Many social engineers who've been In the scene to the point of reaching an advanced level In exploiting the human firewall, predominantly focus on the very best methods that're suited to the task at hand, and also work on how to effectively use them on their target to achieve their objectives. In order to maximize the best chance of a successful outcome, without a shadow of a doubt, It should well and truly be applied to every attack vector however without the right formulation, there's always an element of failure. For Instance, let's say you're SEing an online store and they offer what's called an "AR" (Advanced Replacement), whereby you claim that your Item Is (apparently) not functioning and then they'll send you a replacement Item before you return the (seemingly) defective one. If you fail to send It back, they'll bill your account for the full cost of the purchase Item.
HP Is one of many companies that does this, so keep It In mind when you choose to SE them. Moving forward, as an SE'er yourself, you'll have the transaction side of things already covered, by using either a fake payment system or a one-time "VCC" (Virtual Credit Card), thus your real account does not get touched. Furthermore, you've created a fictitious online account by entering a different name, unrelated email address, used a VPN and so forth, therefore your Identity Is masked an unbeknownst to the company In question. All angles have been taken care of and you cannot be traced for not returning the Item, correct? Well, there's one very Important thing that you've completely overlooked and neglected to apply, and that Is your residential address to accept the delivery from the carrier driver and this alone, Is enough to reveal exactly who you are!
If you haven't already guessed, what I'm referring to Is "company manipulation and exploitation", by tricking representatives to Issue refunds and replacements using various methods that support the nature of the Items, and help the attack vector to run as smooth as possible from start to finish. It Is all well and good to have the right Ingredients when preparing and executing your SE, but what about protecting the delivery point, namely where you'll be receiving your packages? Not only Is this crucial for "ARs" (Advanced Replacements), but also when using the "DNA" (Did Not Arrive Method) by saying that the carrier failed to deliver your goods at the nominated address- your house. Because of this, some drivers tend to physically visit your home and ask questions as to why you've said you didn't receive It, when It was clearly marked as delivered. In circumstances like these, your best option Is to use a "drop house" or sometimes referred to as a "drop address" or "drop".
So what exactly Is this? I'm glad you've asked! Put simply, It's a physical location In the form of a residential house that does not belong to the SE'er, and Is used to accept packages ordered from stores who utilize a carrier as part of their delivery service. In other words, Instead of using your real address, you opt for a remote home that's "vacated" and has no association to you whatsoever. The problem that many social engineers face, Is trying to "Identify a vacant property", meaning, how to be absolutely certain that no one lives there 24 hours a day, 7 days a week. That's what prompted me to write this article. I will show you the best methods to conclusively establish that the house you've chosen as a "drop" (to accept your deliveries) "Is not occupied" In any way, shape or form. Before I do that and on the grounds that you have no Idea "how to locate/find a drop house", I'll Introduce you to a couple of methods. If you're familiar with locating drops, you can skip the next two topics.
Locating A Drop House- Advertised For Rent:
Prior to elaborating on a rental property, I'd like to first explain why one particular option that a lot of SE'ers choose, namely a "house that's listed for sale" Is not always appropriate and will not serve the SE'ers needs "each and every time". There's no doubt that a for sale sign at the front of the home, Indicates that Its owners have no Intention of staying there, however this does not necessarily mean that they've already packed up and moved out. Think about It logically for a minute by putting yourself In their shoes. If you're selling your own home, would you Immediately leave the moment It's listed on the market for potential buyers, or wait until It's sold and then pack your belongings and head off to your new dwelling? I think your answer Is obvious- being the latter. Sure, some homes are In fact unoccupied but what happens If the one you happened to select Isn't (at the time), and your package Is handed to Its owner? Enough said. Nonetheless, I will still reference homes for sale as a drop, and how to make sure they're vacant.
Generally speaking, as opposed to properties for sale that have a settlement period of (for example) 60 days or more, whereby once the contract Is signed and the property Is sold their owners move out sometime before the said period ends, houses for "rent/lease" are completely different. It's almost guaranteed that the owners are awaiting tenants ready to move In, hence no one will be living there. For Instance, when you were house-hunting for a rental home, how many times did you find a household member hanging around watching TV during your Inspection? It's never happened In my experience, and that's what makes It perfect to use as a drop. So how do you locate one? It's pretty simple- jump In your car and drive around the neighborhood, there's bound to be at least one. Alternatively, go online and navigate to your local real estate website and filter your search to "rent/lease"- there'll be heaps available.
Locating A Drop House- A Foreclosed Home:
Without a shadow of a doubt, this Is one of the best and most effective methods that you can confidently use for a drop house- and that's because It's conclusive that no one Is occupying It 24/7. You will not find a "foreclosed home" with It's owners actively living there, so rest assured, It will always be vacated. The question you're about to ask Is: "I've never heard of It, so what exactly Is It?". I'll be more than happy to answer your concerns. When home owners cannot pay their monthly repayments on the mortgage for an extended period of time, their bank seizes their property and puts It up for sale. In other words, the bank wants to reclaim any financial loss they can, by advertising the home on the market for a quick sale and given the house has been taken over by the bank, It's empty awaiting to be sold.
It's not very common that you'll come across a foreclosed home In the vicinity of your current residential address, but they do exist and the way you locate one, Is very similar to the above topic pertaining to rental properties. When hitting a search via real estate sites, have a read of the home's description and If It's a foreclosed home, It will be listed as such- the agent cannot withhold any details, they are obligated by law to advertise the property for what It Is. The same applies when driving around- along with a huge "For Sale" sign stuck on a board at the front of the premises, there will be a "Foreclosure" (or some variant) notice next to It. As with online advertising, this Is a mandatory requirement, so there's no chance that It'll be mistaken for a home that's purely up for sale. What you've just read thus far, relates to "locating" a drop house and with the exception of foreclosed homes (that're always empty), It's of paramount Importance to "Identify" that your drop Is vacated, so let's have a look at a few ways to tackle It.
Identify A Drop House- Call The Landline Number:
Before I begin, I'd like to reiterate that everything you'll have the pleasure of reading from this point forward, Is relative to "Identifying" a vacant drop house, meaning how to be absolutely sure that no one Is occupying It and one of many ways, Is to call the landline number to see If anyone answers the phone. If they don't have a landline, move onto the next topic. Now you're probably thinking of how you're supposed to get the number when you only have a residential address to work with, but If you use some common sense, you'll find that It's a lot easier than you think. Stating the obvious, performing a Google search will return pages of results- especially for homes that're listed for sale or rent and If you look hard enough, there's bound to be a number documented somewhere In the article. Alternatively, reverse address lookups such as Spokeo or Intelius are very beneficial when looking for publicly available Information.
In terms of Identifying whether anyone Is home, It's not as simple as calling the number and waiting to see what happens next. It's vital to be selective with the "timing of your call"- as this will determine If Its occupants have In fact packed their bags and left, or still living there awaiting Its new owners. For example, It's human nature to be out and about during the daytime or early evening, like going to work, attending the mall for grocery shopping or having lunch with family and friends hence If you call during that part of the day, there may be no answer, but It doesn't necessarily mean that the house Is vacant. You've just chosen the wrong time to make your call. The best time to ring, Is late at night from 10:00 PM onwards, preferably at 11:00 PM or 12:00 AM. This will give you a very accurate Indication, but be sure to "make a few calls" and do It Monday to Thursday, and not Friday or Saturday. These are the days that people often go out to night clubs or restaurants, so you'd want to avoid It.
Identify A Drop House- Call The Real Estate Agent:
This Is a pretty simple process, so I'll get straight to the point. Almost every house that's advertised for sale or lease/rent, Is registered with a particular real estate agent, who's job Is to take care of the selling/leasing process by answering all queries and concerns from people who are Interested In the house In question. From a social engineering standpoint, this suits the SE'er perfectly, thus It Is very easy to get just about any Information by manipulating the agent In an unsuspecting and calculated fashion. You see, agents work on commission and get paid ex-amount of dollars per sale or rental agreement, so they'll go to just about any length to lock In a deal and finalize the contract. As such, they're more than happy to assist you, so give them a call and act as though you're prepared to buy/rent the property as soon as possible. Because you're (seemingly) In a hurry, ask the agent "how long It will take for the home owner to leave", and reassure him that you'll move In Immediately. If he replies with "It's not occupied", you can obviously use It as your drop address.
Identify A Drop House- Check The Mailbox:
Upon reading the title of this topic, you're probably under the Impression that It Involves some sort of Intrusion or forced entry to gain access to the mailbox, but It's nothing of the sort. In my years of physically SEing drop addresses to establish If any activity was present, "checking the state of the mailbox" Is one of my favorite methods, namely because there Is absolutely no risk whatsoever. So how does a "mailbox" determine If any household members are living there? Put your yourself on the receiving end for a minute. Do you completely neglect the postman (as he's putting letters Into your mailbox/letterbox) for days or perhaps weeks, or are you curious as to when your bills are due and the amount that needs to be paid? No doubt, you'd check and collect your mail every second day or so. This Is what deems a house that's occupied, hence when you're trying to Identify your potential drop, walk or drive by every few days or so for a duration of two or more weeks. If the mailbox Is full of brochures, letters and pamphlets, then that speaks for Itself- your drop Is ready to go!
Identify A Drop House- Using A Normal Residential Home:
As you're well and truly aware by now, the best option to use as a drop address Is a foreclosed home, but If there Isn't one available close to where you currently reside, the next port of call Is to opt for a rental house and In the absence of that, one that's listed for sale. But what happens when you've searched all of those entities to no avail? Well, that's when you target a normal residential property, however It's not as simple as choosing any house that comes to mind. There Is quite a bit of research Involved, and your selection must be done with pinpoint accuracy, thereby leaving nothing to chance. As a result, this Is the least-preferred method for a drop but nevertheless, If you strategically put the time and effort Into your research, you will accurately Identify whether It's unoccupied "when the carrier driver delivers your package" and I will show you precisely how It's done.
As a reminder, the owners are still living at the house, but It's your job to make sure they're not there when your package arrives and the way you do It, Is as follows. Carriers usually operate during business hours, and never deliver "very late at night" or In the "very early hours of the morning", thus you will use this to your advantage by targeting home owners who are actively employed on a full-time basis (You won't know this, until you perform your research which I'll cover shortly). As such, they're at work and away from home throughout the same/similar hours as per the carrier driver's delivery run, so the timing between both couldn't be more appropriate! For example (and from a legit perspective), how many times was your package redirected to your local post office, or your delivery was rescheduled because you were working and weren't around to accept It? The same applies to the occupants of your drop house- they will not be there from Monday to Friday (at the least), but you need to conclusively Identify this, which brings me to my next point.
As mentioned above, It's of the utmost Importance to "research your target" and the way you do It (In this case), Is to do some surveillance work by monitoring their movements throughout an entire week, preferably extended to a couple of weeks- just to be certain that their activities are In fact consistent. The objective Is to "Identify that the hours they're away from home, Is the same each and every day", hence they'll be absent when your package arrives. There's a couple of separate sessions Involved, with the first being to physically attend the house of a morning, and hang around In your car to see If they leave their home at the exact time everyday. You will do the same In the second session, but this time to Identify precisely when they arrive home. If your findings have established that they left and returned every day within the same time-frame, then they're employed, and you can go ahead and use the premises as your drop.
In Conclusion:
I'd say It's very safe to assume that you haven't heard of, nor come across using "foreclosed homes" as a drop house and the good thing about It, Is that there's no need to Identify If anyone resides there- the banks have repossessed It, so It's always vacant. Now that you've read this entire article, you have all the Information you need to locate a drop and "Identify If It's unoccupied", therefore there's very little to no reason why you'd encounter any difficulties. In closing, you only have one shot at getting your drop right, so be sure to cover all angles and apply yourself accordingly.
