Introduction
This management alert presents issues identified during our Review of National Change of Address and Moversguide Applications audit (Project Number: 21‑146). Our objective is to notify U.S. Postal Service management of risks associated with ineffective identify verification controls on the Moversguide application. See Appendix A for additional information about this alert.
Background
A change of address (COA) request informs the Postal Service to reroute mail including letters, packages, and flats for all or selected individuals at a specified address. Customers can submit COA requests online, in person, or by mail. For each COA submitted, the Postal Service sends a change of address validation letter to the customer’s old address to notify them that a request was received and provides instructions on reporting inaccurate or fraudulent requests. They also send a customer notification letter/welcome kit to the new address. The Postal Service’s Moversguide application (Moversguide) allows customers to submit a COA request online. If customers choose this option, they must pay $1.10 using a debit or credit card to validate their identity.
In 2021, the Postal Service processed nearly 36 million COA requests, completing approximately 20 million (56 percent) online. Additionally, third-party sites completed over one million online requests on behalf of Postal Service customers. These websites charge $20 to $89.95 for the service.
Identity verification is an important security measure to combat fraud because it ensures that a person is who they claim to be when performing online transactions. With data breaches and identity theft on the rise, it is important that businesses ensure that they protect customer information from identity fraud.