I just discovered that scammers are now using UPS MyChoice to change the shipped address on order after they have been shipped. UPS launched this service recently, and it now allows anyone with a tracking number to alter the shipping address to any location without the shipper’s knowledge or approval. This can be any address, not just a UPS store, and there are no restrictions.
THIS IS A MASSIVE FRAUD RISK FOR ANYONE USING UPS LABELS PURCHASED THROUGH SHOPIFY.
We know that when orders are processed through ShopProtect, ShopPay, PayPal, AmazonPay, Signifyd, and similar services, they must be shipped to the address on the order. If the address is changed, sellers lose all fraud protection.
I have personally lost several thousand dollars due to this scam. Scammers place an order using a stolen credit card, ship it to the actual billing address, and use real customer information to make the transaction appear legitimate. The order passes all fraud review systems, including Signifyd. After shipping, the scammer changes the shipping address via UPS MyChoice. The item is then received by the scammer, and the seller faces a chargeback, which is lost because the shipping address was altered.
I spoke to UPS and they said there is now an option when creating UPS label “Direct Delivery Only DDO” for $2 extra which prevents the receiver from making any address changes. However, this option is NOT available when creating a UPS shipping label though Shopify.
@Shopify_77 Can you address this issue? When will direct delivery only be available for UPS labels?
Here is a screenshot from UPS with the DDO option:
This can’t be that simple? So the “buyer” orders, we ship to the address provided via UPS, once in transit, they then go into My Choice, change the address and then get the item to their new address and our shipping label shows delivered to a diff zip code and then we loose all protection?
It is 100% this simple. I’ve had EXACTLY this happen on two orders this week and am now out $3500. I had to get it in writing from UPS directly as I couldn’t believe it. See below. The 'restriction" the refer to is this ‘Direct Delivery’ add on for $2/shipment that is NOT available in Shopify.
I tested it out myself. I created a UPS MyChoice account and shipped myself an item. I logged in was able to redirect it to a completely different address in a different state; all I had to do was create a MyChoice account which ANYONE can do in 2 minutes. All without an notification to or approval required from the ‘shipper’ account.
But what about the receiver redirecting a package to an Access Point, which requires that they show picture ID to pick up the package. By denying the intended receiver all redirection of package, you are also denying them this, a level of security that their shipping address may possibly lack, such as secure drop-offs of packages, packages being prone to theft by porch pirates.
Access points are different. Those still count as the package being delivered correctly since they have to show ID. The issue with UPS MyChoice is that they can redirect the package to ANY OTHER ADDRESS, not just a UPS access location. Scammers redirect the package to a completely new address where they receive it; no ID required.
I came across this thread while researching why UPS wouldn’t honor my own MyChoice Delivery Preferences settings that purports to redirect all deliveries to a UPS Access Point (AP). It has driven me bonkers to find all kinds of excuses given to me by UPS why packages addressed to me are not “linked” to my account settings, so much so, I have had to file a BBB complaint about them, now pending. One given excuse is that the shipper has set restrictions on the delivery that does not allow address changes of any kind. I’ve called the shipper and told them to remove this restriction because my residential address does not have a secure package drop-off location. The shipper in the most recent case was Dell Technologies and they were completely inflexible about requesting Delivery Intercept request from UPS, so that I could pick up my package at a secure UPS location, curiously citing for excuse the very reasons I see here of “fraud prevention”! I got so pissed off trying to reason with them on this issue that I decided to cancel a $2k order for a new computer with Dell. If Dell (and others, only recently, mind you) used this DDO option to block my long-standing use of AP, then this is not a good thing for me. “DDO” does not even come up when you search for it on ups.com; the only Delivery Restriction message on ups.com is that,
“Certain [AP] locations do not accept signature required or odd sized packages. In this case, delivery will be made to your original location.”
But then, this and other packages, thus-blocked from being sent to an AP, did not require signature anyway. I’ve use AP successfully for many years before this has started happening since about 6-mos ago. So, I’m trying to get to the bottom of it right now and UPS, at its corporate offices in Atlanta, has so far been slow in providing answers. I’ll let you know when I learn more.
For high value items like this it will 100% be sent as DDO, direct deliver only. Even though UPS access point pickup have some protection for the shipper they are still often used by fraudsters. It’s very easy to show up with a fake ID or fake notarized letter and UPS will release the package. This results in a chargeback to the seller and which ties up the money for 90 days and then if they are lucky they’ll win the chargeback but no guarantees. I’m telling you this based on multiple first hand experiences with this exact issue.
I also sell high-end electronics and now only ship with DDO as the amount of time wasted dealing with fraud was unsustainable. If you ship anything of value that might be targeted by fraudsters your only option is to ship as Direct Delivery Only otherwise your essentially throwing your products out in the street for anyone to steal.
But the shipper, take Dell for example, has no problem changing the address if you request it, just not to a UPS hold for pickup. Try and explain that. Your requested shipping address does not have to match your billing address.
You have not addressed the fact that delivering to a street address if that address is not secure makes it open to thievery. This has happened to me a lot at my current address.
If someone has stolen your CC or photo ID, then you’d be stupid not to have reported it immediately to the authorities. You can what-if all you want, such as being held at gun point in your home, etc., it does not make things safer to deny the receiver the right to pick up a package in person, with photo ID and a signature. Suggest a better solution if you can.
Finally, if DDO is an option, why is it not mentioned on ups.com?
