Change-of-address fraud is the deliberate diversion of someone’s mail by submitting a false address change to a postal or account records system. It is commonly used to intercept account statements, replacement cards, reset codes, or other recovery mail that supports identity takeover and account fraud.
What Change-Of-Address Fraud Is
Change-of-address fraud is a records abuse pattern, not just a mail nuisance. The attacker submits a false forwarding request so that postal items, account statements, replacement cards, reset codes, and other recovery mail are diverted away from the real recipient and into a channel the attacker can monitor or collect.
This matters because the mailbox is often a trusted recovery path. If an organisation treats postal delivery as a low-risk identity channel, an attacker can use it to intercept signals that confirm account ownership, delay detection, or complete a takeover after an initial compromise elsewhere.
How It Supports Account Takeover
Change-of-address fraud is effective because it converts ordinary correspondence into an interception point. Recovery mail can contain one-time codes, password reset instructions, activation notices, or replacement payment cards, all of which can help an attacker move from external access to direct account control.
The fraud is especially damaging when a business relies on mailed notices as a fallback verification step. If a victim no longer receives statements or alerts, the attacker may gain time to change login details, reset credentials, or redirect subsequent recovery flows before the account owner notices.
Where Organisations Are Exposed
Exposure usually sits at the boundary between postal processes, customer records, and account recovery workflows. Weak change verification, over-trusted address updates, and inconsistent identity checks between service desks, postal systems, and customer support channels all increase the chance that a fraudulent request is accepted.
Organisations also face a visibility problem: the abuse may look like an ordinary address update until downstream events, such as missed statements or failed card delivery, reveal the diversion. That makes inventory of recovery channels and review of address-change controls as important as monitoring the account itself.
Detection and Response After Suspected Diversion
When mail diversion is suspected, the priority is to determine whether the address change is real, authorised, and still active across every system that relies on the same customer record. Teams should compare postal change logs, account profile history, and recent recovery activity for signs that an attacker is using the mailbox as a foothold.
Post-incident review should extend beyond the address record itself. Any statements, replacement cards, recovery codes, mailed notices, or other identity-relevant items sent during the diversion window may need to be treated as exposed and followed by additional account review.
Risk and Threat Considerations
Change-of-address fraud creates a direct identity-theft path because it attacks a trusted recovery and notification channel rather than the password or device alone. The main risk is silent interception: the victim may continue using an account while the attacker collects the material needed to reset access or authorise fraud.
Failure mechanism: A false forwarding request or redirected records entry causes recovery mail, replacement cards, and account notices to route to the attacker, who can then use those items to complete takeover or sustain fraud.
Impact: The result can include account compromise, delayed detection, unauthorised transactions, and wider identity fraud if the diverted mail is used to pivot into additional services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Address changes affect account records and recovery paths tied to managed accounts. |
| IA-5 — Authenticator Management | Mail diversion can expose reset codes and recovery material used to regain access. | |
| AU-6 — Audit Review, Analysis, and Reporting | Fraudulent address changes are detectable through log review and anomaly analysis. | |
| Recommendation — Review and validate address-change workflows as part of account lifecycle governance. Protect, rotate, and tightly govern recovery material that can re-establish account access. Correlate address updates, recovery events, and delivery exceptions to spot abuse. | ||
| CIS Controls v8 | CIS-5 — Account Management | Fraudulent address changes exploit weak identity and account lifecycle controls. |
| Recommendation — Harden account-change approvals and monitor high-risk profile edits. | ||
| MITRE ATT&CK | T1098 — Account Manipulation | The attack manipulates account records to redirect mail and sustain fraud. |
| Recommendation — Hunt for unauthorized profile and account-record changes that alter delivery or recovery paths. | ||
Practitioner Guidance
What to watch for: Treat address changes as a security-sensitive event when they affect billing, recovery, or card delivery. A strong control point is to require additional verification before any change that could redirect recovery mail or financial correspondence.
Governance implication: Ownership should sit across fraud, customer operations, and security, because the abuse path crosses all three. If the address record feeds account recovery, that process should be governed with the same care as other authentication-adjacent controls.
Practitioner takeaway: The safest posture is to assume that a postal address can become an identity-control dependency, and to design review, alerting, and re-verification accordingly.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org