Postal Service site lets anyone hold your mail

Wednesday night on Off The Hook, a radio show on WBAI in New York, Emmanuel Goldstein and the guys from 2600 discussed a feature on the Web site of the U.S. Postal Service that can only be described as ill-conceived.

If you're going to be away from home for a while, the your local post office can hold your mail to avoid an overflowing mailbox. Fine.

In the old days (and you can still do this), you went to the office and filled out a form (PDF). Someone on the show who has done this said the Postal Service doesn't validate the identity of the person who requests mail to be held. It validates only the identity of the person who comes to pick up the mail.

Government techies copied this manual system to the Internet.

You can go to https://holdmail.usps.com (or click on Hold Mail at the Postal Service home page, as shown below) and put a hold on mail delivery. Notice that I didn't say put a hold on your mail delivery. You can put a hold on mail delivered to anyone. This is true with the traditional system, too, but the Internet makes it worse, adding more anonymity and making the process easier. Too easy.

The agency site claims that it needs a name, address, and phone number to stop mail delivery. When tested, however, this turns out not to be the case. Requests with wrong names and wrong phone numbers were accepted, according to a listener who wrote in to the show. All you really need to know is an address.

And with the address, you can stop all mail delivery, not just mail to one person. Quoting from the Frequently Asked Questions: "All mail, regardless of name, will be held for the address entered. Submitting an online Hold Mail request once is all that is required to hold mail delivery for everyone at the address."

Don't have a computer? Simply call 800-ASK-USPS

Off The Hook runs for an hour, but you can listen to this 8-minute segment here

WBAI has an MP3 of the entire show.

See a summary of all my Defensive Computing postings.

[auto1234]

Despite this hole, I would say this is a wonderful service. I had to use when I was out of the country for 3 months. Offcourse, somebody told me about it in last one month of vacation so I could at least hold one month of letter. For other tow months, my mail were just being returned back. So you can imagine my relief on seeing this service and I was amazed.

So despite the hole of being able to hold anybody's mail. It's foolproof, in the sense that one identity is checked when somebody goes to pick it up.

Um, this is not a new feature. I used the hold mail service via the USPS website at least 5 years ago. As you said, there has never been validation of the requester, even when made in person. I don't see why this is such a big deal.

[pmfjoe]

Rather funny, I have also used this service before and I never thought of it's possible nefarious use until now. Thanks Cnet.

[sandrift]

Although mail holding may not require identification, I would imagine that picking it up at the post office would. The scarier case would be mail *forwarding*; fortunately, the USPS website does require identity verification.

[RicABlair]

Nefarious? NOT! So, the 1st time it's done maliciously you go, identify yourself, pick up your mail and warn the USPS of this "nefarious" deed. The second time it's done, you return there to undo the hold and advise the Postal Inspectors that postal fraud is being committed and to be on the alert for someone stopping your mail. The 3rd time you go back, it's to laugh at the joker who has been caught trying to have your mail held. Inspectors go postal when a fraud is being perpetrated. (I worked for the USPS at Xmas and summers) At no point is any of your mail in the wrong hands.

[showme69]

I think this service is great if it worked. Unfortunately, it's as unreliable as everything else the postal service does. Two out of the three times I used it, my mail was not held. We live in MO and were in VA once and luckily my parent checked the house and discovered the mail was still being delivered. I'll never use the website to hold mail again. I'll stick to the old fashioned way of going to the post office and filling out the paper form.