Mail Rerouting Identity Theft via Postal Mail
How thieves intercept physical mail from letterboxes, shared mail areas, and postal redirects to harvest financial documents and enable identity theft.
Part of: Mail Rerouting Identity Theft
Last reviewed: 8 June 2026
While phishing and data breaches dominate headlines, physical mail theft remains a significant and underappreciated source of identity theft. Bank statements, new payment cards, tax documents, and pre-approved credit offers contain everything a fraudster needs to impersonate a victim, and stealing them from an unlocked letterbox or a shared building's mail area requires no technical skill.
Mail rerouting as an identity theft method is distinct from simple mail theft in that it involves a deliberate, sustained interception rather than an opportunistic theft. This includes submitting fraudulent postal redirect orders, bribing postal workers in rare cases, and systematically monitoring shared mail areas in blocks of flats or apartment buildings.
Understanding the physical mail threat alongside digital threats is important because most fraud prevention advice focuses on online channels, leaving the letterbox as a poorly guarded source of sensitive documents.
How this scam works on postal mail
In the simplest form, a fraudster checks an unlocked shared letterbox area in an apartment block or communal building, taking envelopes that appear to come from financial institutions. New card packages — identifiable by their consistent size and banking logos — are particularly valuable. Bank statements provide account numbers, and tax documents provide SSNs and income information.
In more organised operations, a fraudster submits a postal service redirect order (as described in the change-of-address entry) for a specific victim, routing all their mail to a receiving address where a co-conspirator collects it. This method targets an individual rather than simply taking whatever is available from a shared area.
The intercepted documents are used to apply for additional credit, activate new cards in the victim's name, obtain replacement documents, or build a comprehensive profile for synthetic or full identity fraud. Victims may notice the fraud only when their credit score drops, unexpected accounts appear, or they try to use a financial service and find it has already been accessed.
Common red flags
- Expected cards, statements, or correspondence do not arrive on their normal schedule
- A new card arrives that you did not request, indicating someone may be accessing your account
- Notices from institutions reference correspondence they sent that you never received
- Neighbours in a shared building have also reported missing mail
- Unknown accounts appear on your credit report around the time of suspected mail theft
How to protect yourself
- Use a secure, locked letterbox or a PO Box for sensitive financial correspondence
- Sign up for electronic statements and correspondence to reduce the volume of sensitive physical mail
- Shred all financial documents before disposal, including pre-approved credit offers
- Monitor expected card delivery dates and contact your institution if a card does not arrive within the expected window
- Register for USPS Informed Delivery (US) to track expected mail daily
How to report it
- Report mail theft to the USPS Postal Inspection Service at postalinspectors.uspis.gov or by calling 1-877-876-2455
- In the UK, report to Royal Mail's security team and to Action Fraud at actionfraud.police.uk
- File a police report for use in credit dispute processes
- Report to the FTC at reportfraud.ftc.gov if identity theft has resulted
Frequently asked questions
Should I still use paper statements if I am concerned about mail theft?
Electronic statements eliminate the mail theft risk for those documents and are generally the lower-risk option. If you prefer paper, ensure your letterbox is secure and shred all documents promptly after reviewing.
My neighbour also reports missing mail. What should we do?
Collective reports from multiple residents are taken more seriously by postal authorities. Coordinate with neighbours to file a joint report with the USPS Postal Inspection Service or your country's postal security authority, and report to local police as well.