# What a private mailbox is, and why a box cannot prove where you live

A PMB is a box at a mail-receiving agency, written the way USPS requires. What that spelling proves, why banks need a street address, and why no list exists.

Date: 2026-09-05

A private mailbox is a box rented from a business rather than from the post office. The business — the United States Postal Service calls it a commercial mail receiving agency, or CMRA — receives mail on its customers' behalf at its own street address, and each customer has a numbered box behind that address. Print shops, parcel stores, virtual-office providers and mail-forwarding services all run them. They are entirely legitimate, they are useful, and they are the single most commonly misread kind of address in any customer database, because on the page a private mailbox looks exactly like an office.

This guide covers what a private mailbox is, the addressing rule that makes it recognisable, why an address of that kind cannot do the job a bank needs an address to do, and why no product can honestly hand you a list of the agencies.

## The address is the agency's, the box is the customer's

The mechanics matter, because they explain everything else. A CMRA registers with the Post Office responsible for delivering to it: "Each CMRA must register with the Post Office responsible for delivery. Any person who establishes, owns, or manages a CMRA must provide PS Form 1583-A, Application to Act as a Commercial Mail Receiving Agency, to the postmaster" (Domestic Mail Manual 508.1.8.2, https://pe.usps.com/text/dmm300/508.htm, accessed 5 September 2026). Each of its customers then completes a PS Form 1583 naming themselves as an addressee at that agency.

So the delivery address is the agency's own street address. What separates one customer's mail from another's is a box number appended to it. That is the whole arrangement: one street address, hundreds or thousands of recipients, no relationship at all between the address and where any of them lives or works.

## The spelling is not a convention, it is a rule

Because the address belongs to the agency, the Postal Service requires the box number to be written in a way that cannot be mistaken for anything else. Publication 28 puts it plainly: "Mail sent to an addressee at a CMRA must include either the PMB identifier or the #, followed by the appropriate private mailbox number" (Publication 28 §285, https://pe.usps.com/text/pub28/28c2_040.htm, accessed 5 September 2026). The same section rules out the obvious substitute: "The words *POST OFFICE BOX* or *PO BOX* and the private mailbox number cannot be used on the Delivery Address Line."

The Domestic Mail Manual says it from the agency's side — "A CMRA must represent its delivery address designation for the intended addressees by the use of 'PMB' (private mailbox) or the alternative '#' sign" — and forbids folding the agency's own suite number and the customer's box number into a single element, giving `10 MAIN ST STE 11-234` as the thing not to write (DMM 508.1.8.3).

That rule is the reason a private mailbox is detectable at all. `2261 Market St PMB 4321, San Francisco, CA 94114` is not an ordinary street address that happens to have a number on the end; it is an address written the way the Postal Service requires a mail-receiving agency's customer to be addressed. Spaw reads exactly that, and answers `address_type: private_mailbox` with `address_type_source: address_rules`, lifting `PMB 4321` out of the street line into `unit`. You can watch it happen on the [free postal address checker](/tools/address-checker).

## Why a bank needs a street address

United States banks must run a customer identification programme, and the rule spells out what an address means for that purpose. For an individual, the bank must obtain "a residential or business street address"; only where the person has none may it fall back to "an Army Post Office (APO) or Fleet Post Office (FPO) box number" or "the residential or business street address of next of kin or of another contact individual". For a customer that is not an individual, it must obtain "a principal place of business, local office, or other physical location" (31 CFR 1020.220(a)(2)(i)(A)(3), https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1020/subpart-B/section-1020.220, accessed 5 September 2026).

Read the text closely and the logic is clear. The requirement is not for an address that receives post; it is for a physical location associated with the customer. A post-office box is not a street address at all, and the only box the rule accepts is a military one, for people who genuinely have no other. A private mailbox is a street address — but it is the agency's location, not the customer's, and a box at a mail-receiving agency is neither the customer's residence nor their place of business.

None of this makes a box address a bad address. It makes it the wrong evidence for one particular question. A box is an excellent way to receive post, a perfectly ordinary thing for a small business to use, and a terrible answer to "where is this person?".

## Why nobody can sell you the list, honestly

The obvious way to catch an agency address would be a list of agencies. There isn't a public one. Registration goes to the postmaster responsible for delivery, and the resulting records live in what the Manual calls the USPS CMRA Customer Registration Database — an internal system, not a published register. Nothing in the addressing standards points at a downloadable directory of agencies, because none is published.

That has a consequence worth stating out loud when you are comparing address products. A flag that claims to identify every mail-receiving agency is either licensed from the Postal Service under an agreement that keeps it query-only, or it is a guess dressed up as data. Spaw does not carry such a list. What it carries instead are two things it can stand behind: the addressing rule above, and the branch addresses that mailbox operators publish themselves. When an address matches one of those published lists, `mail_drop_provider` names the operator; when it does not, the flag says so rather than inventing a match.

## What the answer means, and what it does not

- `address_type: private_mailbox` means the address is written the way a mail-receiving agency's customer must be addressed. It is a reading of the address, not a claim about a company or a person.
- `is_private_mailbox: false` is a checked negative in a country whose box naming is carried; `null` means nothing was evaluated there. Null is never "no".
- An agency address written *without* the box number reads as an ordinary street address, and the answer says so. That is a real limit of reading the spelling, and it is a better failure than a fabricated match.
- The `private_mailbox` risk signal adds 60 points, the largest weight any open signal carries, because an address of this kind is the least likely to be somebody's own front door. It is not an accusation, and the arithmetic is published so you can disagree with it.

## What to do with it

- **In identity and onboarding flows**, treat a box — post-office or private — as a mailing address, not a location. Ask for a street address separately when the rule you are subject to needs one, and say why; people who use a mailbox are used to the question.
- **In shipping and fulfilment**, do the opposite: a private mailbox is often the *best* address a customer has, and refusing it loses good orders. What matters is that couriers who do not deliver to agencies know in advance.
- **In fraud review**, use it as a signal about a place and combine it with everything else. On its own, "this is a mailbox" describes a large number of legitimate freelancers, expatriates and small companies.
- **Never store it as a fact about a person.** The response deliberately carries no field saying who lives or works anywhere, and nothing here should be written into a customer record as if it did.

## What to do next

- Run an address through the [free postal address checker](/tools/address-checker) and watch the box number move out of the street line.
- Read the [address verification guide](/docs/address-verification) for every field, the nine address types and the published risk weights.
- Check the request and response shapes on the [POST /api/v1/address reference](/docs/api/validate-address).
- See what the register half of the answer can and cannot prove in [how to read an address-existence answer](/guides/how-to-read-an-address-existence-answer).

Reference: https://spaw.co/guides/what-a-private-mailbox-is-and-why-a-box-cannot-prove-where-you-live