Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A mail drop or ghost address is an entity that can receive mail in your name.

For a little more on why would you want to do this, see JJ Luna.

A CMRA stands for a commercial mail receiving agency. Not a good option.

Edited for clarity: I'm looking for a physical mail option, not an e-mail option, of course.

share|improve this question

migrated from Jan 16 '13 at 16:22

This question came from our discussion, support, and feature requests site for information security professionals.

This looks like a question that would be on-topic on the main site (not here on meta: it's not about the site itself). But it is hard to understand: what are your criteria for reliability? That they maintain your privacy with respect to most third parties? with respect to government entities? that they respect your confidentiality? that they aren't likely to go out of business? that they don't lose mails? … – Gilles Jan 16 '13 at 13:02
A little bit of all of the above, yes. – superuser Jan 18 '13 at 11:09
For those not prepared to register there, can you pop a summary of its points into the question. – Rory Alsop Jan 22 '13 at 21:59
@Rory Alsop? Clarify pls. – superuser Jan 23 '13 at 10:44
That JJ Luna page - you need to register to be able to read the doc, and peole may not want to do that, so any chance of a quick summary of the points so we know why you would want to do this? – Rory Alsop Jan 23 '13 at 10:47

I asked an old military friend of mine specifically for a global one.

This one is also recommended by a lot of people. I don't know if you like this one, but I hope it's of some help.

share|improve this answer
Isn't that a commercial mail receiving agency? – executifs May 15 '14 at 12:22
@executifs i have no idea to be honest, it was recommended by someone who values privacy and annonymousity as much as him, i think he choose for them for the fact they operate under new zealand law, have their operations there etc. – Lighty May 15 '14 at 13:55
@Lighty can you please update your answer to include a non-CMRA option? It would be a huge improvement I think, since if you reread the question it says, "A CMRA stands for a commercial mail receiving agency. Not a good option." Not my words. Your answer isn't bad! But it could be better. – T. Webster May 19 '14 at 11:16

Honestly, I'm not sure there is a good answer to this question. Cyber criminals too struggle with it, as demonstrated by this enlightening Microsoft research paper. It focuses on how criminals manage to cash-out stolen credit card numbers, and one of the main hurdles they have to face is finding a way to receive goods anonymously.

Their solution is to hire unsuspecting "mules" and trick them into forwarding packages (incidentally, the mules are the ones who end up taking the fall). Maybe you don't want to go that far. I hope you don't.

The truth is, it's hard to have a private mail drop because most governments don't want you to have one (rightfully so). Here is a drop down of possible solutions (for the sake of brainstorming), all of which I certainly wouldn't advise trying:

  • [Possibly illegal] Find a CMRA that looks shady enough not to respond to law enforcement requests, but still legitimate enough to forward your mail. Some services located in tropical islands offer a full package: mailbox, fake residency certificates and even the creation of a front company. They're a Google search away.
  • [Possibly illegal] Skimming through craigslist may occasionally turn up people renting mailboxes. Are they allowed to do so? Should you trust them? I have no idea.
  • [Absolutely illegal] If you have basic lockpicking skills, it may be possible to hijack the mailbox of an unoccupied flat. Of course, this is nowhere near "reliable"; you never know when the flat will be sold/rented, and some suspicious neighbor could simply call the police.
  • [Absolutely illegal] The "mule" thing. If you were ready to go to such lengths, you probably wouldn't be asking such questions here.

That's all I can think of. Once again, it's nice and fun to ponder on such problems, but doing anything more than thinking about it may well get you into serious trouble. Don't cross that bridge :)

share|improve this answer
on the 3rd option - you'd be surprised how much expensive stuff a UPS employee is ready to leave out in the open without a signature given a sticky note on the front door saying "leave packages on the front door". The other option is to have either yourself or a friend stay at the unoccupied home when UPS comes on by, sign the package, then pretend to make a phone call. I know someone who's used this method for theft before. – Thebluefish May 19 '14 at 23:58
this doesnt really awnser the question, it says more of what NOT to do, then WHAT to do with mr. annonymous's plans of a mailbox a gov. agency/corporate buisness doesnt try to spy into – Lighty May 20 '14 at 14:17

It is difficult (by design) to receive mail anonymously in the US. Obtaining a USPS P.O. box requires two forms of ID. Opening an account with CMRAs, which are regulated by the USPS, also requires two forms of ID. Alternatively, a completed, notarized form 1583 may be used. Note that the form 1583 provides no individual privacy to members of corporate entities, requiring names, verifiable ID and addresses for the corporations' officers who will be receiving mail on its behalf.

As J.J. Luna notes in How to be Invisible, this leaves a few options.

  • One could prepay in cash the rent for a small office space/flat, through which mail could be received. Depending on the formality of the arrangement, ID may not be required. Some social engineering (e.g. an explanation that one is attempting to stay off the radar of an abusive ex/estranged family member/former friend with criminal connections) could smooth the process. A previously-incorporated entity such as an LLC could also be provided as ID for renting an office space. Politely decline to provide personal ID.
  • One might also enlist the help of a trusted friend or local business to accept mail on one's behalf.

Additionally, it is also important to note that not all classes of mail are immune to to inspection (e.g. media mail, which should not be used for correspondence) and that a record of all the the to: and from: addresses on mail for a given recipient, known as "mail covers," are retained by the USPS and can be provided to law enforcement.

share|improve this answer

As said above, even cyber criminals struggle with this.

The best solution would be an in house solution, by using friends and family you can trust (more effort than a paid service but better result). This is difficult though if you need maildrop on otherside of the world

It does also depend on what you are using the address for. For example if you just what privacy but aren't doing anything particularly illegal then a commercial mail fowarding service should be fine. If you don't fancy giving mail fowarding company your id then its also easy enough to register a fake id with some of them. If they use online verification for passport number or license then you can buy these things from TOR marketplace.

If for instance you were using the address to create a new identity, say a forged utility bill then you will need an address that looks like a residential address or at least someowhere a person might live. In this case if supposing you were using a CMRA as the address on that forged document all someone would have to do is google the address and see that obviously you are not going to be living in a huge mail factory so therefore it may not pass closer inspection.

The best CMRA is MBE because they are franchised meaning they don't have huge centres but are often just franchise small shops and can provide a physical street address and even unit number and so making out that you live there even if they googled the address might be slightly more believable

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.