US Postal Service site lets anyone hold your mail

Wednesday night on Off The Hook, a radio show on WBAI in New York, Emmanuel Goldstein and the guys from 2600 discussed a feature on the Web site of the U.S. Postal Service that can only be described as ill-conceived.

If you’re going to be away from home for a while, the your local post office can hold your mail to avoid an overflowing mailbox. Fine.

In the old days (and you can still do this), you went to the office and filled out a form (PDF). Someone on the show who has done this said the Postal Service doesn’t validate the identity of the person who requests mail to be held. It validates only the identity of the person who comes to pick up the mail.

Government techies copied this manual system to the Internet.

You can go to https://holdmail.usps.com (or click on Hold Mail at the Postal Service home page, as shown below) and put a hold on mail delivery. Notice that I didn’t say put a hold on your mail delivery. You can put a hold on mail delivered to anyone. This is true with the traditional system, too, but the Internet makes it worse, adding more anonymity and making the process easier. Too easy.

The agency site claims that it needs a name, address, and phone number to stop mail delivery. When tested, however, this turns out not to be the case. Requests with wrong names and wrong phone numbers were accepted, according to a listener who wrote in to the show. All you really need to know is an address.

And with the address, you can stop all mail delivery, not just mail to one person. Quoting from the Frequently Asked Questions: “All mail, regardless of name, will be held for the address entered. Submitting an online Hold Mail request once is all that is required to hold mail delivery for everyone at the address.”