Figuring out who sent you an anonymous letter starts with treating the letter as evidence, reading everything it tells you about its sender, and deciding whether the content justifies bringing in postal inspectors, police, or a licensed investigator. The approach that works depends on whether the letter is merely unwelcome or genuinely threatening, and on whether it arrived on paper or through a screen.
Preserve the Letter Before You Do Anything Else
The most common mistake is handling the letter repeatedly, showing it to friends, and then stuffing it in a drawer. Every touch deposits skin cells and can smear the sender’s fingerprints or DNA. Treat it as evidence from the moment you realize what it is.
Put on clean disposable gloves before touching it again. Place the letter and the envelope in separate paper bags or clean envelopes; plastic traps moisture and degrades biological material. If you already handled it bare-handed, note that for any future investigator rather than assuming the evidence is ruined. Usable prints and DNA survive casual handling more often than people expect.
Write down when it arrived, how it was delivered, who has touched it, and where it has been stored. That record is your chain of custody, and gaps in it can get evidence excluded from court.1National Institute of Justice. Law 101: Legal Guide for the Forensic Expert – Chain of Custody Photograph the letter, both sides of the envelope, and the postmark before you store it.
Read the Physical Clues
The letter itself is usually the richest source of leads. Start with what you can see, then decide whether professional analysis is worth paying for.
Handwriting and Printer Marks
If it’s handwritten, a forensic document examiner can compare it against known writing samples from suspected senders. Examiners look at letter formation, pen pressure, and spacing habits that are hard to disguise consistently, and courts have long accepted this kind of analysis.2Justia. United States v. Saelee, 162 F Supp 2d 1097 (D Alaska 2001) A certified examiner typically charges between $300 and $2,500 for a single-sample analysis, depending on complexity and whether you need a court-ready report.
Typed letters carry clues too. Laser printers embed nearly invisible tracking dots that encode the printer’s serial number and a timestamp. Inkjet printers produce identifiable patterns from nozzle wear. A forensic lab can sometimes match a printed document to a specific device if investigators have that device to compare it against.
The Postmark
The postmark shows the ZIP code area where the letter entered the postal system. That alone can narrow the search significantly. If you live in a small town but the postmark shows a distant city, the sender either lives there, traveled through, or mailed it from there specifically to mislead you. Unusual stamps, metered postage, or business-rate markings can also point toward a particular kind of sender.
Fingerprints and DNA
Fingerprints can be lifted from paper, though civilian access to fingerprint databases is extremely limited, so this route usually requires law enforcement. Latent prints on paper are harder to recover than prints on smooth surfaces, but forensic labs have techniques for both.
DNA is often the more promising lead. Saliva on envelope seals and stamps is the classic source, and even “touch DNA” from skin cells left on the paper can produce a profile. Recovery success varies with paper type and collection method.3National Center for Biotechnology Information. Touch DNA Sampling Methods: Efficacy Evaluation and Systematic Review Private labs can process samples, but a profile only helps if you have a suspect’s DNA to compare against or if it matches someone already in a law enforcement database.
If the Message Was Digital, Follow the Metadata
When the message arrived by email, social media, or a messaging app, the investigation moves to digital forensics. Digital communications generate automatic records that paper letters don’t.
Email Headers
Every email carries header data most people never see. The full headers record the IP addresses of servers the message passed through, timestamps, and sometimes the sender’s originating IP. In most email clients you can view full headers through the message settings or properties menu. A digital forensics professional can trace those headers back toward the sender’s device, or at least their internet provider.
An IP address identifies a network connection, not a person. It tells you which provider and roughly which geographic area the message came from. Getting the subscriber’s name behind the IP requires a subpoena or court order aimed at the provider.
Getting a Provider to Disclose the Subscriber
Federal law sets a tiered system for accessing stored communications. Under the Stored Communications Act, the government can obtain basic subscriber information like name, address, and IP logs with a subpoena. A court order is needed for more detailed transactional records. Message content stored for 180 days or less requires a full search warrant.4Office of the Law Revision Counsel. 18 US Code 2703 – Required Disclosure of Customer Communications or Records Private citizens can’t issue subpoenas themselves, but an attorney can file a civil suit against a “John Doe” defendant and subpoena the provider for identifying information as part of that litigation.
When the Sender Used a VPN
A sender who used a VPN, Tor, or a disposable email account is significantly harder to trace. VPN providers route traffic through their own servers, masking the real IP address. Many advertise “no-log” policies. What matters in practice is what the provider actually retains when a legal request arrives; billing records, account creation details, and connection metadata may still exist at companies that market themselves as privacy-first. The provider’s home jurisdiction matters too, because companies based outside the United States may be beyond the practical reach of a domestic subpoena.
None of this makes a sender untraceable. Investigators sometimes work around VPNs by identifying senders through account registration details, writing style, timing correlations, or mistakes made before or after using the VPN.
Work Backward From What the Letter Knows
Forensic analysis isn’t always available or affordable. Often the most productive move is working backward from the letter’s content to figure out who had the knowledge, motive, and opportunity to write it.
Pay close attention to what the letter reveals about its author. References to your workplace, personal relationships, daily routine, or private disputes shrink the pool sharply. If the letter mentions something only a handful of people would know, the investigation practically narrows itself. Write down every specific detail and ask who had access to that information.
Then look at timing. Letters rarely arrive in a vacuum. If yours showed up shortly after a workplace conflict, a breakup, a neighborhood dispute, or a public event, that timing is a strong lead. Circumstantial evidence like timing can be as valuable as direct evidence in building a case.5Justia. Holland v. United States, 348 US 121 (1954)
Compare the Writing to People You Suspect
The way someone writes is harder to disguise than most people realize. Word choice, sentence structure, spelling quirks, and idiomatic expressions form a kind of linguistic fingerprint. Forensic linguists compare these patterns across documents to identify or exclude potential authors.
You don’t necessarily need a professional to do this at a first pass. Pull emails, texts, or social media posts from anyone you suspect and read them alongside the anonymous letter. Distinctive errors, pet phrases, or unusual word choices can be as telling as a fingerprint.
The U.S. Postal Inspection Service
Most people don’t know the U.S. Postal Inspection Service exists, but it’s the federal law enforcement arm for crimes involving the mail. If a letter contains threats, extortion demands, or anything that makes you fear for your safety, USPIS has jurisdiction and investigative resources that go well beyond what local police can offer for mail-based crimes.6United States Postal Inspection Service. Threatening Letters and Cyberbullying
To report threatening mail, file a report at uspis.gov/report or call 1-877-876-2455.7United States Postal Inspection Service. Report a Crime If you believe the letter contains a dangerous substance or is a mail bomb, call that number and say “Emergency,” or dial 911. Don’t open suspicious packages.
One tool postal inspectors can use is a mail cover, which records information appearing on the outside of mail sent to or from a particular address. Mail covers can be authorized to obtain evidence of a crime, locate a fugitive, or assist an ongoing investigation.8eCFR. 39 CFR 233.3 – Mail Covers If investigators expect more letters, a mail cover on your address can capture return information or originating postmarks in real time.
When to File a Police Report
Not every anonymous letter warrants a police report. Several categories do: a direct or implied threat of violence, demands for money, sexual content or images, references to stalking or surveillance of your movements, or any indication of a crime being planned or confessed. Police can obtain warrants and subpoenas, run prints and DNA against criminal databases, and coordinate with postal inspectors and internet providers in ways private citizens cannot.
Even when the letter doesn’t clearly cross into criminal conduct, filing a report creates an official record. If more letters follow or the situation escalates, that documented history strengthens any later legal action. Detectives who work harassment cases can usually tell you quickly whether your letter looks like a one-off annoyance or something worth active investigation.
Hiring a Private Investigator
A licensed private investigator can be worth the expense when law enforcement isn’t treating your case as a priority. PIs have access to commercial databases, skip-tracing tools, and surveillance techniques that aren’t available to the general public. They can cross-reference the physical and contextual clues you’ve gathered, run background research on suspects, and interview witnesses.
Expect to pay between $95 and $200 per hour for standard investigative work. Specialized services like digital forensics, or cases requiring surveillance in expensive metro areas, run higher, sometimes $300 to $500 per hour. Many investigators also require an upfront retainer, commonly $1,000 to $5,000 depending on the expected scope. Before hiring anyone, confirm the investigator holds a valid license in your state; almost every state requires one.
PIs have real legal limits. They cannot wiretap, access sealed records, hack email accounts, or impersonate law enforcement. Federal law prohibits using deception to obtain someone’s financial records from a bank or their phone records from a carrier. An investigator who breaks these rules produces evidence that becomes unusable in court and exposes both of you to criminal liability.
Once You Know Who Sent It
Identifying the sender is only half the job. Several tools can stop the behavior and hold the person accountable.
A cease and desist letter from an attorney puts the sender on notice that their conduct has been identified and demands it stop. The letter itself isn’t a court order and carries no direct penalty. Its real value is creating a written record that the sender was told to stop. If letters continue after that, the cease and desist becomes powerful evidence in a harassment case or a restraining order application.
If the letters form a pattern of harassment or threats, you can petition a court for a restraining order or protective order. Most jurisdictions require you to show repeated unwelcome conduct that would cause a reasonable person to feel fear or emotional distress. Filing fees for civil harassment protective orders typically range from $0 to $450 depending on the jurisdiction, and many courts waive fees in cases involving threats or stalking.
If you haven’t yet identified the sender, some courts let you file against a “John Doe” and use the discovery process to subpoena service providers or other third parties for identifying information. Once you learn the sender’s identity, the case is amended to name them.
Depending on content and impact, you may also have grounds for a civil suit alleging defamation, intentional infliction of emotional distress, or tortious interference with business relationships. Civil litigation carries subpoena power during discovery, which is often the most effective way to force email providers or other intermediaries to reveal a sender’s identity.
Anonymous Speech Is Sometimes Protected
Before pushing hard to unmask a sender, know that anonymous speech has strong constitutional protection in the United States. The Supreme Court has held that the freedom to publish anonymously is protected by the First Amendment, calling anonymous pamphleteering “an honorable tradition of advocacy and of dissent” and “a shield from the tyranny of the majority.”9Justia. McIntyre v. Ohio Elections Commission, 514 US 334 (1995)
The protection has limits. Anonymous speech loses its First Amendment shield when it becomes a true threat, meaning a serious expression conveying an intent to commit violence. It also loses protection when it crosses into extortion, blackmail, or certain categories of criminal harassment. But a letter that merely criticizes you, shares an unwelcome opinion, or says something rude is almost certainly protected speech. A court asked to unmask an anonymous speaker will weigh the First Amendment interest in anonymity against the strength of your legal claims, and weak claims lose that balance. If the letter is offensive but not threatening or defamatory, your options for forcing disclosure are narrow.