The identity checks that come with a virtual mailbox feel like bureaucracy — two IDs, a notary, a federal form, all before a single envelope arrives.
Then you look at the numbers. The FTC logged more than 1.3 million identity theft reports in 2025, with related fraud losses topping $15.8 billion. The U.S. Postal Inspection Service received more than 800,000 mail theft complaints between fiscal years 2023 and 2025, and the FBI has issued formal warnings that check fraud enabled by mail theft is climbing — suspicious activity reports for check fraud nearly doubled between 2021 and 2023.
Mail is how identities get stolen. The bureaucracy is the defense. Here is how the compliance system actually works, what it protects you from, and the red flags that tell you a provider is cutting the corners that matter.
Why the rules exist
A mailbox that receives someone else's mail is a powerful thing. Used honestly, it is a business address. Used dishonestly, it is the front end of identity theft, reshipping fraud, check washing, and every scheme that needs mail to arrive somewhere untraceable.
So USPS regulates the whole category. Any business that receives mail on behalf of others is a Commercial Mail Receiving Agency (CMRA), and CMRAs must register with the postal service, verify every customer's identity, and keep records the Postal Inspection Service can audit.
That is the deal behind your mailbox: the provider vouches for who you are, and USPS lets them handle your mail. When a provider skips the verification, they are not being customer-friendly — they are dismantling the thing that makes the address trustworthy, for you and for everyone else in the building.
The scale of the problem the rules answer
It is worth sitting with the numbers for a moment, because they explain every requirement on the form:
- 1.3 million+ identity theft reports to the FTC in 2025 — and reports filed January through September 2025 already exceeded all of 2024
- $15.8 billion in combined fraud and identity theft losses in 2025
- 800,000+ mail theft complaints to the Postal Inspection Service across fiscal years 2023–2025
- 3,654 mail theft arrests under the joint USPS/USPIS Project Safe Delivery initiative through March 2026
- The FBI and USPIS jointly warning that mail-theft-enabled check fraud is rising, with check-fraud suspicious activity reports nearly doubling from 2021 to 2023
The common thread: the residential mailbox is the soft target. An unattended box on a porch, a mail slot in an apartment lobby, an outgoing check left with the flag up — that is where the theft happens. The compliance-heavy commercial alternative exists precisely because the casual one stopped being safe.
What a compliant provider must do
- Register as a CMRA with USPS for its location
- Collect a notarized Form 1583 from every customer before handling any mail — our step-by-step 1583 guide covers the form itself
- Verify two forms of ID, one photo and one proving your residential address, and keep copies on file
- Track authorized recipients — only people named on the 1583 may receive mail through the box
- Maintain records available to postal inspectors
The full regulatory picture — what CMRAs are and the rules they operate under — is in our virtual mailbox rules guide. This article is the security half: what compliance protects you from, and how to spot the operators who skip it.
What it protects you from
Someone else claiming your mail. The authorized-recipient list is why a stranger cannot walk in and collect your bank card, your tax refund, or the replacement debit card your bank mailed. Every handoff traces to a verified identity on file.
Check theft and washing. Business mail carries checks — incoming payments, outgoing vendor checks. The FBI's warning is specifically about checks stolen in transit and altered. Mail that goes from carrier to locked commercial facility to logged handoff never sits in an unattended box, which removes the exact exposure the fraud depends on.
Your provider disappearing with your mail. CMRA registration ties the operation to a real location USPS knows about. Fly-by-night operations do not register — which is exactly why the registration matters.
Your address being used for someone else's fraud. Shared addresses attract scrutiny when any tenant misbehaves. Banks and platforms cross-reference addresses against fraud databases, and one bad actor at a sloppy mail drop can get the whole address flagged. A provider that verifies everyone keeps the address clean for everyone — including for the bank running Know Your Customer checks on you.
Identity theft through your own mail stream. A virtual mailbox at a staffed facility means bank statements, IRS notices and card offers are logged, locked, and visible to you the day they arrive — instead of sitting in a box where, as USPIS puts it, stolen mail is a direct route to a stolen identity.
Why this matters: when a provider offers to skip the notary or start service before your 1583 is filed, they are not doing you a favor. They are telling you they run the same shortcut for every customer
— including the ones you would not want sharing your address.
Red flags when choosing a provider
- "No Form 1583 needed." Either false or non-compliant; both end with your service interrupted when it surfaces.
- Start receiving mail today, paperwork later. Compliance is a precondition, not a follow-up. USPS requires the form before mail handling begins.
- The address is formatted like a PO Box. A real CMRA gives you a street address with a suite number.
- Prices that only work by skipping labor. Identity verification, staffed premises and record-keeping cost money. When a price seems impossible, those are the corners available.
- Nobody answers the phone. The record-keeping requirements assume someone actually operates the location.
- No physical premises you can visit. An address you cannot stand in front of is an address a bank can flag.
One question sorts the market fast: *"Can I see your CMRA registration, and will you notarize my 1583?"* A compliant operator answers both without blinking.
What gets a mailbox shut down
The common causes are mundane, not criminal:
- A stale Form 1583. You moved house, or a business partner started collecting mail without being added as an authorized recipient. The form on file no longer matches reality.
- Unauthorized recipients. An employee or family member picking up mail who was never added.
- Use for illegal activity — rare, but decisive: the box closes and the Postal Inspection Service opens a conversation.
The fix is boring and cheap: keep the form current. Adding a recipient or changing your home address means updating the 1583 — ten minutes with a notary, and ours is free for members.
How we run it
At 1655 S Blue Island Ave, every mailbox sits behind a current, notarized 1583, verified in person or by online notary, with the paperwork stored and the recipient list enforced at the front desk. Mail arrives into a staffed commercial building, is logged the day it lands, and is released only on your instruction through the Anytime Mailbox platform we run on — scan, forward, shred or pickup.
It is a building, not a counter at the back of a shipping store. Come look at it before you hand anyone your mail — that offer is itself a compliance signal, because the operators worth avoiding cannot make it.
Frequently asked questions
Why does the post office need my ID just to receive mail?
Because mail is how identities get stolen — the FTC logged over 1.3 million identity theft reports in 2025 alone. Form 1583 ties every mailbox to a verified human being, which is what keeps your bank card from being collectable by whoever walks in. The friction is the security.
Can someone steal my identity through a virtual mailbox?
Through a compliant one, it is harder than through your home mailbox — items are logged on arrival, locked inside a commercial building, and released only to verified recipients, while USPIS reports hundreds of thousands of complaints about theft from ordinary boxes. Through a non-compliant provider, the risk is real: an operator who skips ID checks for you skips them for everyone sharing your address.
What gets a mailbox shut down?
Usually paperwork, not crime: a Form 1583 that went stale after a move, or someone collecting mail who was never added as an authorized recipient. Keep the form current and the recipient list accurate and you will never think about this again.
Are the cheap providers cutting corners on compliance?
Not all of them — but identity verification, staffed premises and record-keeping are real costs, and when a price seems impossible those are the corners available to cut. Ask one question: "Can I see your CMRA registration, and will you notarize my 1583?" The answer sorts the market fast.
Is my scanned mail actually private?
With a compliant provider, yes: mail is opened only on your explicit instruction, scans live behind your login, and USPS confidentiality rules apply to the operation. Ask where scans are stored and who can access them — a real operator has an answer ready.
Can the police or postal inspectors read my mail?
Not casually. Mail has strong legal protection, and inspecting contents generally requires a warrant. What CMRAs must provide on request is the registration paperwork — who owns the box — which is exactly the accountability that keeps the whole category trusted by banks and states.
Is a virtual mailbox safer than a PO Box?
Different trade-offs. A PO Box is inside a post office, which is secure, but it cannot receive most courier deliveries and fails for business registration. A compliant virtual mailbox adds staffed handling, logging, scanning and all-carrier acceptance on top of comparable physical security — see our full PO Box comparison.
