Thummbnail image of the Change of Address Identity Verification Internal Controls report.

Objective

Our objective was to evaluate the U.S. Postal Service’s identity verification internal controls for its Change of Address (COA) service.

The Postal Service offers COA service whereby residential and business customers can apply to have their mail forwarded to a new address. This service helps customers manage potential adjustments to their mail delivery.

The Postal Service processed 36.8 million COA requests in fiscal year (FY) 2017 — 20.6 million hardcopy requests and 16.2 million online requests. Nearly 96 percent of the total COA requests during that time were from residential customers (4 percent were from businesses).

The Postal Service has a variety of controls in place to help prevent identity theft using the COA service and to protect the mail and privacy of its customers. These controls include electronically validating online COA requests using credit card addresses. The Postal Service also sends hardcopy letters to both the old and new addresses as a means to confirm and validate every COA request.

We initiated this audit based on concerns expressed by Congress, news outlets, and customer complaints regarding the internal controls and security related to the COA service and the potential risk this service could be used for fraudulent activities. The congressional inquiry specifically asked us to identify additional safeguards the Postal Service implemented subsequent to our 2008 report titled Identity Theft Potential in the Change of Address Process. All recommendations related to identity verification controls from that report have been implemented. Furthermore, the identity verification-related controls mentioned in that report — such as those related to verifying that hard copy requests have valid customer signatures and to sending verification letters — remain in place today. Since that time, the Postal Service has implemented additional enhancements to its COA-related identity verification controls, including the development of a watch list for suspect addresses, domain blocks, and flags for requests made from foreign internet provider addresses.

What the OIG Found

The Postal Service has opportunities to improve its COA service identity verification controls. First, the Postal Service lacks a control requiring customers to present a government-issued form of identification for review when submitting a hardcopy COA request at a retail facility or to their letter carrier. Leading practices, including those from foreign posts in developed countries, include having employees perform identity verifications when conducting these types of in-person transactions.

Second, the current online identity verification processes [redacted]. Such a test could help verify the customer’s identity by demonstrating their control over the linked account. The Postal Service [redacted], which uses pre-determined questions and answers such as matching the credit card holder’s billing address with that of the address in the online COA request. Leading practices advocate having a verification process that includes [redacted].

The Postal Service recognizes potential vulnerabilities in these areas, and is evaluating control enhancements. Implementing such enhancements would help reduce the risk of COA-related identity theft. Since January 2016, the U.S. Postal Inspection Service received nearly 25,000 COA complaints, including 8,900 in 2016, 11,000 in 2017, and 5,000 for the first three months of 2018.

What the OIG Recommended

We recommend management:

  • Develop and implement a national policy requiring customers to present a government-issued form of identification for review when submitting a hardcopy COA request.
  • Develop and incorporate [redacted] into its online COA identity verification processes.

Read full report.

Comments (12)

We welcome your comments related to the topic on this page. Complaints about the Postal Service, including lost, stolen or mishandled mail, that are unrelated to the content on this page, will not be posted. Please visit the Contact Us page for information on where to file formal complaints with our agency or the Postal Service.

Leave a comment

CAPTCHA
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.
  • anon

    A dead person cannot take a change of address notice to their local post office to contest the change. This happened to my family and now the consequences are that my information and my son's information is at risk because his mother's address was compromised. No change of address should be allowed without identity verification. It amazes me that this is still allowed at all. The only people who benefit from this are the criminals. I'd be happy to show identification to protect my personal information. Any honest person would.

    Jun 03, 2019
  • anon

    There should be a way for the postal customer to block any address changes not made at their local post office with proof of identity. This would go a long way in protecting the customer if their information has been compromised. This is the procedure available at the Social Security Dept. and I found it reassuring when my information was stolen. As I understand it now the customer is notified after the change has been processed.

    Mar 02, 2019
  • anon

    Hello, Rosella. Thank you for your suggestion. Please share it with the Postal Service directly at about.usps.com/transforming-business/innovations.htm

    Mar 04, 2019
  • anon

    A scammer succeeded in changing my address online and having all of my mail (including bank statements and IRS 1099's) sent to an address in another state. I never received confirmation of this change--not with a postcard, not with an email. I have to think the scammer somehow got hold of my credit-card information, and after that, it was easy. I didn't figure out for several months what was causing my mail not to be delivered. Anything addressed to my husband and to both my husband and me came through just fine. It was only items addressed solely to me that were not being delivered. I have found USPS unhelpful in correcting this situation. The first three times I asked about my missing mail, my local post office said there was nothing they could do. The fourth time I reached a person who discovered that on October 9th the change had been entered online. I was able to have a vendor trace a check they had sent to me and discover to what address the check had been delivered. It had gone to an address to a town in another state. Two of my credit-card companies had the same address. When I called Postal Inspection Services, they gave me a case number, promised someone would research it and call me back (that hasn't happened so far), and tried to suggest the problem was outside the purview of the USPS. In the meantime, I have filed a police report. It seems obvious to me that the USPS is more than a little culpable for all of the stress and time-loss they have created for me. They obviously did not do a good job of vetting the identity of the person posing as me, and they never bothered to confirm the address change with me. All of this could have been prevented if they had simply sent me a confirmation message and required that I respond to it so that they knew I had received it.

    Feb 16, 2019
  • anon

    I moved into a new apartment complex it's been a year now and the address is still not being recognised and I am having issues receiving mail what can be done. I been to the post office and I keep getting different answers I have been to my apartment office and the have no clue as to what has to be done I need an answer please. Thank you

    Feb 08, 2019
  • anon

    Thanks for showing the concept of address identity verification and the importance of it.

    Jan 03, 2019
  • anon

    How do you verify on online Change of Address to prevent fraud or identity theft??

    Nov 21, 2018
  • anon

    Street location of mailbox could be contrasted using electronic nine one one that is voluntarily inputed. just a thought.

    Nov 11, 2018
  • anon

    As long as the USPS allows anyone to mail in a COA form, there is no way to verify someone identity. Additionally, a scammer could show up at a residential customers address a week after the COA is submitted and take the address verification letter out of the mailbox. A curbside box would be ideal for this scam to succeed. The customer would not realize the problem for a few more days or more. In the meantime, some of the mail would already be on the way to the scammers address. If the forwarding address was within the same mail processing facility area, the scammer would have the customers much sooner. Just look at the problems a large firm such as UPS had when a scammer filed a COA for the company’s mail. Sending an address verification letter was useless because someone in the company’s mailroom probably had no idea what it was in the first place. It seems to me that it would be easier to do a fraudulent COA for a large company because of the address verification letter would go unnoticed.

    Sep 04, 2018
  • anon

    All Change of Address orders should be presented to postal clerks, and have them check that the customer did indeed show a proper ID. We have done that in our office for years. Perhaps a fee should finally be charged for filing a COA, perhaps only $5, but a fee none the less.

    Sep 04, 2018
  • anon

    please help with my mail and change of address.

    Sep 04, 2018
  • anon

    Have you tried to use Cortana or the mee bing browser. Both I found on ggolge playstore. If you monk around with it and set commands and update it, maybe they might ne able to provide helpful links and suggestions. If not they are really awesome extensions. Please let me know if it works.

    Sep 05, 2018