Hacker News

Related: Not US postage labels, but suspicious US postage stamps, seemed to also be used as a crude currency.

A third-party seller on Amazon or eBay was including sheets of suspicious US postage stamps in product shipments, unsolicited, with full-color glossy notes offering more stamps in exchange for positive reviews.

(I took the stamps and note I received to a post office, where a manager agreed they looked suspicious, and I asked them forward it up the chain. I like the USPS as a trustworthy service and institution, and I hate counterfeiting.)

Thanks for the links. I'm confused how this works and the USPS report seems to be heavily redacted around details.

I would assume that the tracking number has the address details tied to it (I mean, based on support claims with USPS it definitely does), but maybe there's some obscure package type where destination is not distinct and they abuse that in a pool with other sellers, then at the last mile it gets sorted appropriately?

Seems wild that this market even exists considering how USPS flat rate postage exists.

Was your package something heavy or extremely light which makes weight-based shipping more economical?

Why is that report so heavily redacted?

Possibly. Sometimes delivery companies find it easier to just deliver them attempting to return to sender and dealing with headache of customer complaints since while it should have been clear to people buying the labels that they were not legit, a lot of people would be like "HOW WAS I SUPPOSED TO KNOW? I WANT MY MONEY BACK!"

Yes there is verification. Sometimes the label WAS valid but it was purchased with stolen credit card OR purchased then refunded after delivery to the client but before it entered the postal stream.

EDIT: Remember, boxes can be dropped off before someone processes them. Just hand them random postal carrier OR put them in postal pickup box.

This report alludes to (but IIRC stop short) of confirming that there is only validation at the designated ports of entry scans. https://www.uspsoig.gov/sites/default/files/reports/2026-04/...

My suspicion is that these labels are entering the mailstream somehow circumventing the "first" scan.

they are real labels, im fairly sure. but they are generated fraudulently, likely via stolen credentials on various shipping providers with USPS api

Most countries when presented with evidence that someone who lives there did something criminal will arrest and turn the criminal over to the country the crime was committed in. Sometimes they will put some stipulation in (Europe commonly won't turn a murderer over until the country promises not to seek the death penalty for example), but in general criminals are turned over all the time. In general a country doesn't want criminals living there even if the crime was done elsewhere and so they won't protect their own who commit a crime.

I don't know Pakistan's polices, but I would expect they would turn the criminal over to the US.

>UPS is also full of holes. No verifications whatsoever.

I've had one of my UPS account numbers used to purchase some labels for someone else (I have no idea who). No way to report this to UPS since I can no longer get in touch with my account rep (who was great, until he disappeared).

They probably distinguish between what they think and what they know. It could very well be they ran a “sting” and made a few transactions through the site and are only charging against those transactions to get extradition started while they assemble the larger case.

Isn't it one count per distinct criminal act? I think they do it to keep things simple and sane. In some cases they'll drop some, or add more depending on how evidence grows and the case proceeds.

There are lots of ways to send packages. Stamps are used for letters, but a package tends to have various restrictions and so they get a shipping label which is supposed to be proof that you paid the correct postage without having to find the correct stamps which would be really annoying.

Business that ship a lot (which is probably most packages) don't go to the post office for each shipment. Instead they buy machines/printers/software/labels which allows them to print off the correct label, and also combines all the money into something they handle the money in one larger transaction. There are lots of options in the above for different needs, if you a shipping a package even once a week you should look into them - often you get a discount for something that is easy for you to do (sorting outgoing mail by zip code saves them a lot of money and so they will pass that on to you)

Because there are so many options you can find one option and duplicate it easily enough and it will take them a while to catch it.

I'm assuming, but im pretty sure sites like this operate by getting stolen credentials to third party shipping sites. think of all the sites like pirateship, shippo etc. if a companies account is hacked, they could create api credentials and just distribute a ton of requests across all the accounts. more accounts / larger orgs that get compromised = less chance of killing the beast

These are full shipping labels

-