Warning to anyone who buys postage stamps at USPS vending machines: look carefully before you swipe your credit or debit card for payment, because identity thieves might have installed a skimmer that records your account number, password and other data necessary for a thief to enjoy a fraudulent shopping spree in your name. And an additional warning: if you've already made such a swiped purchase, check the recent history on your card to see if there's any suspicious activity.
Actually, “always look for skimmers” is good advice for any credit- or debit-card swipers, not just postal customers, but the USPS deserves specific mention today since the US Postal Inspection Service is investigating reports of skimmer fraud from stamp vending machines across the United States.
Security blogger Brian Krebs reported on May 13 that his sources in the banking industry noted a disturbing recent trend: fraudulent debit card activity on a variety of accounts with one purchase in common: official USPS self-serve stamp machines in certain areas.
When Krebs emailed the USPIS for comment, he received an email of valid (though generic) advice:
“USPIS recommends customers who use the APC [Automated Postal Center] machine should personally visually inspect the machine prior to use … Look for any type of plastic piece that looks like it has been slid over the actual credit card reader. Look for any other type of marking on the machine that looks as though it has been applied by a third-party.”
And if you see any of these things, avoid using the vending machine, but do let your local postal authorities know about it.
Though the USPIS declined to give specifics, Krebs' sources said the problem apparently dates back to last November, and affected machines were in Arizona, California, Colorado, Florida, Georgia, Kentucky, Massachusetts, Nebraska, New York, Oregon, Pennsylvania, Utah, Virginia, and Washington, D.C.
If you've bought stamps at a self-serve kiosk in any of those states these past six months, give extra scrutiny to your accounts, and if you detect fraudulent activity, contact your bank or card isuer immediately.