With the advent of the information age, the express delivery industry has developed rapidly, which has promoted the transformation of circulation methods and the consumption upgrading. While enjoying the tremendous convenience of the development of the express delivery industry, people are also facing uncontrollable liquidity risks, and serious challenges are posed to public safety. For example, stolen goods are sold by express delivery, and dangerous goods such as drugs and explosives are transported by express delivery. Given the abovementioned considerations, we focus on the crimes of using express delivery to deal with stolen goods based on the analysis of actual historical records of express delivery, and then take the identification of such criminal suspects as the research target to conduct detailed analysis from the aspects of statistics, time, and geography. In addition, we also present a twostep anomaly detection method for suspect identification. The first step is to filter normal users, and the second step is to identify suspects. Experimental results show that in comparison with traditional methods, this method can accurately identify suspects, effectively solve the problem of positive and negative data imbalance, and significantly reduce false detection rate. Therefore, it has high practical value.