April 14, 2026
By Genady Vishnevetsky
You list a property, and it sits vacant for a few weeks between tenants. The lawn gets mowed, the lights stay off, and nobody thinks twice. But someone else might be paying close attention to that empty house—not to buy it, but to steal from it.
Security researchers recently uncovered fraud tutorials on Telegram that teach criminals how to exploit vacant homes as “drop addresses” for intercepting mail. The playbook is simple. Criminals browse platforms like Zillow, filtering for recently listed rentals or homes sitting on the market. They’re not shopping for a home—they’re looking for an empty mailbox.
Once they find a vacant property, they sign up for USPS Informed Delivery at that address. This free postal service sends digital previews of incoming mail—letting criminals see financial statements, credit card offers, and tax documents on a phone screen. From there, they file a change-of-address request to reroute the homeowner’s mail to a location they control. The postal service has verification safeguards, but the tutorials suggest criminals view those controls as easy to work around.
What makes this especially relevant for the real estate industry is that criminals are using our tools against us. Listing platforms designed to connect buyers and sellers are being weaponized to find targets. A property between closings, a rental waiting for a new tenant, a home in probate—any vacant property with an active mailbox becomes a fraud staging ground. Intercepted mail fuels identity theft, unauthorized credit applications, and account takeovers.
This isn’t a high-tech hack. There’s no malware, no phishing email, no software exploit. It’s a criminal walking up to a mailbox at an empty house and helping themselves to someone’s financial life. And because every step abuses legitimate services—real estate platforms, postal forwarding, public listings—it’s hard to detect.
Takeaways
Secure the mailbox on vacant properties you manage. If you oversee listings or properties between transactions, consider locking the mailbox and placing a temporary hold on USPS mail delivery. An open mailbox at an empty house is an invitation.
Sign up for USPS Informed Delivery on your own address before someone else does. Only one account can register per address. If you register first, a criminal can’t. This is one of the easiest steps you can take to protect yourself.
Watch for unexpected USPS change-of-address confirmation letters. The postal service sends a validation notice whenever a forwarding request is filed. If you receive one you didn’t initiate, contact USPS and report it immediately.
Alert property owners about mail security during vacancies. If you work with sellers, landlords or estate representatives, remind them that a vacant property’s mailbox is a vulnerability. A simple heads-up could prevent a much bigger problem.
Freeze your credit if you haven’t already. Stolen mail is often used to open fraudulent accounts. A credit freeze with all three bureaus stops that path cold, and it’s free to set up and lift.
We spend a lot of time protecting ourselves from digital threats—phishing emails, fake websites and malware—but sometimes the most effective attack is the simplest one: a criminal, an empty house and an unlocked mailbox. In our industry, where properties regularly sit vacant, that’s a risk worth taking seriously.