.
- bllguo 8y ago
  this reminds me of this: https://news.ycombinator.com/item?id=16867696 https://news.ycombinator.com/item?id=16867696 apparently that is a service people offer on the dark net
slededit 8y ago
A lot of government services have no security. Most of the time they require you to mail things in and rely on the fact that its a federal felony of mail fraud if you attempt to game them.
ducttape12 8y ago
If it was seriously this easy to pull off, perhaps the real guilty parties here are the USPS workers who let this happen unchecked.

From the article > Henderson-Spruce now faces federal charges of mail theft, which carries a maximum sentence of five years, and mail fraud, which can be up to 20. While a lot of current government processes aren't secure, they come with pretty hefty penalties that dissuade most people from messing around with them.

_bxg1 8y ago
Same with banks/credit card companies. Credit cards are hilariously insecure, but you'll get sued/prosecuted out the wazoo if you steal someone's info and make fraudulent charges.
- rosege 8y ago
  I would hope so but im not 100% sure - the reason is because I've had a credit card been used fraudulently in the past and I got a notification about it very quickly so could alert the bank and merchants - but the things they bought would be so easy to track to someone - e.g. Pizza delivered, online clothing sent to a house.
  - therein 8y ago
    Pizza delivery was probably done to check if the card works and also throw the trail off, and the online clothing sent to a house was probably a shipping drop.
- shyn3 8y ago
  The credit card statement may be incorrect [1]. [1] https://torontolife.com/city/crime/name-johnson-chrome-hes-citys-wanted-identity-thief/ https://torontolife.com/city/crime/name-johnson-chrome-hes-c...
- deleted 8y ago
  [deleted]
underwater 8y ago
Laws being the Terms of Service you didn’t read and can’t opt out of.
- azernik 8y ago
  This guy knew very well that what he was doing was illegal.
  - gknoy 8y ago
    Yeah. If I had forwarded Company X's mail to my house, I might be able to argue that I thought it was just a prank, and planned to contact their legal team about it (and give them the (sealed) mail). That is still probably illegal, but it's believable that someone might not realize that. If I start opening the mail and cashing the checks? WTF, I don't see how anyone could confuse that for ethical or legal behavior.
  - sowbug 8y ago
    I believe the comment you replied to was making a sovereign-citizen argument, questioning whether one is subject to rules one never consented to. https://en.wikipedia.org/wiki/Sovereign_citizen_movement https://en.wikipedia.org/wiki/Sovereign_citizen_movement
electricslpnsld 8y ago
> While a lot of current government processes aren't secure, they come with pretty hefty penalties that dissuade most people from messing around with them. Do they actually investigate mail theft if it isn't at a huge scale like this? Someone got a hold of the USPS skeleton keys in our medium sized city (Oakland) and has raided the mail in our building multiple times, and we have them clearly on video for the multiple break ins, and the postal inspector in charge of the case just kind of shrugged it off as no big deal.
- anubisresources 8y ago
  Postal investigators have a reputation for taking any violation of the mail system extremely seriously. It seems like yours in Oakland is breaking the stereotype. Have you reached out to his higher ups?
- caro_douglos 8y ago
  This person go a hold of new skeleton keys multiple times? Would switching to a fob system that identifies who has access be the way to go?

marme 8y ago

The change of address form at USPS is laughably unsecure. All it takes is $1 and anyone can write any address and forward all the mail for 1 year to any other address. There is no verification of ID and the only warning you get is a post card at the original address telling you the mail is being forwarded but by then it is already too late as mail is already being routed to the new address. Even if you called immediately to stop it some of your mail would end up at the new address

koboll 8y ago
There's a new feature they just rolled out that emails you images of the mail whenever it comes. Just as little security. You can spy on someone's mail indefinitely and they'd be none the wiser.
- reaperducer 8y ago
  Yep. I get e-mail every few days with pictures of the mail headed for the people who now live in an apartment in another city I haven't lived in for close to 10 years. I've tried to get it fixed online, but so far no results.
- craftyguy 8y ago
  My favorite part of this feature is that I now get to see images of junk mail before it is delivered to my mailbox. Too bad the USPS is so serious about maintaining their leadership as the 'leading deliverer of junk mail' to offer a way for recipients to reject it since they can literally see it in transit.
  - tetrep 8y ago
    If you could reject junk mail, junk mail senders wouldn't pay to, well, send it. And the USPS would lose a lot of money. Imagine how terrible GMail's spam filters would be if spammers paid Google for delivery... Oh wait, Google literally has a dedicated tab for that! For those that find it useful (and I don't doubt it is), imagine what the alternative would be for the spammers, you'd be 100% ignoring it by unsubscribing or filtering it as spam. Now that it's corralled off, you can look at it at your leisure, and Google can keep advertisers happy by offering them a non-zero chance you'll look at their spam.

mjevans 8y ago

I would /really/ like for national ID numbers to be public, and usable //as// 'addresses' for sent items. The owner of such a national ID address could update their preferred physical location (preferably also have different delivery locations and instructions for mail / packages / 'legal documents'). Maybe even electronic delivery addresses as well. I think the best way of preventing abuse for such a system would be to include a lookup fee for it's use (part of normal postage for mailed items).

jopsen 8y ago
In Denmark we have electronic national ID with one-time tokens on a small piece of paper. You can use for: government interaction, banks, utilities, health records, and lots of other things. They also made a digital secure mailbox, where you can receive PDFs from government, banks, utilities, doctors, etc. You can also send replies. It sucks that all of this is point-and-click web apps without a standardized API. I'm sure other countries have similar things, but most implementations are probably snowflakes. Whereas email is universally integrated everywhere, it's not trusted for personal sensitive information. I hope one day secure webauthn and secure email will replace all these snowflakes. But as much as I hate to admit it, the non-standard walked gardens does do a better job, with higher security than the old paper world ever did.
- mercurial 8y ago
  I don't know what it's worth in terms of security, but it's really convenient. And Danish bureaucracy is the smoothest I've seen yet.
- foepys 8y ago
  > They also made a digital secure mailbox, where you can receive PDFs from government, banks, utilities, doctors, etc. You can also send replies. Does that mean one has to constantly monitor this mailbox and is liable if something is left unanswered?
  - jopsen 8y ago
    Yes! This sucks... You can get text or email notifications. Like I said, I hate these systems with passion, but as much as I hate to admit it they are more secure than paper ever was. Probably also more convenient, as things moving fast compared to snailmail.

emodendroket 8y ago

This is an amusing story, but how in the world could he have expected to get away with this scheme?

ozten 8y ago
As an American entrepreneur, he could have protected this revenue stream with a consulting agreement with Essential Consultants LLC. Currently this government program is in a closed beta, AFAIK.

eof 8y ago

Somewhat related to this, you can submit an "informed delivery" for any address; and they will send you photos of every piece of mail being sent to that address. For free! I found this out on accident when I forwarded my mail somewhere else while I was traveling and they prompted me to sign up. I immediately started receiving emails with photos of all the mail going to this address.

crazygringo 8y ago
I signed up for it for my apartment... and starting getting e-mails with images of the envelope for every single piece of mail for every resident of the whole building to me. Huge privacy fail. (And yes, the USPS knows about each individual apartment, delivering mail into a separate USPS box per apartment...)
- perl4ever 8y ago
  I was trying it out and it seems to be sort of the inverse for me - it showed only one piece of mail on a day when there were several.
amorphid 8y ago
I get this, too. It's pretty neat.
rossdavidh 8y ago
This also helps if you worry about the "postman who stops delivering most mail" kind of problem. Not that I've ever had an issue. I mostly use it as a "you should actually go pick up your mail today, there's something worth getting in it for a change" reminder.

Paul-ish 8y ago

I've had a similar issue where a stranger put a hold on the mail to my house. Took me a while to figure out, and I'm still not sure why it happened. If I had been expecting critical mail such as bills, things could have gone worse than they did. Fortunately it just delayed some packages and spam.

leephillips 8y ago
About 20 years ago I had the bright idea of saving trips to the pharmacy by having them mail me my medicine. After it was a week late, I noticed that I hadn't been getting any other mail for a week, either. I went to the post office and learned that my mail was on a vacation hold. Another tenant living in my small building had filed a legitimate hold, and the P.O. decided that it applied to the whole building, instead of just his unit. That was the last time I entrusted anything important to the USPS.

newobj 8y ago

How did he cash all the checks???

chrischen 8y ago
You just take it to the bank. One time my friend wrote the amount in the name field and the name in the amount field and they still cashed it. They did contact me about a week later, but by that time I could have just walked away with the cash.
- gowld 8y ago
  You're going to need some kind of ID to cash a large amount of checks. (Sure, it could be fake ID)
  - icedchai 8y ago
    He probably just put it in the ATM, deposited it to his account. Eventually someone will notice, of course... but it will take weeks, longer than it takes for him to cash out his accounts.
    - pwg 8y ago
      If you are depositing into your own account you could even take it to a human teller and likely get it deposited without so much as a raised eyebrow. Of course, depositing it into your own account creates a "paper trail" that will eventually lead to some law enforcement officer discussing your activities with you at some time in the future.

louprado 8y ago

The article doesn't mention, but the USPS no longer allows you to submit a change of address from a commercial address. I tried to do this last September when my business moved and I received a letter from the USPS denying my request. This included any personal mail that was being sent to the commercial address even if it didn't have my business name. I am not sure when the above restriction went into effect. It appears the crime mentioned in the article was in 2016, so perhaps it is recent.

_d8fd 8y ago
This happened to me, too. I lived in a hotel, moved out, and was unable to forward my mail. My hotel room was considered to be a commercial address. I think this was in 2011.

trisimix 8y ago

This is so dumb. You cant be arsed to create a more secure form of this process so you made it illegal. All he did was fill out the paperwork lol.

IncRnd 8y ago
He filled out the paperwork AND CASHED CHECKS.
jedberg 8y ago
Being illegal is what makes it secure.
kchr 8y ago
Security by obscurity. The latter being money in this case...

princekolt 8y ago

> "Henderson-Spruce did not identify himself on the one-page form. At first, the initials 'HS' were written on the signature line, but the initials were then scratched out and replaced with 'UPS,' according to the charges" Come on, this guy is a genius. The fact he managed to pull it off by literally using cartoon-level forgery is nothing but remarkable.

ktta 8y ago
>Come on, this guy is a genius I don't it takes a genius to recognize the fragile parts of a seemingly secure system we live in. I'm sure there are people in every industry that know things that can be easily exploited for profit.
- TeMPOraL 8y ago
  Of course it is. It's also easy to make money, if you're a total sociopath with no conscience. Fortunately, most people aren't like that.
- jandrese 8y ago
  It's fragile because the penalties for mail fraud are so steep. Only an absolute blockhead would attempt it.
  - ktta 8y ago
    That is a poor reason for such a glaring hole. Your argument is okay for how easy it is to steal from a mailbox. This is about affecting businesses worth billions of dollars. Couldn't the same have happened to a Fortune 500 company?
make3 8y ago
"I'll have thousands of letters delivered to my own house, I'm sure no one will notice" - Genius Guy, apparently
- rmason 8y ago

stretchwithme 8y ago

I find it hard to believe that the post office would actually start forwarding somebody's mail.

pugworthy 8y ago
That's... literally what the form is for.
- stretchwithme 8y ago
  It just hasn't been my experience that they actually do it.

ggm 8y ago

"what we need, is a computer network, because this kind of over-the-counter social engineering attack would never work online" oh. hang on...

matte_black 8y ago

When I was young I “hacked” the USPS to send free mail by putting the return address as the address I wanted to send to and leaving the actual address blank or as some invalid address. Then I would deposit the letter somewhere without a stamp and it would be sent across the country for free (but very slowly). Was this actually a felony?

CamTin 8y ago
Yes, and a federal one.
- matte_black 8y ago
  So what would I be looking at, prison time?
niij 8y ago
Yes, that's quite obviously fraud.
jedberg 8y ago
Besides being a crime, it doesn't work anymore (you weren't the only one to think of that). Now, if the return address on unstamped mail isn't within the local delivery area, it just goes to the dead letter pile.

deleted 8y ago

[deleted]

macintux 8y ago

To request a new social security card online, it takes your credit report information. Thanks, Equifax data breach. Good news: the SSA will only send your new card to your current address as reported in your credit report. Thanks, USPS. So, in summary, sounds like getting someone else’s social security card is pretty easy. Admittedly there’ll be a nifty paper trail, but I’m sure that’s solvable too.

Overtonwindow 8y ago

Now that’s some tenacity!

iambateman 8y ago

UPS should play this by sending the guy a package, addressed to UPS, at his jail cell, thanking him for the service he provided them. Pretty funny way to go to jail.

msravi 8y ago

Wait... how did he manage to cash checks that were made out to UPS? Doesn't the bank verify the beneficiary when cashing a check?

fyfy18 8y ago
This was the most concerning thing to me too. How do cheques in the US work in terms of verification?
- pwg 8y ago
  There is essentially none. You could write a check out to "Mickey Mouse" and deposit it into your bank account and I doubt anyone would notice. If there is any verification, it occurs after the fact when someone complains that a payment got lost. Then the banks start looking to see what happened.
  - peterkelly 8y ago
    That seems like something they should probably fix
    - pwg 8y ago
      You would normally think so, but they (the banks) likely have a different viewpoint. They could either, for deposits into accounts in the bank: 1) slow down every deposit by an order of magnitude or more in order to perform careful identity verification, when the vast majority are correct and honest or 2) expend effort, afterward, cleaning up, the very few that are doing something illegal using the records they keep on what happened, and the fact that they can simply reverse the transactions when they do find something amiss. For them, the cost of #2 is likely still lower than the costs of #1. Now, the situation is different if you go in with a check and try to negotiate it for cash in hand right then and there. They will do the full identity verification at that time, massively slowing down your one-time action of converting a check into US Dollars in your pocket. This of course makes sense, there is no way to reverse a transaction that involves handing someone a stack of fifty dollar bills that they stick in their pocket. But in this case, just the one individual that did need to be triple checked before the action completed had their time extended by the verification process.

magicbuzz 8y ago

Laughable that he could do this!

exabrial 8y ago

The unionized idiots that allowed this should also be investigated. I'm a little surprised this -could- be pulled off, I think it'd be worthwhile to check for inside help. Then again, maybe the USPS is in fact, just that incompetent

HaifaHacker 8y ago

And the Post Office says it's our fault for not monitoring our mail.

benmarks 8y ago

I just CTRL+F'ed and am pleasantly surprised that no one has blah-blah-blockchained in this thread. Perhaps we've turned a corner.

itronitron 8y ago

I see a small business opportunity hear offering a service of sending weekly letters to a person's postal address just so they can be assured that their address hasn't been changed.

bllguo 8y ago
this reminds me of this: https://news.ycombinator.com/item?id=16867696 https://news.ycombinator.com/item?id=16867696 apparently that is a service people offer on the dark net

slededit 8y ago

A lot of government services have no security. Most of the time they require you to mail things in and rely on the fact that its a federal felony of mail fraud if you attempt to game them.

ducttape12 8y ago

If it was seriously this easy to pull off, perhaps the real guilty parties here are the USPS workers who let this happen unchecked.