USPS Audits Continue to Reveal Failures to Protect US Mail
-
Audits reveal systemic, repeat security failures across USPS facilities and initiatives.
-
High-tech fixes like eLocks and scanners underperform due to poor deployment and oversight.
-
Mail theft and check fraud keep rising despite USPS claims of rigorous security efforts.
For years, OrboGraph has tracked a troubling pattern: the United States Postal Service (USPS) conducts audits, the audits reveal serious security failures, recommendations are made — and the problems persist. The latest report from the USPS Office of Inspector General (OIG), released May 6, 2026, is no different. This time, the subject is the Vulnerability Risk Assessment Tool (VRAT) process — and the findings point to a system that is fundamentally broken.
The VRAT is a risk-based model used by the U.S. Postal Inspection Service to identify security deficiencies at postal facilities. Tier 1 (most critical) and Tier 2 (critical) facilities are the highest-priority targets for these assessments. In theory, the VRAT should be a cornerstone of USPS security infrastructure — a systematic way to identify vulnerabilities, assign corrective action, and track resolution.
In practice? The OIG's audit paints a far different picture.
What the Latest Audit Found
According to the May 2026 OIG Audit Report (No. 25-147-R26), the Postal Inspection Service did not effectively oversee the VRAT process. Specifically, auditors found:
- Many surveys were not started or incomplete
- Deficiencies remained unresolved
- The status of resolved deficiencies was not reported in the system
- Not all facility management received required VRAT security training prior to performing surveys
- Personnel from both the Postal Inspection Service and USPS duplicated efforts by completing separate VRAT surveys at the same Tier 1 and Tier 2 facilities in the same fiscal year
The OIG issued six recommendations — all agreed to by management — covering survey completion failures, deficiency monitoring, status reporting, training verification, and survey redundancy. The fact that management agreed to all six recommendations is not reassuring. It's a sign that these are known, recurring problems.
A Pattern of Failure
This is not the first time OrboGraph has reported on USPS security audit failures. The pattern is well-established:
What Financial Institutions Can Do
Waiting for the USPS to fix its security infrastructure is not a viable fraud prevention strategy — the audit history makes that clear. Additionally, as we've noted in the past, even its recent efforts do not make relying upon the US Government's impact a wise move.
Financial institutions must rely on the technologies available to them to stop check fraud, plain and simple. The most successful FIs are leveraging a multi-layered, technology framework that works regardless of upstream failures. By combining image forensic AI, transactional analysis, rules engines, and dark web monitoring, FIs can achieve detection rates of 95% or higher—ensuring that even when fraudsters successfully obtain stolen checks, the financial institution is protected.
