Postal inspectors warn of spike in holiday scams, mail theft

As the holiday season brings increased shopping and package volume, the U.S. Postal Inspection Service is warning consumers about a rise in sophisticated scams and mail theft.

With the uptick in mailing and shipping, the federal law enforcement agency is asking the public to take steps to protect their purchases and personal data.

Criminals are escalating their efforts to steal personally identifiable information and physical packages through schemes like phishing, smishing, brushing, and quishing, according to an advisory from the U.S. Postal Inspection Service.

Phishing and Smishing Attacks

Phishing (via email) and smishing (via text message) are cyberattacks where criminals impersonate U.S. Postal Service officials or the organization to trick victims into providing sensitive personally identifiable information, including credit card or Social Security numbers.

These communications often contain official-looking language regarding package deliveries, unpaid postage, or a “Delivery Failure Notification,” complete with a fake URL or file. Clicking on these links or opening the file can lead to the theft of personal information or even infect a device with malware or a virus.

To prevent falling victim to these cyber scams, the U.S. Postal Inspection Service advises customers to:

• Be suspicious of any email or text message requesting personal or business information.
• Do not click on unsolicited links, especially from unknown numbers or suspicious email addresses
  
  Brushing and Quishing Schemes

A less common but growing threat is the “brushing” scam, where unsolicited, un-ordered merchandise arrives at a customer’s door. While this merchandise is legally the recipient’s to keep without payment or return, the goal is often more nefarious than a free gift.

Brushing scammers use this method to write fake online reviews in the recipient’s name, artificially boosting their product sales.

Some of these unexpected packages may contain a QR code, which directs to a “quishing” website when scanned. These sites are designed to prompt users to surrender personal information.

Consumers can cut out these crimes by:

• Refraining from scanning unknown QR codes.
• Never providing personal information to unverified or unknown sources, which could compromise identity.

Mail and Package Theft

The high volume of holiday mail and packages creates greater opportunities for thieves, despite the U.S. Postal Inspection Service making thousands of arrests for mail theft annually. Postal inspectors emphasize that they are actively monitoring for mail thieves year-round.

To protect against mail theft this season, consumers should:

• Avoid leaving letters and packages unattended in mailboxes or at doorsteps for any length of time, as this increases their vulnerability to theft.
• Never send cash through the mail.
• Use delivery management tools such as Hold for Delivery, opt for secure delivery lockers, or have a trusted neighbor retrieve mail and packages when away from home.
• Request signature confirmation and add tracking to packages.
• Hand outgoing mail directly to a letter carrier, use a secure receptacle at a place of business, or mail it at the post office.

The U.S. Postal Inspection Service asks anyone with a camera system focused on their mailbox or front door to save any footage of mail thieves in action and report the incident to postal inspectors by calling 877-876-2455 or submitting a report at uspis.gov/report.