Change-of-Address Redirect Fraud

Change-of-address redirect fraud involves a criminal submitting a mail forwarding order in your name to the postal service — typically using your real address and a little publicly available personal data to pass the basic verification check. Once the redirect is active, all physical correspondence sent to your home is delivered to the fraudster's chosen address instead.

The attacker's goal is to intercept valuable items: replacement credit and debit cards, bank statements containing account numbers, government letters containing benefit information or tax documents, new chequebooks, and identity documents. Intercepting this mail provides a near-complete identity package that enables further fraud — new accounts, loans, and benefit claims.

The postal redirect also serves a concealment purpose: by diverting your correspondence, the fraudster ensures that warning letters from lenders, fraud alerts, and account notifications never reach you, extending the window during which fraud can proceed undetected. You may simply notice that your post has stopped arriving and assume a postal delivery issue.

In many countries, a change-of-address request requires only basic information — full name, current address, new address, and a small administrative fee paid by card. The verification threshold is low by design: postal services want to make address changes easy for the millions of people who move home legitimately every year.

Fraudsters submit these requests online or in person at post offices, using your name and current address (which is often publicly available or obtained from a data breach) and nominating an address they control — often a temporary mail drop, a vacant property, or an address associated with a money mule.

The redirect typically activates within a few days. You will receive no physical confirmation at your new address (because you are still at your original address and that is where confirmation is sent — but incoming mail is already diverted before it arrives). You may receive a confirmation email if you have a registered account with the postal service, but many people do not.

Postal address change processes are designed for convenience, not security. The low barrier means most requests are processed automatically. Because the confirmation of a redirect often goes to the new address rather than the original address, victims may not be alerted at all. The fraud is invisible: you simply stop receiving post, which can easily be misattributed to postal delays.

[Postal Service]: a mail forwarding request has been submitted for [Your Name] at [Your Address] to [New Address]. If you did not request this, call [Fraud Line].

Important: your address registered with [Bank] has been changed to [New Address]. If you did not make this change, contact us immediately.

[Government Agency]: your correspondence address has been updated. If this change was not authorised, call [Number].

Your [Credit Card] replacement has been sent to the address we have on file. Expect delivery in [X] days.

We attempted to deliver an item to [New Address] from [Bank/Government Agency]. No one was available to sign for it.

Register for your national postal service's informed-delivery or address-management service. In the US, USPS Informed Delivery provides daily email previews of incoming mail — any redirect would cause previewed items to stop arriving. In the UK, Royal Mail offers an address update confirmation service. Periodically log in to these services to confirm no redirect is active on your address. If post unexpectedly stops arriving, contact your postal service directly rather than assuming a delivery issue.