If you signed PS Form 1583 naming a mailbox company as your agent, USPS delivers your mail to that agent. In our reading, the two federal mail statutes punish taking mail before delivery, and stealing it. What the company opens after delivery is set by the service terms you accepted.
The question has three layers, and each layer comes from a different text. Federal law describes acts that are punished. PS Form 1583 names who receives your mail. The agreement you sign with the company covers what happens to a piece after it arrives. None of the texts we read lists who is "allowed" to open mail, so this post shows each layer and marks where our own reading begins.
A virtual mailbox is a private mailbox at a commercial mail receiving agency (CMRA), the business that receives your mail. We read two sections of Title 18 of the United States Code, 18 U.S.C. § 1702 and § 1708, and the June 2024 edition of PS Form 1583. We also read section 1.8 of Domestic Mail Manual (DMM) 508 and two U.S. Postal Inspection Service (USPIS) pages. All of it was read on October 30, 2026. We sell virtual mailboxes, and the section before the FAQ gives our own policy. This post isn't legal advice.
What the two federal mail statutes forbid
Both sections sit in Title 18 of the United States Code. The first, 18 U.S.C. § 1702, is titled "Obstruction of correspondence." The whole section is a single sentence:
"Whoever takes any letter, postal card, or package out of any post office or any authorized depository for mail matter, or from any letter or mail carrier, or which has been in any post office or authorized depository, or in the custody of any letter or mail carrier, before it has been delivered to the person to whom it was directed, with design to obstruct the correspondence, or to pry into the business or secrets of another, or opens, secretes, embezzles, or destroys the same, shall be fined under this title or imprisoned not more than five years, or both."
In our reading, the sentence stacks three things in order. First comes the act: taking a letter, postal card or package out of a post office, an "authorized depository," or from a letter or mail carrier. Second comes the time: "before it has been delivered to the person to whom it was directed." Third comes the purpose or the further act: a design to obstruct the correspondence or to pry into someone's business or secrets, or opening, hiding, embezzling or destroying the piece. The penalty is a fine, prison for up to five years, or both.
We counted words in the section. "Opens" appears once, in that list of acts. "Delivered" appears once. "Authorized" appears twice, both times in "authorized depository." "Agent," "consent," "1583" and "CMRA" appear zero times. So the section never speaks of an agent the addressee has chosen. Its time marker is delivery to the person the mail was addressed to.
The second section, 18 U.S.C. § 1708, is titled "Theft or receipt of stolen mail matter generally." Its first paragraph reaches whoever "steals, takes, or abstracts, or by fraud or deception obtains" mail from a post office, a mail receptacle, an "authorized depository for mail matter," or a carrier. The same paragraph reaches whoever "abstracts or removes from any such letter, package, bag, or mail, any article or thing contained therein." A later paragraph covers whoever "buys, receives, or conceals, or unlawfully has in his possession" such mail, "knowing the same to have been stolen, taken, embezzled, or abstracted." The penalty line reads: "Shall be fined under this title or imprisoned not more than five years, or both."
The word "open" doesn't appear in § 1708 at all, and neither does "agent." In our reading, § 1708 covers theft, fraud, and taking things out of mail, while § 1702 is the section that names opening. USPIS Publication 146, the agency's guide for law enforcement, lists the second section under the heading "Theft of Mail (18 USC 1708)."
USPS ties both sections to the physical mailbox where mail is delivered. Apart from the exclusions listed in DMM 508.3.1.2, DMM 508.3.1.1 says every letterbox or other receptacle used for mail delivery on a route "is designated an authorized depository for mail within the meaning of 18 USC 1702, 1705, 1708, and 1725."
Neither section lists who is allowed to open mail. Both describe acts that are punished. So the answer to the question in the title has to come from two other places: the form that tells USPS where to deliver, and the contract you sign with the company.
What PS Form 1583 authorizes, and what it leaves out
PS Form 1583 is the USPS form every mailbox customer signs. Its title is "Application for Delivery of Mail Through Agent." The form's own definitions say: "Agent: The Commercial Mail Receiving Agency (CMRA)." Our post on what a CMRA is covers the term, and what a CMRA can and cannot sign for.
The agreement on page 2 begins "In consideration of delivery of my mail or our firm's mail" and then names the agent and five numbered duties. The five duties cover change-of-address orders, transfers to another address, new postage on remailed pieces, the transfer addresses the agent gives USPS, and a new application when information changes. The Privacy Act Statement on the same page says the information will be used, among other things, "to permit delivery of your mail to your authorized agent." Our post on whether a virtual mailbox can deposit checks reads the same agreement for checks. Here we read it for opening.
The form names several kinds of people besides you. The agent is the CMRA itself. An "Authorized employee" is "An employee of the CMRA who is authorized to act on the CMRA's behalf." An "Authorized individual" is a person "authorized to pick up mail" for the box holder, listed in item 5, and footnote 5 says the applicant "authorizes mail to be collected by the individual noted in item 5." Item 12, for business use, lists other members who will receive mail at the box, and each of them must show two forms of ID if the Postal Service asks.
We counted words across both pages of the June 2024 form, in the text we extracted from the PDF. "Open" appears 0 times as a whole word. The only partial match is "1a. Date PMB Opened," the date the private mail box (PMB) was opened, which has nothing to do with opening a letter. "Scan," "scanned," "read," "forward" and "inspect" appear 0 times as whole words. "Delivery" appears 9 times, and "deliver" as part of a longer word 11 times. Forms of "authorize" appear 23 times, 9 of them in the page 1 labels for the authorized individual and the authorized employee. Where the form says what mail handling is being authorized, the object is mail being collected, mail being picked up, or "all mail delivered to the agency under this authorization", which must be prepaid with new postage when it is mailed again.
In our reading, the form hands one thing to the company: delivery of your mail, with the collection and pickup that follow. The form doesn't say the company may open your mail, and the form doesn't forbid opening either. Opening and scanning sit outside the form, in the agreement between you and the company.
Two more lines on the form matter here. You sign in the presence of the agent, or its authorized employee, or a U.S. notary, in person or by live audio and video. The agent then uploads the signed form to the USPS CMRA Customer Registration Database and keeps a copy, and that copy "must at all times be available for examination by the postmaster (or designee) and the Postal Inspection Service."
What USPS rules say once a CMRA has your mail
USPS rules for mailbox companies are in DMM 508, section 1.8. Section 1.8.1 defines a CMRA as a business that accepts delivery of U.S. Mail for another person or entity, as a service. Section 1.8.2 says the CMRA accepts delivery and then holds the mail for pickup or remails it with new postage.
The section is about receiving. A separate PS Form 1583 is required for each addressee of a private mail box for residential or personal use. The CMRA keeps at least a digital copy, and the form "must be available at all times for examination by Postal Service representatives and Postal Service inspectors." A CMRA "may not refuse delivery of mail" for a customer or a former customer within the past 6 months. When no form is on file for a name, the CMRA must return the piece to the Post Office.
Our post on how a virtual mailbox works counted the words in section 1.8: "must" appears 63 times, and "photo," "open" and "shred" appear zero times. We checked the same section on October 30, 2026, and those counts still hold. For this post, the point is that section 1.8 decides who may receive mail at the box and never uses the word "open" for what the company does afterward. One line elsewhere in DMM 508, on mail that needs a signature, says such a piece can't be opened or handed over before the recipient signs for it, unless an electronic signature is used. Our CMRA post covers that rule.
Two more lines in section 1.8 matter. The customer gives a remail address on the form, or an email "if correspondence is scanned for digital delivery". So section 1.8 knows that scanning for digital delivery exists, and it doesn't say when a company may do it. And the Chief Postal Inspector or a designee "may issue an emergency mail-withholding order" against a box holder suspected of using the box for "any activity that violates United States Code Title 18 or Title 39". Title 18 is where § 1702 and § 1708 sit.
A common claim online is that a virtual mailbox is "legal," and that this settles the matter. That claim is about the address. Whether a CMRA address itself is allowed is a different question, and our post on whether your mailing address is a PO Box answers it in its FAQ.
How the three texts fit together
The table puts the texts side by side and shows what each one says about opening.
| Text | What the text does | What the text says about opening |
|---|---|---|
| 18 U.S.C. § 1702 and § 1708 | Punish taking mail before delivery or prying into it, as well as theft and fraud, and removing contents | "Opens" appears once, in the § 1702 list of punished acts; "agent" appears 0 times in both sections |
| PS Form 1583 (June 2024) | Authorizes delivery of your mail to the agent, and collection or pickup by the people you list | "Open" appears 0 times as a whole word |
| DMM 508, section 1.8 | Sets who may receive mail at a CMRA, which form must be on file, when mail goes back to the Post Office, and the 6-month rule for former customers | "Open" appears 0 times, per the count in our how-it-works post |
| Your service agreement | Sets what the company does with a piece after it arrives | The place where "open," "scan" and "shred" are defined |
In our reading, the order is this. You sign the form, USPS delivers to the agent, and the agent is the company. After that point, none of the three public texts uses the word "open" for the company's handling, and your agreement does. So two customers of two companies can get different treatment, and both companies can be inside their own terms.
Defaults differ. Stable's pricing page, quoted in our roundup of virtual mailbox services, says it will open and scan mail "automatically or on request" within a monthly count. Anytime Mailbox's renter terms, quoted in our post on how long virtual mailboxes keep mail, start a ten-day clock once a scanned item is available, after which the operator may destroy the paper. Both are contract terms, and both are things a customer agreed to at signup.
Before you sign with any provider, get answers to three questions in writing.
- What triggers opening: my request for one piece, or every piece automatically?
- What happens to the paper after a scan, and after how many days?
- Which names are on my Form 1583, in item 5 and item 12, and who else can collect the mail?
What to do if a company opens mail you didn't ask it to open
We can't say whether any particular act is a crime. What we can show is where USPS tells people to go. The USPIS report page says: "Report suspected mail theft, and other mail-related crimes, tips or incidents" through its online form at report.uspis.gov. The same page says "Or call USPIS: 1-877-876-2455" and "Call 911 to report an active crime in progress." If the person you suspect is a USPS employee, the page tells you to contact OIG, the USPS Office of Inspector General, instead.
Before you report, read your agreement. If you turned on automatic scanning, or the terms open every piece by default, the company may be doing what you signed. The USPIS pages we read give the reporting channels and don't define which acts count as mail theft.
How Auteur handles opening your mail
We sell virtual mailboxes, so this is the seller's view. Auteur is in pre-launch, and your exact street address is assigned the day your city opens. Our rule on opening is in our fair use policy, which says: "Opening and scanning is the one action we charge for: a flat fee per piece, only when you ask for it, and the piece comes back as a searchable PDF with Henry's summary and translation attached." The same policy lets you turn on automatic scanning for everything that arrives, with the same per-piece fee. Every piece gets an envelope photo when it arrives, and legal and tax mail is never destroyed automatically.
The Virtual Business Address receives mail in a business or trade name. Choose it for letters addressed to a company, a DBA (doing business as) name, or any other trade name. The Virtual Mailing Address is for personal mail, in individual names only.
Both plans photograph the envelope of every piece, and we open and scan only when you ask, for one flat fee per piece. Henry, our AI assistant, explains each letter you ask us to open. USPS Form 1583 is required before any provider can receive mail for you. Pricing comes by email with the next steps, and our fees and limits are in our fair use policy.
If your mail comes to a business name, get your Virtual Business Address. For mail in your own name only, choose the Virtual Mailing Address. Ordering is free, there's no card, and nothing is charged today.
FAQ
Can a virtual mailbox legally open my mail?
We can't give a legal answer for your case. The texts we read work in three layers. 18 U.S.C. § 1702 punishes taking mail before it reaches the addressee, with design to obstruct or pry, and opening, hiding, embezzling or destroying it. PS Form 1583 authorizes delivery of your mail to the agent. Your service agreement sets whether the company opens a piece on request or by default. In our reading, a company that opens a piece you asked it to open is acting inside that agreement.
Who is legally allowed to open your mail?
None of the texts we read gives an allowed list. The two statutes describe punished acts. PS Form 1583 names who receives: the agent, which is the CMRA, its authorized employees, an authorized individual who may pick up mail, and people listed in item 12. What any of them may do with a sealed piece after delivery comes from the agreement you signed with the company.
Does PS Form 1583 give the mailbox company permission to open my mail?
The form doesn't address opening. We counted both pages of the June 2024 form: "open" appears 0 times as a whole word, and the only partial match is "Date PMB Opened." The form authorizes mail delivery, and the collection and pickup that follow. Opening and scanning come from the company's terms, so read those before you sign.
What should I do if my virtual mailbox opened a letter I didn't ask it to open?
Read your terms first, because an automatic-scan default may be what you signed. If you believe a crime occurred, USPIS says to report suspected mail theft and other mail-related crimes online at report.uspis.gov or by phone at 1-877-876-2455, and to call 911 for a crime in progress.
This post explains two federal statutes, a USPS form, USPS mailing standards and our own published policy. The post isn't legal advice.
Bottom line
The two federal mail statutes punish taking mail before delivery and prying into it, and they punish theft and removal of contents. Neither one lists who may open mail. PS Form 1583 authorizes delivery of your mail to the agent, and the word "open" appears 0 times in it as a whole word. USPS rules for CMRAs set who receives mail, and section 1.8 never uses the word "open." In our reading, what a company does with a piece after it arrives comes from the agreement you signed, so read the default before you sign.
