Hacker News Reader

Comment by landr0id | Hacker News Reader

Thanks for the links. I'm confused how this works and the USPS report seems to be heavily redacted around details.

I would assume that the tracking number has the address details tied to it (I mean, based on support claims with USPS it definitely does), but maybe there's some obscure package type where destination is not distinct and they abuse that in a pool with other sellers, then at the last mile it gets sorted appropriately?

Seems wild that this market even exists considering how USPS flat rate postage exists.

Was your package something heavy or extremely light which makes weight-based shipping more economical?

View on HN

I’ve read about this. They basically reverse engineered how USPS creates the unique tracking number.

They aren't hard to generate. They give you how to generate them via their own documentation. It's just made up of an app ID, service type code, mailer ID, serial number, and check digit.

No. That won't work. Every carrier has it own way to generate tracking number. And that number must have registered in the carrier's database before it becomes "valid/sanctioned".

If you generate a random number even fitting the pattern and looks like a real one, the scan will fail with an error and fail to register tracking information every single step of the way that package gets scanned from dropoff at the retail postal office (this was the case) as bulk inbound pickup from USPS are only allowed for USPS verified partners.

Label creation (which generates the tracking number) is a billable action in their API. Some volume partners have pre-arranged/allocated tracking number segments assigned to the bulk volume partner/shipper (similar like how IP address v4 is assignment from IANA). And that pre-allocation tracking number range requires $$$$ contract in place. Billing that is post paid like cellphone bill.

Most retail shipping software (like shipengine, pirateship etc.) bills using the prepaid method, meaning you will have to pay for the label at the time label is generated.

Disclaimer: I used to work for a carrier that integrated a few dozens of global shipping carriers.

Yes, I’m deep in e-commerce and fraudulent labels are all over the place. Even Amazon, 3rd party sellers are using these fake labels to sell items for cheaper and win the buy box. Even UPS has this issue.

I get that they have reverse engineered how the numbers are created, but how are they showing up in USPS and UPS databases?

Are shipping platforms like shipengine getting these labels pre-made and this fake label seller has reverse engineered how these tracking numbers are created programmatically and are essentially using the ones allocated to these big shipping platforms?

And the only plausible way they got around is likely recycle previously used real tracking numbers because USPS is inept (the thing USPS has been constant and consistent is raising prices).

We would never know how since that's the part USPS redacted heavily.

I wish Anthropic/OpenAI FDE take over USPS IT altogether.

> how are they showing up in USPS and UPS databases?

Are you overestimating their validation capabilities? Maybe the validation just isn't that accurate or isn't always done, for efficiency.

I once desperately needed a (FedEx or UPS) package that was delayed. Tracking showed it in a facility about an hour away so I asked if I could pick it up there. I was told: 'It's not really there; our (customer-facing) tracking shows where packages should be.'

Their image of super-efficiency is for selling themselves. (If you are deep in e-commerce, you probably already know.)

Yeah USPS definitely reuses tracking numbers, but how were these guys able to overwrite the delivery address? I feel like this shouldn’t be possible unless they are inside the system.

Having a connection/s inside who are in on the game would make sense.

My guess is that the validation just validates the numbers which are old and valid and some automated system notices the label and routes it. I bet their system is a disjointed system and not set up in a way where every step checks every thing. It's very plausible it was home grown in such a way where its like this

Correct, I was just pointing out how trivial it was to generate/counterfeit a USPS barcode. I also worked in shipping/logistics with heavy USPS integration, but it was dealing with bulk/volume labels, where we'd only get charged if the label was actually used (returns, etc).

The redaction is frustrating, but I suspect the approach is still at least partially viable, so they aren't interested in giving a playbook for scammers to exploit.

The tool I bought wasn't what you'd think of as a small, inconsequential item. I'd wager it was ~2lbs and was a automotive brake bleeder in a blowmolded case. Probably the size of an old-timey encyclopedia. Cheaply made of course (almost certainly an aliexpress item). The seller I bought from has what appears to be an aliexpress dropshipping supply chain -- they buy the tool for $, ship from a US warehouse in Florida for $$.

Reply on news.ycombinator.com