Postcode loophole enables fraudsters to hijack eBay parcels | Hacker News Reader

Postcode loophole enables fraudsters to hijack eBay parcels

theguardian.com

83 pointsjimnotgym91 comments

There does seem to be a spate of something... articles in which the solution is "A British startup, what3words".

They must be spending a steady amount on PR. The news seems perfectly constructed for the obligatory quote from their founder when in this case the answer isn't their system, but just that Royal Mail use the correct identifier: the post-code and the identifying information for the property (building name and/or building number as well as company name if applicable).

I've also seen a bunch of articles about what3words.

I've not seen any articles discussing how awful they are -- The idea of copyrighting and privatising the concept of "position" should be rejected at every opportunity.

https://shkspr.mobi/blog/2019/03/why-bother-with-what-three-...

Their PR really is amazing. They replied to a tweet of mine criticising them within 10 minutes. They of course didn't actually respond to my criticism.

What is amazing about a timely reply that doesn’t actually address your concern? The timing could be chance, therefore, replying without answering your issue seems not amazing.

He said the PR is amazing, that is completely separate to actually responding to criticism.

Now if he said that the customer service was amazing, it would be legitimate to expect some level of criticism response.

Their legal team is vicious about taking down any open-source implementation of the W3W encoding algorithm. This is sad because it could be legitimately useful in a small handful of circumstances, but only if it were free and open to all.

We released WhatFreeWords last week and it was taken down after 4 days.

It is back up now at https://whatfreewords.org/ but who knows for how long.

You can read their DMCA notice to our previous hosting at https://whatfreewords.org/download/dmca-20190917.pdf

I'm not a lawyer, but I don't think US copyright covers functionality (that is what patents are for) if you haven't copied any code or creative output, and thus the DMCA wouldn't apply, so that wouldn't be a valid use of a DMCA takedown.

Unfortunately that's not how the DMCA works.

Once they've submitted a DMCA notice, the hosting company has to take it down within 2 days unless you file a counter-notice, which has to personally identify you and be signed "on penalty of perjury".

None of the DMCA process has anything to do with whether the claimant has a legitimate copyright claim over the work.

Adding onto what nitrogen said (and I also am not a lawyer) but interoperability is a listed exemption to DMCA. It might be costly to fight but I really don't think they have a leg to stand on to claim copyright.

They claim that what3words is the answer to this problem, except they themselves admit (on their website) it is no substitute for addresses since many people live in multiple occupancy buildings, and their system is only for use at ground level. You still need to know the address at the end of the day.

(googler, opinions are my own)

As a reminder, there is a similar free solution that tries to solve the same problem as what3words from a different angle:

https://plus.codes/

Google Maps shows these today. And you can search Google or Maps for plusCodes.

From the article:

> The 11-digit codes [...] are hard to memorise and a single mistyped digit would send a courier to the wrong address.

The plus codes FAQ [1] mentions that they thought checksums weren't important for a couple of reasons:

* Not needed for codes that are copy pasted rather than typed or written

* Mistyped codes will be "obviously wrong" due to referring to an unrelated area

I'm not too convinced by the rationale, as playing around on Google Maps shows a typo of one digit can at least sometimes produce another valid code not too far away. And even if typoed codes were always obviously wrong, it's not clear that a computer would recognize incorrect but valid codes as well as a human.

[1] https://github.com/google/open-location-code/blob/master/FAQ...

I thought this too, it felt more and more inevitable the nearer I got to the end of the article.

what3words is so problematic and really isn't the solution to this problem.

Came to say the exact same thing. This is the second article in a major news publication I've seen this weekend touting what3words.

What3words has amazing technology, for getting media attention

Here is their technology in full:

Google “PR agency London”. Email the top five asking for a price-per-mention, and get offers back in the region of £500 a pop. Sign a contract. Talk about how you were featured on the BBC.

Any startup company with enough money for PR can get mentions in casually related articles written in just about any publication--even The Economist.

It says nothing about product, traction or anything else. It only proves journalists and editors can be or already have been bought.

That's what the company name really means. What 3 words will get people's attention?

> They must be spending a steady amount on PR. The news seems perfectly constructed for the obligatory quote from their founder when in this case the answer isn't their system

It might also just be familiarity from the writer, i.e. journalist writing article about inexact nature of post codes -> remembers the article he/she wrote or read about what3words -> figures that's a good alternative so contacts the company for comment.

my sweet summer child

Relevant: http://www.paulgraham.com/submarine.html

This article might be worth reading. http://paulgraham.com/submarine.html

The alleged issue highlighted in this piece of PR for a commercial company (shame on The Guardian for playing along) has nothing to do with postcodes. If there is an issue it is with the way Royal Mail handles tracked mail and proofs of postage.

UK postcodes are more precise that in any other country I'm familiar with and are a terrific system [1]: Postcodes are precise to about the street level vs. a whole town or district in most countries. This allows websites that need your address to work it out fully just by asking postcode and house number in most cases.

[1] https://en.wikipedia.org/wiki/Postcodes_in_the_United_Kingdo...

The Irish system,"eircode", is actually more exact. Much more exact. I live in a regular semi split into two flats, and upstairs have a different eircode to me. Because we both share the same front door, our letter-box is actually mapped to three eircodes - eg 1 (the address of the house before it was split), 1A & 1B (downstairs/upstairs, post-split). I also find it interesting that the three are non-sequential.

That's pretty cool. It's funny that Ireland has such an accurate system now, when it used to be used as the classic example of not assuming things about addresses because much of Ireland didn't have postcodes of any form.

I really like the idea of having a system that is that accurate. Although as someone else pointed out, in the UK your postcode and house number/name are almost always enough to uniquely identify your property.

postcodes aren't mailbox identifers and were never designed to be exact

they are a routing code for the postal service

the number and postcode uniquely identify a mailbox

Even more impressive is that Royal Mail have an even more accurate database than the postcodes people are used to. Every address in the UK has a Unique Property Reference Number, which as the name suggests uniquely identifies a single address.

UPRN's are allocated by local authorities; Royal Mail uses UDPRN's (unique delivery point reference numbers).

This is what USPS tried to solve with the ZIP+4 mechanism. ZIP codes, as is widely known, are almost always at least a semi-large grouping of streets (excluding custom-assigned ZIP codes for a building that gets a lot of mail and other non-standard codes).

Adding four digits on the end for a "standardized address" means that a specific block and, often, a subset of numbers on that block, can be identified. For example, ZIP code 90210 covers the bulk of Beverly Hills, California but 90210-5317 narrows it down to just the odd numbers of the 200 block of South Beverly Drive or, according to the USPS database, a maximum possibility of 23 delivery addresses (because not all of the numbers in that block block are assigned).

the most precise postcode is likely singapore where each building block has its own post-code. the worst is probably hongkong, which does not even have a postcode.

In the UK, most large buildings (with more than 25 units) have their own postcode too. Everywhere I've lived in London has its own postcode.

looks like it's the same as singapore then. i don't think singapore even has buildings with less than 25 units :-)

Sadly this is how most British rags are making money these days, with sponsored advertorials.

> “This issue highlights the fact postcodes are based on out-of-date technology”

Piss off, it shows that a postcode without a house identifier is a shitty way for Royal Mail to guarantee delivery is all.

More so as the onus and legal aspect (data protection) means that the receiver has no way of disputing this with Royal Mail, only the sender does. So if the sender pays for the basic service, this can happen, if they paid a little bit more for the tracking service, thats different.

Case is, you can send a letter - no way of tracking that, but if you send it recorded delivery, that's tracked.

So issue here is not the Royal Mail, more case of Ebay etc allowing people to send things using the cheapest untrackable way and allowing such abuse to transpire.

But then every system is abusable - you can send a recorded delivery item to a person, log into tracking and see a copy of that person's signature which you could then abuse in nefarious ways. But many systems open to such abuse. Send a cheque to somebody - they cash it. Then track via your bank and get the bank account details of the recipient. Heck send cheque via recorded delivery and and get the targets signature and bank account details, all legal like. Is that a fault in the systems and even if it is - how do you fix that!

Well, Ebay could insist that all postings are done recorded delivery - would solve this instance.

This article is quite confusing in the way it explains the fraud technique. Here's my understanding (using a made-up example):

In the UK, a full postcode e.g B40 4XJ (made up) can be shared by more one than home or building. So the homes numbered 1-20 Acacia Avenue all share the same full postcode: B40 4XJ

Janet lives at 7 Acacia Avenue. She sells her iPhone via eBay for £200 to Patrick living elsewhere. She posts a parcel containing the iPhone to Patrick.

Patrick, via eBay, contacts Janet and says the iPhone is faulty and wants a refund.

Through eBay, Patrick generates a return label (shipping label) which lists Janet's address: 7 Acacia Avenue, B40 4XJ. However, Patrick, alters the address on the label to state: 19 Acacia Avenue, B40 4XJ.

He can do this, of course, because the label is generated online, and using some graphics editing program, he can alter the label before he prints it.

Patrick posts an empty box to 19 Acacia Avenue and keeps the iPhone. Patrick now has the iPhone and a refund from eBay for the £200 he paid for the iPhone.

What of the empty parcel posted to 19 Acacia Avenue? Presumably, the parcel isn't signed for when it is delivered? Or is it? If the parcel requires a signature on delivery, surely the resident of 19 Acacia Avenue will immediately notice the parcel is addressed to someone else?

Please do correct the above if it's incorrect.

> In the UK, a full postcode e.g B40 4XJ (made up) can be shared by more one than home or building.

It's not that they 'can' be shared, like it's some sort of bug or corner case - they're designed to be shared. A full address is a house number or name plus the postcode.

My understanding is that the empty box is posted to a different addres, because eBay only issues a refund when they get the confirmation that the parcel was delivered.

I assume that the unsuspecting resident of 19 Acacia Avenue, B40 4XJ will sing off receipt for the parcel, then open it and find the box empty, but since they weren't expecting any delivery at all they will do nothing about it, maybe just tell the story as an anecdote next time they go to drinks with friends.

Another thing that enables the fraud is that eBay only compares postal codes, so the delivery to 7 Acacia Avenue and 19 Acacia Avenue is all the same for them.

Ebay checks the house number as well. The problem is the package is routed to the local post office using the machine readable barcode which contains the postcode, then somebody reads the house number when they deliver the package. By photoshopping the printed address, the parcel can be deliberately misrouted.

That said, Royal Mail say anything over £100 should be Signed For so why did eBay let somebody return an iPhone without using Signed For?

I've seen stories about similar happenings in the US, and I'm not sure a return box is even a factor - even a letter/empty envelope with delivery confirmation may be adequate.

> What of the empty parcel posted to 19 Acacia Avenue? Presumably, the parcel isn't signed for when it is delivered? Or is it? If the parcel requires a signature on delivery, surely the resident of 19 Acacia Avenue will immediately notice the parcel is addressed to someone else?

This is addressed in the article. They sign for it, see it’s empty, assume error on someone’s part, and dispose of it.

"Acacia Avenue"

Where does Banana Man fit into all this???

https://en.m.wikipedia.org/wiki/Bananaman

This has almost nothing to do with a "postcode loophole" and almost everything to do with the two following facts:

- eBay are supremely uninterested in being an unbiased arbiter of disputes.

This goes back as far as I can remember and likely to the dawn of eBay. People have been scamming each other on there for 15 years at a minimum.

- Royal Mail do not provide proof of postage at a granular level.

Combine that with the above where eBay will probably take a piece of tissue paper as proof of postage and there you are.

>- eBay are supremely uninterested in being an unbiased arbiter of disputes.

It's not just eBay though, it's also the credit card companies. You can't escape this by switching platforms.

So how does this enable the fraud? Why would this not work with an empty return package?

E: I guess this is just one of many possible ways to force a carrier to "lose" a parcel, enabling the fraudster to use the same ebay account more times without attracting complaints from sellers.

it does work with an empty package but it just goes to another address. So the seller doesn't get any package. If the seller were to get an empty package they would have some proof to show ebay and so the fraud would be harder to stop.

> If the seller were to get an empty package they would have some proof to show ebay and so the fraud would be harder to stop.

What? Think about it for a second, what proof would they have?

They could have video surveillance of the package from delivery to being opened.

Why would they bother with the video surveillance? That's not going to help the seller win the dispute.

It still doesn't make any sense. What would be your proof in this case? A picture of an empty box? That's not a proof of anything really, or at least I'd hope it's not - if it is then scummy sellers would always say that you returned an empty package(picture of an empty box included).

There's no "postcode loophole", this is just a polished empty return scam.

The trick described in the article just improves upon it slightly by making the seller think that royal mail lost the package. There's no dependence on this trick though, the scam works 100% of the time even if the seller receives an empty box.

It does change slightly, ebay will consider a 'hey my box was empty' if it's coming from a buyer with a decent feedback. But since the royal mail says 'nope, was delivered' it never leaves the automated system that just assigns guilt to the buyer.

It is the seller receiving an empty box, not the buyer.

Ebay will always believe a "hey my box was empty", no matter your account history. They'll just ban your account at some point.

>they would have some proof to show ebay

At first glance the empty box seems pretty meaningless, it certainly won't win a dispute for the seller.

I guess you're right though, now the seller won't even realize that they're getting scammed and won't report the buyer account to ebay.

Ok, so if someone tries this scam on you, take a picture of an empty box and then you have won. Right?

No, you always lose if someone tries this scam on you. The only solution would be some kind of an insurance.

This is just a cost of doing business. Really sucks for amateur sellers though.

> The only solution would be some kind of an insurance.

If the scammer is in the UK, there's always small claims court. I'm not even from the UK, and I got a scamming seller from there to refund me by just threatening to make a claim.

It works because the royal mail system doesn't include the FULL postcode on the tracking information, only the first portion, so for example YO1 which allows the fake recipient to be anywhere in central York. Since it shows as being delivered to 'broadly the right place', ebay refuse to refund, the '£3,000 camera lenses' in the article probably never even existed - the seller will have just sent some random junk that was vaguely the right weight to a co-conspirator in the same town/area.

Okay, so where does the money come from if the seller and buyer are co-conspirators?

Stolen money makes no sense, this kind of trickery would have zero impact on chargebacks.

The buyer isn't a co-conspirator, someone in the same area is. The buyer is out the money they paid.

But it actually works both ways, this scam has happened on sellers and buyers.

I'm not sure an exact grid reference would help delivery drivers in many urban areas. There is just too much stuff jumbled on top and behind each other plus shadowed from an accurate GPS signal.

Headline whilst HN correct is misleading.

TLDR - fraudster orders good, returns empty box with tracking, tracking label is photoshopped to different property in post code. Fraudster knows that tracking only records post code not property within post code. eBay issue refund.

Problem is granularity of tracking nothing to do with post code loophole.

Ebay would issue the refund even if the fraudster didn't photoshop the tracking label.

Is the granularity of the tracking really the problem? I believe fraud is the problem, and it's an impossible one to solve.

The issue is Royal Mail being negligent.

Even for proofs of postage sometimes (always?) the certificate only lists the recipient's postcode instead of the name and full address.

You are correct that Proof of Postage only records the postcode, which can only be obtained at the the Post Office (for free), when handing over the letter/parcel at the counter. However, you can insist upon the address or the property number to be recorded ─ which requires a 'Certificate of Posting', which needs to be filled in and stamped. You can have one or the other, not both. This absolves RM of any negligence albeit they could clarify this distinction.

Since, this particular scam is originating from a very specific ecosystem; in this case, the responsibility ultimately lies with eBay and to a certain extent with PayPal ─ who are blasé about these scams and have zero intent on solving these issues, they are even happy to front-load the system, so it favours certain types of scammers.

https://business.help.royalmail.com/app/answers/detail/a_id/...

If anything your reply makes RM look even worse... Also the issue seems to also lie with tracking, not just with proof of postage (or whatever exists solely for the purpose of confusing customers who are never made aware of these 2 options)

That may be true, but Royal Mail does not play a significant part in this fraud. There's nothing Royal Mail could do to stop this fraud.

Having correct tracking and proofs of postage, and potentially coherency checks between written address and barcode, would make it much more difficult to impossible.

I was curious how much coherency would help, thinking perhaps it's just the postcode that goes in the barcode too.

Apparently they also use a field "Delivery Point Suffix"

"A postcode is not always sufficient to uniquely identify each delivery point in the UK – for example, in shared buildings.

Some postcodes relate to only one delivery point, while others may cover up to a hundred. The average is 15.

For that reason a Delivery Point Suffix (DPS) has been developed. The DPS is a two character code (a number and a letter) which enables each delivery point to be identified.

The DPS can be created by extracting the postcode together with the house number or name using Royal Mail Postcode Address File (PAF)."

A postcode never refers to a single delivery point (i.e. address), except in some specific, rare cases.

It's not at all rare. Any building that gets a large amount of post is likely to have its own postcode.

So it's rare and specific. It's certainly not the standard case as suggested by the quote I commented on.

Nope, that'll do nothing at all. This scam works just fine even if the fraudster does not tamper with the label and the seller receives an empty box.

The empty box scam is one scam, all the abuse that is possible because of Royal Mail's negligence is another.

At least if the seller is the one receiving an empty box he can set up procedures to attempt to prove it.

What abuse is that? The example in the article is the empty box scam.

>At least if the seller is the one receiving an empty box he could set up procedures to attempt to prove it.

I definitely agree that would be a better outcome, but I think it is a stretch to blame royal mail for this. If someone really wants their package to get lost in shipping there's not much you can do about it.

Receiving empty box gives you evidence to submit for Police investigation. Much easier to prosecute than "system said I receive package".

Ebay would refund the seller even if the fraudster shipped back just an empty box to the correct address. They don't give a single fuck.

This can happen in the US, too. I sat on a grand jury that heard a case involving the same scam.

Go away what3words PR team

I find it ludicrous that we’re still not using GPS coordinates as addresses. My address would look something like

    First Last
    Street # or Building Name if any
    18.0000 -7.0000
    USA

Basically the “ZIP city, state” line should be replaced by coordinates; 4 decimals are precise to 11 meters.

And in less dense areas you might not need the second line either:

    First Last
    18.0000 -7.0000

Mail is not handled manually anymore so why act like it still is?

How does your mail get delivered? Mine still gets delivered by a human.

Your mailman follows a screen that tells them where to go.

From the few mailmen I know, this is hardly the case.

Seems like that would be difficult to remember - every postman I've known in the UK just learns the route. It would also be harder for people posting a letter to remember - it's easier to remember 6-7 characters than 12 digits, and less prone to errors. Get one character wrong in a postcode and it'll _probably_ still go to the right region, or be an obvious error and handled accordingly, and if you're written the full address you have the area/city to check. Mistaking 40.6971, -74.2598 for 41.6971, -74.2598 puts you 100km away, and 50.6971, -74.2598 1000km away, and there's no obvious way of telling that's wrong.

We can do something similar to your system in the UK now - "10 SW1A 2AA" is a unique address, but we don't as it's less robust. "10 Downing Street, London, SW1A 2AA" makes the intention clearer, both if there is an error when writing ("10 Downng Street, Lendon, W1A 2AA" - we can make a fair assumption, particularly if the name indicates it's the same as other mail going there) or if it is damaged in transit ("10 Downing [Unreadable], London, SW-- 2A-").

How does that help solving this fraud? More than one person lives in the same GPS location. If they don't track flat numbers, they still have the same problem.

You didn’t read. The second line is still your regular address if you live in dense areas.

I was just complaining about addresses and not this specific handling of ZIP codes by UK’s post.

I thought I was missing something. If it doesn't solve the problem, why did you propose it then?

So everyone in the North-East facing apartments in my apartment building have the same address?

You didn’t read. The second line is still your regular address if you live in dense areas.

I read it, you didn't describe what you think you described. You didn't say regular address, you said street - which doesn't tell you which apartment in a building you live in.

Reply on news.ycombinator.com