262,000 suspicious mail items in 2021.   6,300 threats  —  are you prepared?

Download our Annual Mail Security report.

Mail Threat Alert - OctoberAugust September July 2020

Dangerous Mail Report Download

In large corporate mail centers, small offices, and everything in between, the process of visually screening the mail is similar — and it carries the same risk.


Visual & Tactile Mail Screening Techniques

Proper mail handling starts with the understanding that, based on well documented historical evidence, almost all threat-related mail shows one or more identifiable traits.

These traits are so predictable that the United States Postal Service published them on its Poster 84 publication.


How to Screen Mail

While poster 84 shows us what to look for, it does not provide the HOW. That is where we apply the basic principles of physical mail screening.

To start, let’s discuss the workspace, safety, and supporting equipment while conducting the visual screening.

Workspace: For letters, choose an area that is free of clutter and is not located directly under a heating or cooling vent or fan.

Having a designated area for processing mail is helpful but not always realistic.

Whatever space you are using, make sure it provides adequate space to examine and open letters, flats, and small packages.


Screening Personnel Safety

Mail, even when it does not contain a threat is dirty.

We strongly recommend you wear nonpowdered nitrile gloves whenever you are handling or opening mail.

Gloves are a low cost, highly effective way of preventing contamination and are available at almost any drug or big box store.  While they come in a variety of sizes, most facilities select the one size fits all variety.  They should be disposed of when you are finished screening or opening mail.    We recommend blue or black since powders and contaminates will be more obvious on these surfaces.

Your work center may also recommend or require that you wear an N-95 mask.   If required, try and select one with a purge valve.  This works better with glasses and is less restrictive.


Screening Area

With regard to tools and the work surface, we recommend using either a piece of black mat board which can be disposed of when dirty, or a self-healing cutting mat.

The self-healing cutting mats come in a variety of sizes and offer the benefit of easy cleaning and a scale that can be very useful if your protocol requires you to photograph suspicious letters.


Screening Tools

You will also need some basic tools. A free-standing tape dispenser, flashlight,  date-time stamp, and letter opener.

Avoid traditional letter openers that rip and opt for the type that contains an enclosed blade.

A pair of scissors, small bulldog clips, and a staple remover are also helpful.

Be sure there is room for these tools in your immediate work area, and that these tools are designated to the work station that screens and or opens mail to avoid cross-contamination.



Be sure the area has sufficient light.

In most cases, small spills are first detected on the work surface. Having a good light source helps identify such spills.

We recommend bulbs in the 5,000-5,600K range.

Be sure the lights are shielded so as not to interfere with your vision.

In addition to the light associated with the workstation, a handheld flashlight is also useful.

Using this to provide low-level side lighting of the surface can help detect contaminants that would otherwise not be visible.


Screening Techniques

First, take your time.

As noted in poster 84, mail-borne threats often share the same visual traits.  Know them and be on the lookout for them.

Rushing through the screening process, or making assumptions, can and will lead to missed indicators.


Outward Signs

Many teams start by examining the letter’s thickness, weight, stiffness, and balance.

Thickness is a key indicator that something is different.

If your department normally receives letters that are the same weight and thickness, and you suddenly find yourself holding an exceptionally thick or heavy letter; stop and give it a bit more scrutiny.

It is not at all unusual for a disgruntled customer to use a prepaid return envelope to send a multi-page, threatening rant.

Even if everything else about the letter is normal, irregular size and weight alone should be enough to get your internal alarm bells ringing.



Next, run your hands along the edges, powders and foreign objects tend to settle toward the bottom of the envelope.

Tap the envelope against the work surface then feel along the edges;

Feel something? Say something.


Visual inspection of Front of Envelope

Now examine the front of the envelope. Start with the postage.

  • Are the stamps properly canceled and the envelope postmarked?
  • Excessive postage?

Next, look at the return address,

  • Do the postmark and return address match?

While non-matching return addresses and postmarks are common, it is when combined with other factors that they are indicators of potential problems.

Continue with your examination of the return address.

  • Is the return address complete, with matching name, address, ZIP code?


Addressee Information

Why is addressee information last? Because it allows you to actually focus on what it says.

Mail handlers and admins are so used to the individuals within their organizations that names that are misspelled, mistitled, and even marginally close get sorted, delivered, and opened without much thought.

At normal speed, your eyes see one thing but your brain, out of habit, sees something else — in this case, close is not enough.

Examine the remainder of the front of the envelope.

  • Are there any admonishments or warnings such as “eye’s only” or “personal”?
  • Are there any obvious wet spots, leaks, or stains?
  • Does the handwriting or choice of writing instrument seem strange or out of place?

Crayon, sharpie, and even pencil are not normally used for business correspondence.


The Back of The Envelope

  • Examine the seal; Is it taped and if so is the tape being used to close edges that would normally be open?
  • Are there any statements or warnings written on the letter?
  • Turn the envelope on its side and tap it against the surface of the table.  Powder or other reside on your work surface indicates a potential problem and may require the initiation of your facility’s suspicious mail handling protocols.



Flats can be examined using the same basic techniques, just be aware that it is not unusual for such envelopes to contain bulk documents, publications, or in these days, Amazon, items ordered online.

Here is where common sense pays off.

If concerned, contact the addressee and see if they are expecting a package from the indicated vendor.

If not, don’t hesitate to initiate your facility’s suspicious package protocols.


Item Forwarding

If you are working in the mail center or other sorting station and nothing suspicious was detected, you are now ready to send the item forward.

However, this is not the end of the screening process.

Regardless of the indicators on poster 84, many threats are not detected until the letter, flat, or package is opened.

Please note, the following steps are recommendations only, your organization should develop and implement specific mail opening protocols for you to follow.

That being said, here are the steps that are most commonly followed when opening parcels or envelopes.


Unsealing Parcels or Packages

Being sure that the envelope is centered over the work surface, place it so that the flap is facing up.

Insert the opener and, while keeping the envelope flat on the work surface, slide the opener away from you while opening the letter.

Keeping this action smooth will help prevent anything inside the envelope from becoming airborne.

If you note anything spilling from the envelope, stop, and leave the opener and letter flat on the table.

Execute your organization’s mail-borne threat response plan.


Opening Parcels

If nothing is noted during the opening process, turn the envelope up and open it.

Examine the contents prior to removing them. Here is where a flashlight can be helpful. If nothing is noted, remove the contents and sit them on the work surface.

Examine the envelope one more time checking for residue, moisture, or stains. Carefully unfold the contents of the letter, look for signs of residue, moisture, or stains.

Finally, if authorized, verify that the information contained within the document does not contain threats or concerning information.


Examine Contents

Package screening is much the same as letters, with the addition of needing a larger work surface, and knife or scissors, to cut through packing tape.

Once open, examine the tape for powder residue then open the flaps and examine the interior of the package.

If during the opening process you come across wires, circuit boards, batteries, or other electronics or materials that are not expected, stop and initiate your suspicious package protocols.


Remove Contents

Carefully remove the contents of the package and set them on the work surface.

Examine the interior of the empty box.

If substances are found that cannot be associated with the legitimate contents of the box, execute your organization’s safety and security protocols.


Indicate Opened-By

Finally, most organizations require that materials that are opened away from or without the knowledge of the addressee should be photographed, date time-stamped, and initialed.


USPS Poster 84.

Poster 84 from USPS

Poster 84 provides detailed information on traits common in the majority of threatening letters and packages.

These traits,  graphically depicted on the poster, provide mail center and administrative personnel with a visual reference that they can refer to when handling incoming mail.

To acquire a copy please contact us, we will gladly send one to you.



The processes stated here are recommendations.

Your organization should develop and institute specific mail handling, screening, opening, and suspicious mail response policies.

For more information on how we can help design these plans with you please contact RaySecur’s training team.