4 ms·

https://krebsonsecurity.com/2018/11/u-s-secret-service-warns-id-thieves-are-abusing-uspss-mail-scanning-service/ https://krebsonsecurity.com/2018/11/u-s-secret-

• rickyc091 8y ago
  They've "fixed" the loophole by sending you a physical letter with a pin number that you have to input onto their website to activate the service. However, someone that's targetting you could still steal your mail with the pin.
  • sesutton 8y ago
    Unless they changed it very recently you can still sign up completely online or have them mail you a PIN. They do still mail you a PIN no matter what so you can at least deactivate it if you didn't set it up.
  • omilu 8y ago
    Negative, I just activated it and all I had to do was answer some questions related to my credit.
    • mynameisvlad 8y ago
      Is the address you activated it for on your credit report? They likely verified your identity through those questions, and would also have your current and past addresses as part of that.
• SlowRobotAhead 8y ago
  Maybe I just didn’t see the attack vector clearly, but it appears Krebs and security issue is that a scammer can target you, sign you up for this, see that you are a CapitalOne account holder - THEN use that information to further attack you say by opening a new account at the same bank. Seems like a pretty flimsy side information gathering service. If an attacker has enough information to add an account for you, they probably have enough to determine where you bank at. Good that the USPS can fix it easily enough, but maybe I’m missing how scammer would otherwise use this info.
  • dontbenebby 8y ago
    I think the attack is that they can see a credit card is on it's way to your mailbox, then snatch it out of the mailbox while you're at work. Things like this are why I moved all my financial stuff over to a PO box.
    • SlowRobotAhead 8y ago
      How many attackers are local to you? This requires proximity obviously, I just have to think that’s even more rare. Maybe there are niche credit card thieves that like to target just the area they live in. Seems like a lot of additional risk as now you aren’t just committing CC fraud but also mail fraud.
      • abarringer 8y ago
        I work in the Credit card industry. Account origination fraud using the real address is a thing. The bad guys hire mules to check mailboxes daily until the card arrives. This would greatly simplify that task.
        • SlowRobotAhead 8y ago
          Ah, mules. That makes more sense because people are really stupid. Takes the locality requirement off the “brains” of the operation.
        • dawnerd 8y ago
          Luckily usps requires all new development to use cluster boxes so that should put an end to it for any new house.
          • craftyguy 8y ago
            [Citation needed]
            • 8y ago