Royal Mail's redirection service sends mail from your old address to your new home when you move. It costs just under £40 for 12 months, and is supposed to reduce the risk of identity theft. But what if it's not you that's redirecting your post?
By early August 2009, BBC sports presenter John Inverdale hadn't had any post for nearly a month. There'd been strikes locally so he put it down to that. But when he bumped into his postman on his street, he found out his name was on the redirection list. The problem was this was the first he'd heard of it. He simply hadn't signed up.
While the police investigated, John headed to Berlin to cover the athletics World Championships. He hoped the police would be able to find out where his mail was and who had re-directed it.
Applying for credit
The police soon discovered that - somehow - online fraudsters had redirected John's mail across town to a North London address. Someone John knew nothing about had been getting his letters, bills and salary details. On police advice, John put a block on all his credit and debit cards. This meant that while John was away from home he was unable to get hold of his own money.
Stopping John's cards also meant the scamsters couldn't get their hands on the money in his bank account. But they'd found other things they could do with his details. When John got back from Berlin, he found that three credit cards had been opened in his name.
John was angry but relieved it wasn't worse. "I still don't know what they did with those cards. But at least none of my money was stolen."
Opening bank accounts
Julie Ham wasn't so lucky. Just like John, she noticed she wasn't receiving any mail. Just to be sure - she did her own test.
"Every day of that week I sent myself a letter to see if I was getting post...I sent them from my work, I got my work to send me post, I got my partner to send me post just to see if anything came through. Nothing came at all."
Julie then got a letter from Royal Mail confirming that she had redirected her mail. Like John, she hadn't. She immediately asked Royal Mail to stop the redirection but it was too late; the fraudsters had already opened bank accounts in her name.
"It just made me so angry because I had all these banks, nine different banks contact me saying I'd applied for things which I hadn't done".
This time, the fraudsters had managed to take money direct from Julie's bank account.
"It was between about £150-£300 in total that they took from my bank. And obviously there could still be fake accounts out there I don't know about".
Julie's bank did gave her the money back but Royal Mail still can't tell either of them exactly how their identities were stolen. So what could be wrong with their redirection scheme that lets this sort of thing happen?
Counterfeit phone bills
Tom Ilube, an internet security expert from Garlik illustrated how simple it can be.
"Really the fraudsters today are very focussed on money. So if they're getting hold of your mail, they want to see what your bank details are. They want new credit cards that you've applied for coming to them instead of you. Or they're applying for new things like bank credit cards, like store cards and having them directed to them rather than directed to you.
"It's pretty straight-forward. A while ago, a few years ago, it used to be a technical challenge. Now with the sort of computing power, the sort of equipment people have got, it's just easier and easier. So if you can basically use a computer, you can use the internet, you can use a computer and a scanner, you can take over someone's identity."
In just a few minutes, Tom demonstrated how he can become John by rustling up a counterfeit phone bill.
We don't know exactly how the fraudsters hijack the Royal Mail's redirection scheme. To set up a redirection online, you need a credit card registered to either the old or new address. No problem for a well connected scamster. But you can also do it in person at the post office. You need two forms of IDbut one can be a utility billlike the one Tom showed can just be whipped up.
Ruined credit ratings
For some people, the long term implications can be devastating. Sharon and Kevin Hamer are building their dream home in Merthyr Tydfil in South Wales. Last April fraudsters re-directed their mail to an address in Nottingham and started applying for credit cards in their name.
"Whoever did this took £5,874.74..It's not the money they've taken out, it's the credit rating that they've ruined for us".
In a branch hundreds of miles from Merthyr Tydfil fraudsters filled in a form pretending to be the Hamers.
"The sheer number of credit applications that have been processed against both our names has resulted in our credit rating being taken away from us".
Although the bank gave back the money spent on the credit card, no-one will lend the Hamers enough money to finish the house.
"Unfortunately this is the reason we're having to put it on the market as well... I'm struggling".
The Royal Mail is so proud of its redirection service that they've handed out a leaflet to their workforce pointing out that the scheme is a 'great money-earner' for Royal Mail bringing in a staggering £49m a year.
However, the second paragraph of the internal leaflet refers to the fact they've had to hand back £332,000 in compensation to customers. The question is how much of that was paid to people who had their mail and money redirected straight into the hands of crooks?
Royal Mail said:
"Redirection of mail provides a hugely valuable service for a great many people and having an accessible redirection service is, in itself, recognised by the Home Office and law enforcement agencies as an important safeguard against fraud because without it, significant amounts of mail would be at risk of being delivered to addresses from which the addressee had moved.
"The security of our customers' mail is of the utmost importance to Royal Mail and we deploy a range of security checks for our Redirection service - so sending a confirmation letter to the address from where mail is to be redirected is just one of the steps we take to protect our customers and their personal data. We constantly review security arrangements and we work closely with the police and other agencies to ensure we take all reasonable steps to guard against any criminal attack on the service."
Royal Mail strike
"We are still maintaining and delivering our Special Delivery service and would recommend its use for customers when sending valuable items or items that require a guaranteed next day delivery.
"Customers are directed to our website at www.royalmail.com/serviceupdates (or call Customer Services on 08457 740 7400) where the latest information about strike dates and areas affected can be found. In those areas where there is strike action, customers should be aware that this will cause delay to mail."
Has your post gone missing?
By early August 2009, BBC sports presenter John Inverdale hadn't had any post for nearly a month. There'd been strikes locally so he put it down to that. But when he bumped into his postman on his street, he found out his name was on the redirection list. The problem was this was the first he'd heard of it. He simply hadn't signed up.
While the police investigated, John headed to Berlin to cover the athletics World Championships. He hoped the police would be able to find out where his mail was and who had re-directed it.
Applying for credit
The police soon discovered that - somehow - online fraudsters had redirected John's mail across town to a North London address. Someone John knew nothing about had been getting his letters, bills and salary details. On police advice, John put a block on all his credit and debit cards. This meant that while John was away from home he was unable to get hold of his own money.
Stopping John's cards also meant the scamsters couldn't get their hands on the money in his bank account. But they'd found other things they could do with his details. When John got back from Berlin, he found that three credit cards had been opened in his name.
John was angry but relieved it wasn't worse. "I still don't know what they did with those cards. But at least none of my money was stolen."
Opening bank accounts
Julie Ham wasn't so lucky. Just like John, she noticed she wasn't receiving any mail. Just to be sure - she did her own test.
"Every day of that week I sent myself a letter to see if I was getting post...I sent them from my work, I got my work to send me post, I got my partner to send me post just to see if anything came through. Nothing came at all."
Julie then got a letter from Royal Mail confirming that she had redirected her mail. Like John, she hadn't. She immediately asked Royal Mail to stop the redirection but it was too late; the fraudsters had already opened bank accounts in her name.
"It just made me so angry because I had all these banks, nine different banks contact me saying I'd applied for things which I hadn't done".
This time, the fraudsters had managed to take money direct from Julie's bank account.
"It was between about £150-£300 in total that they took from my bank. And obviously there could still be fake accounts out there I don't know about".
Julie's bank did gave her the money back but Royal Mail still can't tell either of them exactly how their identities were stolen. So what could be wrong with their redirection scheme that lets this sort of thing happen?
Counterfeit phone bills
Tom Ilube, an internet security expert from Garlik illustrated how simple it can be.
"Really the fraudsters today are very focussed on money. So if they're getting hold of your mail, they want to see what your bank details are. They want new credit cards that you've applied for coming to them instead of you. Or they're applying for new things like bank credit cards, like store cards and having them directed to them rather than directed to you.
"It's pretty straight-forward. A while ago, a few years ago, it used to be a technical challenge. Now with the sort of computing power, the sort of equipment people have got, it's just easier and easier. So if you can basically use a computer, you can use the internet, you can use a computer and a scanner, you can take over someone's identity."
In just a few minutes, Tom demonstrated how he can become John by rustling up a counterfeit phone bill.
We don't know exactly how the fraudsters hijack the Royal Mail's redirection scheme. To set up a redirection online, you need a credit card registered to either the old or new address. No problem for a well connected scamster. But you can also do it in person at the post office. You need two forms of IDbut one can be a utility billlike the one Tom showed can just be whipped up.
Ruined credit ratings
For some people, the long term implications can be devastating. Sharon and Kevin Hamer are building their dream home in Merthyr Tydfil in South Wales. Last April fraudsters re-directed their mail to an address in Nottingham and started applying for credit cards in their name.
"Whoever did this took £5,874.74..It's not the money they've taken out, it's the credit rating that they've ruined for us".
In a branch hundreds of miles from Merthyr Tydfil fraudsters filled in a form pretending to be the Hamers.
"The sheer number of credit applications that have been processed against both our names has resulted in our credit rating being taken away from us".
Although the bank gave back the money spent on the credit card, no-one will lend the Hamers enough money to finish the house.
"Unfortunately this is the reason we're having to put it on the market as well... I'm struggling".
The Royal Mail is so proud of its redirection service that they've handed out a leaflet to their workforce pointing out that the scheme is a 'great money-earner' for Royal Mail bringing in a staggering £49m a year.
However, the second paragraph of the internal leaflet refers to the fact they've had to hand back £332,000 in compensation to customers. The question is how much of that was paid to people who had their mail and money redirected straight into the hands of crooks?
Royal Mail said:
"Redirection of mail provides a hugely valuable service for a great many people and having an accessible redirection service is, in itself, recognised by the Home Office and law enforcement agencies as an important safeguard against fraud because without it, significant amounts of mail would be at risk of being delivered to addresses from which the addressee had moved.
"The security of our customers' mail is of the utmost importance to Royal Mail and we deploy a range of security checks for our Redirection service - so sending a confirmation letter to the address from where mail is to be redirected is just one of the steps we take to protect our customers and their personal data. We constantly review security arrangements and we work closely with the police and other agencies to ensure we take all reasonable steps to guard against any criminal attack on the service."
Royal Mail strike
"We are still maintaining and delivering our Special Delivery service and would recommend its use for customers when sending valuable items or items that require a guaranteed next day delivery.
"Customers are directed to our website at www.royalmail.com/serviceupdates (or call Customer Services on 08457 740 7400) where the latest information about strike dates and areas affected can be found. In those areas where there is strike action, customers should be aware that this will cause delay to mail."
Has your post gone missing?