Adversaries Exploit Vacant Homes to Intercept Mail in Hybrid Cybercrime

Cybercriminals are combining physical infiltration with digital fraud in an increasingly sophisticated hybrid attack model: exploiting vacant homes as "drop addresses" to intercept physical mail. A new threat intelligence report from Flare documents how threat actors leverage empty properties, fake identities, and postal service abuse to enable a wide range of downstream fraud — from financial account takeover to government benefit theft.

What Is a Drop Address?

A drop address is a physical location used by criminals to receive stolen or fraudulently ordered goods, financial documents, and government correspondence — without exposing their real identity or location. Traditionally, these were properties rented using stolen identities or complicit individuals. The new twist identified by Flare involves systematically targeting vacant homes — properties that appear occupied on paper (often via forged change-of-address requests) but have no actual residents to notice intercepted mail.

How the Attack Works

The fraud chain leverages a combination of publicly available property data, social engineering of postal services, and exploitation of gaps in address verification systems.

Hybrid Fraud Chain:
 
1. RECONNAISSANCE
   - Threat actors identify vacant homes using public records,
     real estate listings, tax databases, or foreclosure filings
   - Target properties that appear unoccupied but maintain
     valid mailing addresses in postal databases
 
2. POSTAL INFILTRATION
   - Submit fraudulent change-of-address (COA) requests via
     USPS or equivalent postal service
   - Re-route mail from victims to the vacant property address
   - Alternatively, file address changes for the vacant property
     itself to receive mail addressed there
 
3. PHYSICAL COLLECTION
   - Operatives physically visit the vacant property to
     collect intercepted mail
   - Use of couriers, mules, or organized collection networks
     reduces personal exposure
 
4. EXPLOITATION
   - Bank statements → account takeover, new credit applications
   - Government documents → identity theft, benefits fraud
   - Tax documents → fraudulent tax returns, IRS impersonation
   - Credit card offers → unauthorized new account openings
   - Medical correspondence → healthcare fraud

Why Vacant Homes?

Vacant properties present a unique opportunity for fraud operators:

• No vigilant occupant to notice missing mail or report tampering
• Valid legal address — passes address verification checks used by financial institutions
• Plausible deniability — difficult to trace criminal activity to any specific individual
• Scale — millions of vacant properties exist across North America and Europe, providing an essentially unlimited supply of drop address candidates
• Low upfront cost — no need to rent or control the property; mail collection only requires brief physical access

Flare researchers noted that threat actors actively discuss targeting strategies for vacant properties in underground forums, with some groups sharing automated tools for identifying and cataloguing suitable drop addresses.

Underground Forum Activity

The Flare report highlights that this technique is openly discussed in cybercriminal communities. Forum posts include:

• Guides for filing fraudulent change-of-address requests online
• Methods for identifying vacant properties in specific geographic areas
• Operational security advice for physical mail collection to avoid surveillance
• Services offering "ready-to-use" drop address networks as a commercial offering (Drop-as-a-Service)

The commoditization of this technique — from manual individual fraud to organized criminal services — mirrors the broader trajectory of cybercrime toward professionalized, scalable attack platforms.

Affected Services and Data Types

Mail interception at drop addresses targets a broad range of correspondence:

FINANCIAL:
- Bank account statements and debit/credit cards
- Loan and mortgage documents
- Investment account correspondence
- Tax refund checks
 
GOVERNMENT:
- Social Security / National Insurance correspondence
- Driver's license renewals
- Passport applications
- Government benefit notifications
 
HEALTHCARE:
- Insurance explanation of benefits
- Medical billing statements
- Prescription notifications
 
IDENTITY DOCUMENTS:
- Replacement ID documents ordered using stolen identity
- Background check results
- Employment verification letters

Defensive Measures

For Individuals

• Opt in to USPS Informed Delivery (US) or equivalent postal notification services — receive daily email previews of mail before physical delivery, enabling detection of unexpected items
• Use a PO Box or secure mailbox for sensitive financial and government correspondence
• Monitor credit reports for unauthorized accounts opened at unfamiliar addresses
• Set up alerts with financial institutions for address change notifications
• Freeze your credit with all three major bureaus to block fraudulent account opening

For Financial Institutions and Government Agencies

VERIFICATION ENHANCEMENTS:
- Require multi-factor verification (not just address match)
  for change-of-address requests
- Cross-reference new addresses against vacant property databases
  before processing high-value correspondence
- Implement velocity checks on address changes tied to
  financial account activity
- Use identity verification services that go beyond address
  match for new account creation

For Property Managers and Real Estate

• Report long-term vacant properties to local postal services to flag them for monitoring
• Ensure vacant properties are not accumulating mail that could signal exploitable drop address status
• Work with municipal authorities to maintain accurate vacancy records

Broader Implications

This technique represents an important evolution in cybercriminal methodology: the deliberate reintegration of physical operations into digital fraud chains. As financial institutions have improved digital fraud detection — flagging unusual login locations, device fingerprinting, behavioral biometrics — attackers are increasingly supplementing purely digital techniques with physical components that bypass these controls.

The postal system, designed decades before modern fraud at scale, has limited ability to authenticate the legitimacy of address change requests. This structural weakness, combined with the enormous volume of mail carrying sensitive financial and identity information, makes it an attractive and underexplored attack surface.

Source: BleepingComputer — April 2, 2026 · Flare Threat Intelligence