Newsgroups: comp.risks
X-issue: 16.44
Date: Sun, 25 Sep 1994 10:55:50 -0400
From: "Jonathan I. Kamens" <jik@cam.ov.com>
Subject: Authentication of changes of address (Re: Postal address disasters)

Six months or so ago, my father went to the post office to put a temporary
hold on his mail because he was going on vacation, and the clerk he spoke to
said something to the effect of, "Now, when you say on this form that you want
your mail to start being delivered on date <x>, you really mean that you want
it to start being forwarded to your new address, right?"

Puzzled, my father responded, "What new address?"

The clerk responded, "The address you sent us on your change-of-address card."

My father hadn't sent in a change-of-address card.  Subsequent investigation
(and a number of interviews with the postmaster at that post office) revealed
that someone had sent a fraudulent change-of-address card in my parents' name
to the post office, forwarding their mail to a non-existent address in
California.  The card was sent from another state.  it seems unlikely that
whoever sent it will ever be caught.

Fortunately, the deception was detected before they started forwarding the
mail, because of the coincidence of the timing of my father's visit to the
post office.  If he hadn't gone in to put a hold on his mail, the post office
would have happily started forwarding it with no questions asked.

Obviously, the problem here is that there was no authentication whatsoever of
the change of address.  Admittedly, the post office does send a
change-of-address kit to anyone who files a card, but if the card asks for the
forwarding to begin immediately, it will start happening quite a while before
the kit arrives.  And the kit will be forwarded to the new address, which
doesn't do much good if it's a fake!

Even something simple like delivering a confirmation card to any address that
requests a change of address, and requiring that it be filled out and returned
before processing the change, would be a huge improvement over the current
system.  Who knows why the post office doesn't do this.

Jonathan Kamens  |  OpenVision Technologies, Inc.  |   jik@cam.ov.com