Thummbnail image of the Change of Address Identity Verification Internal Controls report.

Objective

Our objective was to evaluate the U.S. Postal Service’s identity verification internal controls for its Change of Address (COA) service.

The Postal Service offers COA service whereby residential and business customers can apply to have their mail forwarded to a new address. This service helps customers manage potential adjustments to their mail delivery.

The Postal Service processed 36.8 million COA requests in fiscal year (FY) 2017 — 20.6 million hardcopy requests and 16.2 million online requests. Nearly 96 percent of the total COA requests during that time were from residential customers (4 percent were from businesses).

The Postal Service has a variety of controls in place to help prevent identity theft using the COA service and to protect the mail and privacy of its customers. These controls include electronically validating online COA requests using credit card addresses. The Postal Service also sends hardcopy letters to both the old and new addresses as a means to confirm and validate every COA request.

We initiated this audit based on concerns expressed by Congress, news outlets, and customer complaints regarding the internal controls and security related to the COA service and the potential risk this service could be used for fraudulent activities. The congressional inquiry specifically asked us to identify additional safeguards the Postal Service implemented subsequent to our 2008 report titled Identity Theft Potential in the Change of Address Process. All recommendations related to identity verification controls from that report have been implemented. Furthermore, the identity verification-related controls mentioned in that report — such as those related to verifying that hard copy requests have valid customer signatures and to sending verification letters — remain in place today. Since that time, the Postal Service has implemented additional enhancements to its COA-related identity verification controls, including the development of a watch list for suspect addresses, domain blocks, and flags for requests made from foreign internet provider addresses.

What the OIG Found

The Postal Service has opportunities to improve its COA service identity verification controls. First, the Postal Service lacks a control requiring customers to present a government-issued form of identification for review when submitting a hardcopy COA request at a retail facility or to their letter carrier. Leading practices, including those from foreign posts in developed countries, include having employees perform identity verifications when conducting these types of in-person transactions.

Second, the current online identity verification processes [redacted]. Such a test could help verify the customer’s identity by demonstrating their control over the linked account. The Postal Service [redacted], which uses pre-determined questions and answers such as matching the credit card holder’s billing address with that of the address in the online COA request. Leading practices advocate having a verification process that includes [redacted].

The Postal Service recognizes potential vulnerabilities in these areas, and is evaluating control enhancements. Implementing such enhancements would help reduce the risk of COA-related identity theft. Since January 2016, the U.S. Postal Inspection Service received nearly 25,000 COA complaints, including 8,900 in 2016, 11,000 in 2017, and 5,000 for the first three months of 2018.

What the OIG Recommended

We recommend management:

  • Develop and implement a national policy requiring customers to present a government-issued form of identification for review when submitting a hardcopy COA request.
  • Develop and incorporate [redacted] into its online COA identity verification processes.

Read full report.

Comments (6)

We welcome your comments related to the topic on this page. Complaints about the Postal Service, including lost, stolen or mishandled mail, that are unrelated to the content on this page, will not be posted. Please visit the Contact Us page for information on where to file formal complaints with our agency or the Postal Service.

Leave a comment

CAPTCHA
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.
Image CAPTCHA
Enter the characters shown in the image.
  • anon

    How do you verify on online Change of Address to prevent fraud or identity theft??

    Nov 21, 2018
  • anon

    Street location of mailbox could be contrasted using electronic nine one one that is voluntarily inputed. just a thought.

    Nov 11, 2018
  • anon

    As long as the USPS allows anyone to mail in a COA form, there is no way to verify someone identity. Additionally, a scammer could show up at a residential customers address a week after the COA is submitted and take the address verification letter out of the mailbox. A curbside box would be ideal for this scam to succeed. The customer would not realize the problem for a few more days or more. In the meantime, some of the mail would already be on the way to the scammers address. If the forwarding address was within the same mail processing facility area, the scammer would have the customers much sooner. Just look at the problems a large firm such as UPS had when a scammer filed a COA for the company’s mail. Sending an address verification letter was useless because someone in the company’s mailroom probably had no idea what it was in the first place. It seems to me that it would be easier to do a fraudulent COA for a large company because of the address verification letter would go unnoticed.

    Sep 04, 2018
  • anon

    All Change of Address orders should be presented to postal clerks, and have them check that the customer did indeed show a proper ID. We have done that in our office for years. Perhaps a fee should finally be charged for filing a COA, perhaps only $5, but a fee none the less.

    Sep 04, 2018
  • anon

    please help with my mail and change of address.

    Sep 04, 2018
  • anon

    Have you tried to use Cortana or the mee bing browser. Both I found on ggolge playstore. If you monk around with it and set commands and update it, maybe they might ne able to provide helpful links and suggestions. If not they are really awesome extensions. Please let me know if it works.

    Sep 05, 2018