Joe Merola of Blacksburg has read with interest some recent columns on identity theft. He experienced that outrage himself this past summer. In Merola’s case, the thief employed an interesting tactic: He (or she) used the U.S. Postal Service to help steal Merola’s identity.
Ironically, a relatively recent postal service technology gizmo also helped the Virginia Tech professor quickly realize what was happening and head off the crime. The only thing Merola lost was a package of mail-order medicine, and dozens of hours trying to repair the damage.
But the thief came close to procuring three credit cards in the names of Merola and his wife, Catherine. The result involved three credit bureaus, fraud departments in at least two banks, the Social Security Administration, the Federal Trade Commission, the Postal Service Inspector General, local police and postal inspectors.
“I frankly marvel at [the thief’s] ingenuity,” Merola said.
The gizmo is called “Informed Delivery.” It’s free and available to residential customers in a majority of U.S. Zip Codes. It provides them with daily digital images of mail on its way to their homes. You have to sign up for it — online — and you need a computer, tablet or smart phone to access information it provides.
Fortunately for Merola, he had signed up for Informed Delivery sometime in the past year. That proved especially handy this past July 15, which was a Monday. His Informed Delivery message that day told him to expect several pieces of mail, including a package from a mail-order pharmacy. But no mail arrived at Merola’s house that afternoon.
Merola checked his Informed Delivery account again. It noted the pharmacy package was “out for delivery.” But the package’s tracking also noted that it had been forwarded to another address, which seemed curious.
On July 16, Merola called the Blacksburg Post Office. Eventually, a male employee informed Merola all his mail had been forwarded to an apartment complex in Alpharetta, Georgia.
“We don’t know exactly how,” Merola said. “But we do know it was relatively easy” for someone to get the Merolas’ mail forwarded to the other address. “It took a little bit of chatting to convince him [the postal employee] that neither I, my wife or son or any other relative requested this forward,” he said.
The Blacksburg postal worker canceled the forward-mail order and suggested Merola call the U.S. Postal Service and file a report. When Merola did that, he spoke with a woman who assigned him a case number. She told him to file a report with the Postal Service Inspector General, and contact the Social Security Administration as well.
Merola filed fraud reports with the Inspector General and the Federal Trade Commission online.
By virtue of his membership in the American Automobile Association, Merola has access to his credit report through Experian, a consumer credit reporting agency. When he checked his Experian account, he learned there were two recent “hard inquiries” from two different major American banks, Wells Fargo and JPMorgan Chase. He ordered a freeze on that account.
Next he tried to set up an online account with the Social Security Administration, to ensure nobody else was accessing that. But he was unable to do it because he had placed the freeze on his Experian account. Merola called Social Security and learned nobody else had tried to set up an account using his name and Social Security number.
Because the fraudulent forward order had been canceled, mail delivery resumed to the Merolas home on Wednesday, July 17. In his mail that day, Merola found a credit card in his name from Wells Fargo, but for which he had not applied.
He called Wells Fargo and had it canceled, and opened a case with the bank’s fraud department. He also called JP Morgan Chase, and learned someone had applied for their card in his name as well. Next he called Blacksburg Police and filed a report.
On Friday, July 19, another credit card in Catherine Merola’s name arrived at the Merolas’ home. She had not applied for that, either. She had to go through the same notification processes her husband did.
Ultimately, all the mail that Informed Delivery had told the Merolas to expect arrived at their home — except for the mail-order prescription from the pharmacy. Merola’s Informed Delivery indicated that had been delivered to the Alpharetta, Georgia, address.
So he called the pharmacy, and learned they could not issue another prescription. Neither would his insurance pay for it if they could.
Ultimately, “I had to give [the mail-order pharmacy] a copy of the police report, and other fraud reports I had made, and they replaced the prescription. They made me pay for it first, but reimbursed me later,” Merola said.
In the end, the above travails cost the Merolas nothing, “except for my time, which is valuable,” he said. Merola estimated he and Catherine spent between 30 and 50 hours on the phone and online filing various fraud reports to different banks and government agencies.
How did the Merolas’ mail get forwarded in the first place? They still aren’t sure how that happened. Mail may be forwarded (or held) by dropping off a card at a Post Office, and that can also be ordered online.
Beginning this month, the postal service made a key change regarding online hold or forward orders. Customers must verify their identity online to complete such an order.
“The U.S. Postal Service takes the privacy of customers’ mail very seriously and takes measures to ensure that all personal information is protected. These updates are being made to increase security for postal service customers,” said Tad Kelley, a postal service spokesman.
Meanwhile, the postal service is pushing Informed Delivery. Merola recommends it highly.
“If I hadn’t had Informed delivery, I might have delayed contacting the Post Office by a few days.”
And by then, as many as three credit cards in the Merolas’ names might have been in the hands of thieves. In that case, there’s no telling what kind of financial havoc could have been wrought.