Change of address identity theft, traced from request to statement

Change of address identity theft is the redirection of someone's mail, through the Postal Service or directly with their bank, so that statements, replacement cards, checks and the bank's own warning letters reach a thief instead of the owner. At a bank it usually arrives as an account maintenance request to change the mailing address, often followed within days by a request for a new card. The rules expect banks to verify such requests on existing accounts, and the practical defence is to check the new address against what the bank already knows, write to the old address, and treat a card request soon after a move as a reason to look again. Botminds' Account Maintenance Requests is account maintenance request software that does that checking with agents and leaves the decision to two specialists. This guide follows one new address from the form to the first statement.

The traced address belongs to a sample customer of the fictional Corvane National Bank, as the solution handles it. Figures on postal fraud and the rules are from the U.S. Postal Service's Office of Inspector General and the eCFR, linked where they appear.

How change of address identity theft works at a bank

The thief's goal is not the address itself; it is what the address receives. Once a bank's mail goes elsewhere, the customer stops seeing statements that would show unfamiliar transactions, stops receiving the letter that confirms a change, and a replacement debit card or a book of checks can be sent to the new address. The address change is the quiet step that makes the loud ones possible.

The federal Red Flags guidelines name the countermeasure. A bank's identity theft program should address detection on existing accounts by "Authenticating customers, monitoring transactions, and verifying the validity of change of address requests, in the case of existing covered accounts" (12 CFR Part 41, Appendix J, section III(b)). The FFIEC's 2021 authentication guidance goes the same way, listing changes to physical or email address among the account maintenance activities that warrant enhanced authentication (FFIEC, 2021).

The sequence in Corvane's hardest case is typical. A mailed form for Eleanor M. Watts, 81, asked to move the mail on all three of her accounts to 9080 Ridgeline Parkway, Suite 212, in Kellerton, Ohio, to name a new payable-on-death beneficiary, and to send a replacement debit card to the new address. Kellerton was 128 miles from her home, the suite was a private mailbox, and the same mailbox was on two other older customers' requests that month.

Change of address fraud at the Post Office: what the inspector general found

Postal change of address fraud is real, measured and growing, which matters to banks because many treat a USPS move as evidence that a customer moved. The Postal Service's Office of Inspector General reported in 2022 that "online COA fraud and attempted identity theft by individuals and organized groups increased from 8,857 to 23,606 (167 percent) from 2020 to 2021" (USPS OIG, Management Alert 22-058-R22, April 2022).

Two findings in the inspector general's reports bear directly on banks. First, the old resident is the safety net, and it is a thin one: the Postal Service sends a validation letter to the old address and a welcome kit to the new, but "if the customer does not follow the instructions to report issues, their mail is automatically forwarded." Second, fraud clusters on addresses. The 2022 alert's table of forwarding addresses with multiple cases of fraud lists one that appears in 50 fraudulent requests in 2020 and 66 in 2021.

The 2018 audit found the controls on paper requests weak too: the Postal Service then lacked a control requiring a government-issued identification for hardcopy requests made at a retail counter or to a letter carrier, while handling 36.8 million requests in fiscal 2017, and the Postal Inspection Service had received nearly 25,000 complaints about changes of address since January 2016 (USPS OIG, Audit Report MS-AR-18-005, August 2018). The 2022 alert records that the 2018 recommendation on online verification was closed as not implemented in November 2021. The point for a bank is not today's postal controls but that a postal change of address can itself be the forgery.

Can a fraudster change a customer's address at the bank?

Someone can try, and the bank's verification is what stops them. A fraudster typically has enough of the customer's details to pass knowledge questions, a forged signature good enough for a glance, or a convincing story on the phone. What they usually do not have is control of the contact details the bank held before the request, which is why the strongest checks reach back to those.

On the account itself, the signs are the ones the Red Flags guidelines list for banks: statements that stop arriving, and mail returned while the account stays in use. For banks, the defence is a request that cannot succeed on the form alone: an address compared with the bank's own history and the postal data, a callback to a number on file before the request when anything is off, and a letter to the old address every time.

Red flag rules on address changes: what the regulation names

The Red Flags Rule does not ban address changes or prescribe a method; it requires a written program that identifies relevant red flags, detects them and responds. Its guidelines list a suspicious address change as an example of suspicious identifying information, and Supplement A gives illustrative red flags that a maintenance desk meets every week. The broader program, its elements and who approves it, is covered in the guide to the Red Flags Rule in banking; the table below keeps to the flags that touch an address.

Number 19 is the one most often met in the same envelope. The guideline reads: "Shortly following the notice of a change of address for a covered account, the institution or creditor receives a request for a new, additional, or replacement card or a cell phone, or for the addition of authorized users on the account." In the sample case, the card request was not shortly after the address change. It was on the same form.

What is the 30 day rule for card requests after an address change?

A bank that issues debit or credit cards must validate an address change before sending an additional or replacement card if the card request arrives within a short period after the address change, which the rule sets at "(during at least the first 30 days after it receives such notification)" (12 CFR 41.91(c); that is the OCC's text, and the FDIC and the Federal Reserve have matching rules). Before the address is validated, "the card issuer may not issue an additional or replacement card".

The rule gives two ways to validate. The issuer can notify the cardholder at the former address, or by another means the two have previously agreed, and give a reasonable way to report an incorrect change; or it can assess the change under its own Red Flags procedures. It may also validate the address when the change arrives, before any card request. Any notice must be "clear and conspicuous and provided separately from its regular correspondence with the cardholder." A confirmation buried in the next statement does not count.

The practical reading for a maintenance desk is that the safe default is the alternative timing: validate every address change when it arrives, with a letter to the old address, so a later card request is already covered. Corvane does both: every address change produces two letters, one to the old address and one to the new.

Is a USPS change of address proof of a move?

No. A match with a permanent postal change of address filed by the same customer is good evidence, and it lowers the risk of a request, but it is not proof, because the postal record can itself be fraudulent, as the inspector general's figures show. It is one signal, to be read with the others.

Corvane uses the match as one of four conditions for its low-risk lane, not as a pass. A request goes there only if the address matches a permanent postal change of address by the same customer, no takeover signal appeared in 90 days, and the request came through a verified channel; even then a checker opens one in 20 in full before approving the group. On the sample day, 612 address changes met the conditions, 31 were opened in full, and one was pulled out for a specialist because the postal change was a temporary forward, not a permanent move.

Clean address changes cleared in a group, with one in 20 opened in full

Why does a bank send a change of address verification letter to the old address?

Because if the change is fraudulent, the old address is where the real customer still is. A letter there is the cheapest way for the bank to hear "I did not ask for this" before a card, a statement or a check is sent to the new one. The card issuer rule builds its validation around exactly that notice, and the Postal Service's own process does the same with its validation letter to the old address.

The letter's wording matters as much as its address. It should say a change was requested and how to report it if the customer did not make it, using contact details the bank already had, and it should not repeat the new address or anything else that would help a fraudster who has access to both mailboxes. At Corvane, the confirmation is drafted from an approved template and goes to both addresses once the change posts.

One new address, from the form to the first statement

Follow the Watts address the whole way and the weak points show. The Intake agent read it from line 4 of the form, and the clip under the new value opens that line as scanned at the bank's mail center, with the envelope postmarked Kellerton, Ohio, on October 16. That one source line is what a specialist, a checker and an examiner will each look at, which is why it is attached to the value rather than left in a document folder.

The requested address opens the line of the form it came from

From there the address would have reached every system that mails or verifies: the core banking system, the card processor that sends the replacement card, the statement and notice files, the digital banking profile, and the confirmations. At Corvane, the request never got that far. The agents found five takeover signals, the specialist held the request for a callback to the landline the bank had held since 2009, and Mrs. Watts said she had not moved. Her mailing address stayed at Linden Hollow Road, and no card was mailed.

For the address changes that are genuine, the same path ends with the core read back after posting, so the bank knows the stored address is the approved one, and with two confirmations, one to each address. Whether the card processor and statement files picked up the same value is something a bank should test after go-live, not assume.

Measuring whether the address is right: five checks after posting

An address can be verified and still be wrong where it matters. Quality assurance for address changes should test the downstream copies and the weeks that follow, not only the decision. These checks turn the regulation's examples into measures a deposit operations team can report monthly.

Each check yields a rate that can be tracked. A rising rate of returned mail on recently changed addresses, or of card requests inside the 30-day window, is an early sign that a takeover pattern is working through the desk. Callback verification when the phone on file just changed shows how an address change sits between a phone change and a beneficiary change, and the questions to ask a vendor include how its tool proves these checks.

Questions people ask

What is change of address fraud?

It is filing a change of address in someone else's name, with the Postal Service or a business such as a bank, to divert their mail. Online postal requests are validated by a $1.10 card payment, and the inspector general found in 2022 that this check did not verify identity effectively. Diverted bank mail can include statements, new cards and the confirmation letters meant to warn the customer.

How do banks verify a change of address?

Methods vary, but the strong ones compare the new address with what the bank already knows, check postal and private mailbox data, look for other recent changes on the account, write to the old address and, when signals appear, call back on a number the bank held before the request. The Red Flags guidelines ask banks to verify the validity of change of address requests on existing accounts.

Can a bank refuse an address change it cannot verify?

A bank can delay or decline an address change it cannot verify, and doing so is part of the identity theft program the Red Flags Rule requires. In practice it will ask for more verification, such as a callback to the number on file or a branch visit with identification, rather than refuse outright.

How long does a bank address change take?

A clean change can post the same day; one with warning signs waits for a callback. At Corvane the design target is same-day for clean requests received by 2 p.m., and a held request is due a callback within four business hours.

What should a bank do when a USPS change of address arrives before the customer's request?

Treat it as a reason to check. A change the customer makes directly with the bank comes through a channel the bank can verify, and a postal change of address that matches it strengthens the request; a postal change the bank sees first, with no word from the customer, is worth a callback on a number held before the change.

What must a card issuer do when a card is requested soon after an address change?

For a debit or credit card, the issuer may not send the card to the new address within the rule's window until it has validated the change, for example by notifying the former address. That letter is the customer's chance to report the fraud, which is why it has to be separate from regular statements.