Hacker News Reader

Comment by djur | Hacker News Reader

Important mail also clearly says who it's from. Any time I see mail that's supposed to mimic the appearance of US government forms (a common example being having the current year in a large font with the "20" and "19" visually distinguished in some way, like on a 1040 form) but a vague "Benefits Office" type sender I know it's junk.

View on HN

On the other hand, when I receive a valid credit/debit card, it's a plain envelope and the sender name is not there. There is a return address, but no name. But when I receive a pre-selected offer to apply offer with a fake card, always a name.

I’ve wondered how effective this is in securing post of credit cards. I assume over time thieves simply remember the return addresses used. Over the years my banks haven’t changed their return address, so always easy for me to spot the new card letter.

> I’ve wondered how effective this is in securing post of credit cards. I assume over time thieves simply remember the return addresses used.

It shouldn't matter. Last 10 years or so, my cards had to be activated online first, before becoming useful.

The concern I have is someone will intercept the card, grab its details, and then repost it to me. They just have to wait a couple days/weeks and I’ll have activated the card by then. They will then have my name, address, card number and ccv values— often enough for online purchases. Some of my cards ask for a secondary password but not all my cards and not all the time.

Requires someone able to intercept the post (eg corrupt postal employee or subcontractor), and the ability to create a convincing replacement envelope/letter, but it is all achievable, and I expect not everyone will properly scrutinise the envelope/letter/card for signs of tampering. Even for me, with a new card only once every 3 years or so, how can I tell the difference between their letter being tampered with and them just using a new/slightly different design?

Fair enough. That's probably a case where disputing charges and blocking a card is a solution.

It may also be possible to pick the card up at the bank (instead of post delivery). I did that once before, too.

Reply on news.ycombinator.com