Fraud Tutorial Details Use of Vacant Homes to Intercept and Redirect Mail
Summary
Flare analysts describe a tutorial for using vacant homes, postal services, and fake identities to monitor and redirect mail for potential identity and financial fraud. The article recommends correlating address, forwarding, and identity signals to detect abuse.
Key points
- Flare analysts analyzed a fraud tutorial circulated in Telegram and other forums that describes using vacant residential properties as mail “drop” addresses.
- The tutorial advises finding recent or long-standing property listings on sites including Zillow[.]com, Rightmove[.]com, and Zoopla[.]com.
- It describes using Informed Delivery to monitor incoming mail and change-of-address or forwarding services to redirect it.
- The described methods include fake identities, forged documents, or purchased personal data to set up mailbox services and forwarding requests.
- The article says these tactics could support identity theft, account takeovers, credit fraud, and refund scams; it also describes recruiting people to collect mail in person.
- For detection, the article recommends correlating address usage, forwarding activity, and identity inconsistencies; it says financial institutions are increasingly flagging reused addresses.
- The article cites USPS-related data reporting a 139% rise in theft from mail receptacles between 2019 and 2023.
Article Details
- Event Type
- Flare analysts reported a fraud tutorial describing how to identify vacant residential addresses and abuse postal services to intercept and redirect mail.
- Impact
- The described workflow could enable mail interception, identity theft, account takeovers, credit fraud, and refund scams. The article does not confirm that the specific tutorial's instructions were carried out. It cites U.S. Postal Inspection Service–related data reporting a 139% rise in theft from mail receptacles between 2019 and 2023, and says mail-theft schemes have been linked to hundreds of millions of dollars in suspicious activity tied to check fraud.
Vendors
Products
Change of Addressand dark web forums showing how to find “drop” addresses, use services like Informed Delivery and Change of Address, and set up persistent mail forwarding with fake identities to scale low-tech, hard-to-detect fraudInformed Deliverytutorials on Telegram and dark web forums showing how to find “drop” addresses, use services like Informed Delivery and Change of Address, and set up persistent mail forwarding with fake identities to scale low-tech,Premium ForwardingAdditional services, such as Premium Forwarding, can consolidate and redirect all incoming mail on a recurring basis.RightmoveAttackers identify vacant “drop” addresses via real estate platforms such as Zillow, Rightmove, and Zoopla.ZillowAttackers identify vacant “drop” addresses via real estate platforms such as Zillow, Rightmove, and Zoopla.ZooplaAttackers identify vacant “drop” addresses via real estate platforms such as Zillow, Rightmove, and Zoopla.
Countries
Industries
Postal servicesThreat actors are abusing vacant residential properties, real estate listings, postal services, and weak identity verification to intercept and redirect mail for identity theft and financial fraud.real estateThreat actors are abusing vacant residential properties, real estate listings, postal services, and weak identity verification to intercept and redirect mail for identity theft and financial fraud.