Dude,Where’s My Check? An OSINT-Based Analysis of the Link Between Check Theft and Identity Theft

Abstract

Identity theft targeting American citizens continues to rise. While prior research has linked this trend to data breaches and scams, a more recent development—check theft from U.S. Postal Service (USPS) mailboxes—may also be contributing to the problem. However, the absence of official data connecting check theft to identity theft limits our ability to fully assess this relationship. This paper investigates whether check theft activity observed on Telegram, a major platform for illicit trade, can predict officially reported identity theft incidents as recorded by the Financial Crimes Enforcement Network (FinCEN). By integrating open-source intelligence (OSINT), we were able to collect and analyze publicly available data and compare it with formal crime reports, to illustrate how combining alternative and official data sources can enhance our understanding of the online fraud ecosystem, particularly the factors driving identity theft.