Locking Down Your USPS Online Account to Prevent Unauthorized Change‑of‑Address

Changing a mailing address should be simple—and safe. But criminals abuse change‑of‑address (COA) and mail forwarding to divert bank statements, replacement cards, tax documents, and identity clues. A single unauthorized USPS COA can set off a chain reaction of account takeovers. The good news: you can harden your USPS online account and add layered defenses that make fraudulent address changes much harder to pull off. This step‑by‑step guide shows you how.

Why Unauthorized Change‑of‑Address Is a Serious Risk

When your mail is redirected—even temporarily—thieves can gather enough information to open credit, intercept replacement cards or checks, or pass additional identity verification. Paper mail remains a high‑value target because it bridges the gap between your offline identity (name, date of birth, address) and your online accounts (banking, taxes, insurance, utilities).

• Account takeover: Statements and security mailers reveal account numbers, partial SSN, and recovery codes.
• Financial fraud: Criminals may add your new “moved” address to bank and credit profiles to pass fraud checks.
• Privacy exposure: Sensitive medical, insurance, or legal mail can be harvested for impersonation.
• Downstream damage: Once an attacker controls your mail, recovering accounts becomes much harder.

How USPS Address Changes Work (and Where Abuse Happens)

USPS allows changes online and in person. Legitimate requests generate validation mailers, but attackers rely on victims missing or dismissing those notices. Knowing the process helps you spot red flags fast.

• Online COA: Requires name, old and new addresses, move date, email, and a small identity “verification” via a $1.10 credit/debit card charge. If a criminal has your basic details and a prepaid card, they may attempt this.
• In-person COA: Submitted on PS Form 3575 at a Post Office. A Move Validation Letter is mailed to the old address.
• Validation letters: USPS mails a Move Validation Letter to the old address and a Customer Notification Letter or Welcome Kit to the new address. These are your early warning system.

Immediate Steps to Lock Down Your USPS Online Account

Start with your USPS.com account, then secure the email and phone numbers attached to it. Small improvements here block most opportunistic attempts.

1. Create or claim your USPS.com account
   • If you do not have an account, create one using your primary email and a secure password. If an account already exists in your name and you didn’t make it, recover it immediately and reset credentials.
2. Use a strong, unique password
   • Create a password of at least 14–20 characters with a mix of words and symbols. Don’t reuse passwords from other sites. A password manager makes this easy.
3. Enable two-step verification (2SV)
   • Turn on two-step verification in your USPS profile. Prefer app-based TOTP codes (from an authenticator app) over SMS whenever offered. If SMS is the only option, keep your phone number secured with your carrier (see SIM protections below).
4. Verify and lock recovery channels
   • Confirm the email and phone listed on your USPS account are current and privately controlled. Remove old numbers or secondary emails you no longer use.
   • Secure your email account with strong 2FA since it receives USPS security alerts and password resets.
5. Upgrade identity verification where available
   • USPS sometimes offers enhanced verification via an in‑person ID check at a Post Office or through a vetted identity provider. Completing this step can reduce friction for you and raise friction for fraudsters.
6. Review active services tied to your USPS account
   • Check for Informed Delivery enrollment, active package intercepts, change‑of‑address history, or unexpected preferences you didn’t set. Remove anything unfamiliar.

Harden Informed Delivery Against Takeover

Informed Delivery is convenient but can be abused. Lock it down if you use it, and consider defensive enrollment if you don’t—claiming your address prevents someone else from doing it in your name.

• Defensive enrollment: Even if you don’t plan to use Informed Delivery, consider enrolling. It prevents a bad actor from claiming your address and seeing scanned mail images.
• 2FA required: Make sure two-step verification is enabled for your USPS login that controls Informed Delivery.
• Check the household roster: See which emails and devices are receiving daily digests. Remove any you don’t recognize.
• Alert sensitivity: Opt into notifications for any profile or address changes so you get early warning.

Add Non‑USPS Layers That Block Mail‑Based Fraud

Securing USPS is necessary but not sufficient. Strengthen adjacent accounts and physical controls so a COA alone can’t compromise you.

• Carrier and phone security: Add a carrier account PIN/port‑out lock to your mobile number. Many COA attacks pair with SIM‑swaps to intercept SMS codes.
• Bank and credit alerts: Turn on transaction and profile‑change alerts for financial institutions. Add a verbal password and high‑risk activity notifications.
• Freeze your credit: Place free security freezes at Equifax, Experian, and TransUnion. This stops new-credit openings if your mail is diverted.
• Mailbox security: Use a locking mailbox or P.O. Box if possible. Retrieve mail daily. Pause mail with USPS Hold Mail when traveling, and verify the request yourself in person or online with your secured account.
• Address privacy: When allowed, use a P.O. Box or CMRA (Commercial Mail Receiving Agency) as a public mailing address to reduce exposure of your residence.

Early Warning Signs of a Fraudulent Change‑of‑Address

Spotting the signs early can limit damage. Treat these as “act now” signals:

• A USPS Move Validation Letter arrives and you did not request a move.
• Mail volume suddenly drops or expected statements don’t arrive.
• “Welcome to your new address” letters appear from banks, insurers, or utilities.
• Informed Delivery shows mail you never receive, or you stop receiving the daily digest.
• USPS emails or texts note changes to your profile you didn’t make.

What To Do If Someone Filed a Change‑of‑Address in Your Name

Move quickly and keep records of each step. Aim to both reverse the address change and contain any downstream identity exposure.

1. Contact USPS immediately
   • Call or visit your local Post Office with government ID. Bring the Move Validation Letter if you have it. Ask to cancel the unauthorized COA and restore delivery to your correct address.
   • Request the COA details (date submitted, method, forwarding address) if available and ask for a written confirmation of cancellation.
2. Secure your USPS.com account
   • Change your password and enable two-step verification. Review and correct all profile details and delivery services.
3. Notify impacted institutions
   • Contact your banks, card issuers, and important accounts. Add notes that mail tampering occurred, confirm your correct address, and enable high‑sensitivity alerts.
4. Place credit protections
   • Freeze credit at all three bureaus. Add fraud alerts if recommended in your situation.
5. Report the incident
   • File a report with the U.S. Postal Inspection Service if mail theft or fraud is suspected.
   • Consider filing at IdentityTheft.gov to generate a recovery plan and documentation.
6. Watch for follow‑on fraud
   • Monitor your credit and financial accounts for new inquiries, new accounts, and address changes for several months.

Step‑by‑Step: Routine Security Check for Your USPS Account

Use this quick checklist every 3–6 months, or after any suspicious event:

1. Sign in to USPS.com and confirm your name, address, phone, and email are correct.
2. Confirm two-step verification is enabled and working on your primary devices.
3. Review recent account activity and address change history for anything unfamiliar.
4. Check Informed Delivery enrollment, recipients, and notification settings.
5. Remove saved payment methods you no longer use and verify the billing address.
6. Verify your mailing address with your banks, credit cards, and insurers matches your actual residence or chosen mailing address.
7. Shred old documents with personal information and retrieve mail daily.

Reduce Your Exposure: Limit What Mail Can Be Used Against You

Even with a secure USPS account, less sensitive data in your mailbox reduces risk.

• Go paperless for banks, brokerages, utilities, and insurance. Enable email and app alerts to replace paper statements.
• Turn off pre‑approved credit offers at OptOutPrescreen. Fewer offers mean fewer “easy wins” for thieves if mail is diverted.
• Consolidate mail to a single secure address you control (e.g., a P.O. Box), and update all important accounts to send there.
• Use aliases carefully when allowed by vendors to track data leaks, but keep billing addresses consistent with your card issuer.

Common Myths About USPS Account and COA Security

• Myth: The $1.10 card charge guarantees identity verification. Reality: It confirms access to a card, not true identity. Prepaid or stolen card details can be abused.
• Myth: If I didn’t enroll in Informed Delivery, I’m safer. Reality: Not enrolling can leave the door open for someone else to enroll and view your mail images.
• Myth: A hold mail request is harmless. Reality: Fraudsters can use hold mail to stockpile sensitive letters for pickup. Treat unexpected holds as suspicious.

Ongoing Monitoring for Identity and Credit Changes

Mail diversion is often one part of a broader identity‑theft attempt. Combine USPS security with ongoing monitoring so you’re alerted quickly if criminals try to open accounts or change your profile data elsewhere.

• Keep your credit frozen and thaw only when needed.
• Enable alerts for new credit inquiries, new accounts, and address changes.
• Review bank and card transactions daily or weekly.
• Maintain strong, unique passwords and two‑factor authentication across your email and financial accounts.

For a single place to watch for credit pulls, new accounts, and identity‑related changes, consider adding a monitoring tool to your routine. If you want an option that combines privacy, credit monitoring, and identity‑protection features, see our overview of SmartCredit for privacy, credit monitoring, and identity protection.

Frequently Asked Questions

Can I block all change‑of‑address requests on my profile?

USPS does not offer a permanent “no‑change” lock you can place on an address. Your best defense is securing your USPS account, enabling strong 2FA, monitoring for validation letters, and acting immediately on any unexpected notices.

What if I share a mailbox or live in a multi‑unit building?

Use a locking mailbox or ensure mailroom access is controlled. Enroll in Informed Delivery to know what should arrive. Ask your property manager about procedures for COA validation letters and unclaimed mail.

Is a P.O. Box better for privacy?

Often, yes. A P.O. Box keeps your residence off many mailers and can centralize sensitive correspondence in a locked USPS facility. Still secure your USPS account and keep credit frozen.

I received a Welcome Kit at a new address I don’t recognize. What now?

Visit or call USPS immediately to cancel the forwarding. Then secure your USPS account, notify banks and insurers, and place or confirm your credit freeze. Continue monitoring for follow‑on fraud.

Conclusion

Preventing unauthorized change‑of‑address is about speed and layers: lock down your USPS online account with strong credentials and two‑step verification, enroll (or defensively enroll) in Informed Delivery, secure your phone and email, and add financial guardrails like credit freezes and alerts. Treat any USPS validation letter or unexpected drop in mail as an immediate action item. With a few permanent settings and a simple monthly check, you can make mail‑based identity fraud far less likely—and far less damaging if it’s ever attempted.