Illegal online pharmacy using address of my shop as sender address.

Just when you thought you've seen it all....

[jecasc]

We have our regular fraud attempts, there was one case of DDOS blackmail, there was a fraudster trying to transfer money from our bank account with a fake money order and when you think you have seen everything something new comes up.

Like today:

The parcel service arrives, hands over a parcel that could not be delivered because of incomplete address information. There is our address as sender address on the parcel - thats why it is returned to us. However the address is misspelled and the parcel does not look like any of ours.

I open the parcel - employees are already joking maybe it's a mail bomb. But no - it contains Anabolic steroids and other drugs which normally may not be legally sold. A quick check on the internet shows, the goods are worth several hundred. So I take the box, drive to the nearest police station and get rid of it there.

What worries me though:

I can't think of a reason why anybody would use our address as sender address. Why not simple use a completly fake address or none at all?

Anybody had a similar experience?

I am a little worried about my reputation I don't want my business name all over the internet in connection with illegal drug sales. And even worse - with sales not delivered correctly.

And actually now I am wondering - what if it had been a mail bomb or a package full of cocaine? Do you have a policy about opening parcels?

[oliondor]

So weird, interesting to know the replies.

[lucy24]

I can't think of a reason why anybody would use our address as sender address. Why not simple use a completly fake address or none at all?

Has it been a long time since you set up your own shipping-service account(s)? My immediate assumption was that they have become more security-conscious and make sure the account holder has a real, physical address which is printed on the label. If you're in the same town-- which your shipping service normally would be-- you know whether the 300 block of Union Street really exists or whether it would put you in the middle of the East River. It may even be coincidence that the address used is real as opposed to just possible.

For future reference, it might be useful to talk to the parcel service. If they really do have someone else's account linked to your address, they should be able to Do Something About It.

This is all assuming for the sake of discussion that
:: cough-cough ::
one of your minor employees isn't running a sideline in something they shouldn't.

And, yes, a bomb or equivalent went through my mind too. I kinda think I would have brought the parcel to the police without opening it.

[jecasc]

The parcel wasn't shipped from a shipping account but posted as a normal parcel from a post office in another city. The sender and receiver address where printed on small custom labels.

My hope is that they simply put random addresses from random businesses from the internet on the sender labels and not only my address. I don't want dozens or even hundreds of parcels with my address and illegal drugs inside being shipped around. Or even worse - some mad bodybuilders on steroids coming to my warehouse demanding their money back or wanting to reorder.

I kinda think I would have brought the parcel to the police without opening it.

Yes, in hindsight I also thought it was quite stupid to open the parcel.

[edited by: jecasc at 7:30 pm (utc) on Aug 30, 2012]

[SevenCubed]

...mad bodybuilders on steroids...

Indeed, roid rage is very destructive, especially if you are in its path and it's expressing itself as an extended fist that is 3 times the size of your head :(

This problem you are having is low (as in undesirable behaviour). I've seen it in action to some degree where spammers use googles places to create fictitious local business addresses to get themselves listed in the neighbourhood of good businesses but that's minor compared to what you are experiencing right now.

[lucy24]

The parcel wasn't shipped from a shipping account but posted as a normal parcel from a post office in another city. The sender and receiver address where printed on small custom labels.

Ah, like that. The post office may insist on a return address for packages. I know you can't just toss them in the nearest dropbox; if you don't have a postage meter you have to deal with a human at the post office.

Detour to usps.com leaves me none the wiser except that they do say explicitly that mail which is picked up from your location has to have that same location's return address. Something tells me your steroid vendors do not have their packages picked up at their actual location ;) and, similarly, that they do not have a postage meter account.

[RhinoFish]

"one of your minor employees isn't running a sideline in something they shouldn't." = where my mind immediately went as well.

overall, email spoofing is common
[en.wikipedia.org...]
but this is for physical shipments, they're pretending you're the shipper... hmmm... with the lax controls the post office has, don't think you can stop this. if it repeats, perhaps a policy of not accepting return shipments w/o an RMA number? even that can be foiled easily.

i'd suspect somebody who wants to intercept your return mail, either an employee, your mailman, or the like.

i can't see any foolproof way of being victimized this way, nothing of short of new verification processes for anyone who ships anything, don't see that happening.

[dpd1]

Turn it over to the postal inspectors.

[bwnbwn]

So Jecasc all there was was a return address no name of the business?

This would worry me too.

[ken_b]

Turn it over to the postal inspectors.

That's probably a good idea, at least report it to them, even if you've give the package to the police already.

[lucy24]

i'd suspect somebody who wants to intercept your return mail, either an employee, your mailman, or the like.

Hmm, that's a whole nother range of possibilities. I think the OP (and I) took it at face value: the package was intended to be delivered, but the destination address was inadequate.

Since the package has to go through a human at the post office, the address would have to look complete. But the postal guy at your end wouldn't know if an out-of-town address belongs to, say, an office building or apartment block-- or even a commercial dropbox site-- where you'd need an extra number to get it delivered.

So the steroid user didn't want his spouse/ roommates/ parents/ co-workers to know what he was ordering, and expected the package to end up with the doorman or management office. "I think this is for you." Seems risky though. If there's no signature requirement, it could just as well be "This came for your husband. Tell him to get the ### address right next time. It's not my job to take in packages."

Or, of course, the company engaged in the hanky-panky was simply incompetent ;)

[jecasc]

I can rule out that the parcel was ment to be returned rather than delivered. We are not that big that anyone could intercept parcels without someone noticing. Only me and five employees. And not everybody there all the time. There is no reception, no special delivery entrance or anybody specially assigned to receive the parcels. Whoever is there when the postman arrives accepts the mail and signs for it. Sometimes it is me, sometimes the woman who does the accounting, sometimes a packer, there is no way you can tell in advance. If at all - I'd rather suspect someone at the post office intercepting mail.

My best guess would be however that someone is simply sticking random sender addresses on his parcels and screwed up the delivery address. Or better that's my hope. Worst case scenario: Someone is running a website and using my name. I haven't found anything yet however in the search engines. Maybe if the police can find the intended sender they will find out where he ordered.

I wonder though why the wackos always choose me for their stupid schemes. I have been at the police so often, I'll soon have my own coffee mug there.