Fraudulent activities now extend beyond conventional hacking methods, exploiting genuine services and tangible infrastructure. By piecing together readily available data, flawed identity checks, and gaps in procedures, criminals are developing scalable, budget-friendly, and hard-to-spot fraud schemes.

A tutorial, found on a chat group focused on fraud and examined by Flare researchers, details how to spot and take advantage of empty homes to reroute mail, showcasing a simple yet remarkably effective way to commit identity theft and financial scams.

This method, which focuses on misusing real services and physical logistics, differs from typical cybercrimes that depend on malware, phishing kits, or unauthorized network access.

The strategy combines freely available information, postal service features, and fake IDs into a synchronized operation to gain ongoing access to individuals’ mail.

The tutorial starts by explaining how to find vacant homes (referred to as “drop addresses”) that can be used to receive mail without immediately raising suspicion from the actual residents.

Criminals are advised to search real estate websites like Zillow, Rightmove, or Zoopla, filtering for recently listed rentals. Attackers focus on these listings because they are more likely to be vacant between tenants.

The instructions also suggest looking at older listings to find homes that have been empty for a while, making them more reliable for use as drop locations.

In some cases, the criminals suggest taking care of neglected properties to make them look occupied, reducing the risk of attracting attention when using the addresses for illegal purposes.

After finding an appropriate address, the next step involves using online postal services to discover and track incoming mail.

Informed Delivery, for example, allows people to see digital images of their letter-sized mail and track packages at no cost.

By signing up for these services using the chosen address, attackers can remotely monitor incoming mail and pinpoint valuable items like financial documents, credit cards, or verification letters before they physically access the mailbox.

This turns mail delivery into a way to gather information, allowing for more focused and effective fraud.

If the address is already registered, the tutorial suggests using change-of-address requests to regain control of mail delivery. These services are meant for legitimate individuals moving their residences and are widely offered by postal systems like USPS.

Submitting a permanent or temporary Change of Address (COA) request online or in person allows users to have their mail forwarded to a new location for a period ranging from weeks to months.

Other services, like Premium Forwarding, can collect and redirect all incoming mail regularly.

While these services include security measures like requiring a small online payment tied to a billing address or showing a valid photo ID in person, the tutorial implies that attackers believe these measures are not stringent enough or are inconsistently enforced.

In particular, the ability to submit forwarding requests remotely, combined with verifying the address rather than firmly establishing a user’s real identity, may create opportunities for abuse if the related identity information is stolen or falsified.

As a result, control over mail delivery can, in some instances, be transferred without directly involving the actual resident, turning a service designed for convenience into a way to illegally redirect mail.

At this point, the operation shifts from passively selecting targets to actively monitoring them, providing attackers with information that significantly increases the success of subsequent fraud.

Once it’s confirmed that valuable mail is being delivered, the strategy shifts toward establishing ongoing access through mail forwarding services.

Attackers are told to create personal mailbox accounts that enable them to forward all incoming mail from the drop address to another location under their control.

Because these services usually require identity verification, attackers use fake IDs, forged documents, or purchased private information to complete the process.

This marks a key shift from sporadic interception to regular access. Once mail forwarding is set up, attackers no longer have to physically visit the location, decreasing the risk of exposure while maintaining continuous access to sensitive information.

The use of fake identities, often involving fabricated personal details or Credit Privacy Numbers (CPNs), shows how this technique fits into wider fraud schemes.

Rather than occurring in isolation, using drop addresses becomes part of a bigger process that can support account takeovers, credit card fraud, and refund scams.

In reality, these fake identities can be used to register mailbox services, submit forwarding requests, or receive sensitive financial mail related to victim accounts.

This allows attackers to connect online breaches with real-world access, enabling them to complete verification steps, intercept authentication information, or create new accounts under assumed identities.

Consequently, gaining control of a physical address can serve as an important step in fraudulent activities that depend on both identity credibility and access to legitimate communication channels.

The method described in the tutorial reflects a broader trend in fraud, where online information gathering is combined with manipulating the physical world.

Besides leveraging online platforms and postal services, attackers also describe using individuals (sometimes recruited from vulnerable populations) to physically access mailboxes or collect delivered items.

This introduces a human element into the operation, allowing attackers to outsource risk and further distance themselves from direct involvement.

The activity described in the tutorial reflects a wider increase in mail-related fraud that has recently been documented. According to U.S. Postal Inspection Service data, reports of mail theft have increased substantially in recent years, with thefts from mail receptacles up 139% between 2019 and 2023.

The financial impact is significant, with mail theft schemes linked to hundreds of millions of dollars in suspicious activity related to check fraud.

At the same time, abuse of postal redirection services, similar to the technique mentioned in the tutorial, has also increased, with change-of-address fraud growing sharply year-over-year. Together, these trends emphasize the increased value of controlling physical mail.

However, the tutorial acknowledges operational challenges. Financial institutions are increasingly flagging virtual addresses and commonly reused locations, suggesting that security teams are starting to include address-based risk factors in their detection systems.

Consequently, attackers stress the importance of finding “clean” residential addresses that have not yet been linked to fraudulent activity.

These elements together illustrate a fraud model that is driven not by high-tech methods, but by coordination, adaptability, and the strategic use of legitimate systems.

While this might appear to be a unique tutorial, similar tutorials on how to find physical drop addresses are common, some are free and others require payment.

The rise of these techniques highlights a growing challenge for organizations: many of the systems being exploited (real estate platforms, postal services, and identity verification processes) are outside the scope of traditional cybersecurity defenses.

As fraud operations continue to evolve, detection increasingly depends on linking signals across different areas, including address usage patterns, mail forwarding activity, and identity inconsistencies. Without this broader perspective, attacks that rely on legitimate services rather than technical exploits may continue to bypass standard security measures.

Learn more by signing up for our free trial.

Sponsored and written by Flare.