As online sales in the UK rose by 3.6% in 2017, there is an ongoing need for online retailers to enhance their customer experience and in turn sustain rapid growth. This is where recognising customer satisfaction as a key driver of retention is critical.

Many online retailers have implemented generous refund or replacement policies to help improve the customer journey and generate loyalty, but unfortunately, these policies can be susceptible to various forms of merchant abuse.

Refund fraud is a pervasive form of merchant abuse in which an actor purchases a product from an online store and has it shipped to their home or a drop site. After delivery, the actor falsely claims that the product never arrived, prompting the company to issue a refund. Thus, the fraudster receives their chosen product at no cost.

Research shows that online retail businesses lose approximately £500,000 per month due to fraudulent refunds. The potential loss when you take into consideration fraudulent vouchers, fake goods and account take over, almost doubles.

Cyber criminals’ capabilities are further advancing with digitalisation and they are now pursuing bigger and more advanced targets. Equally these criminals are starting to not only gather mass following among those who want to copy their crimes but are also setting up “specialist” services to help these followers do just that.

Chatter on the Dark Web

Refund fraud is openly discussed on the underground forums and marketplaces of the Deep & Dark Web (DDW), where illicit vendors offering fraudulent refund services are commonplace.

This guide also describes how your personal data can appear on the dark web (such as your credit card data) and what you can do about it, including dark web monitoring.

Since accomplishing a successful refund depends more on a vendor's social engineering skills than on bypassing any particular type of anti-fraud measure, many vendors offer refunds for a variety of companies.

A screenshot shared by a client of a DDW refund fraud vendor showing an email reply from the customer service team of a high-end clothing retailer. The email indicates that the actor received a $512 refund after using the vendor’s social engineering services to convince the retailer that they had purchased a package, but it was never delivered.

Successful refund vendors have gained loyal followings within their cybercriminal communities. Indeed, satisfied customers have been known to leave positive reviews accompanied by screenshots of emails sent by impacted stores issuing refunds.

After finding a reliable refund vendor, forum members will often become repeat customers, requesting refunds from a variety of companies the vendor targets.

As analysts of business risk intelligence, we have observed numerous vendors advertising fraudulent receipts for sale on the DDW. These actors are capable of producing counterfeit receipts in a variety of formats, including physical store receipts, packing slips, and digital receipts.

Fake receipts typically target retailers that sell technology products, and they are often available for less than $10 USD per receipt. However, fake receipt vendors are often capable of targeting a variety of companies and are able to adjust their tactics, techniques and procedures (TTPs) in response to customer concerns and demands.

A fake receipt vendor advertises an image of a counterfeit physical store receipt for a $201.90 entertainment/electronics purchase from a major U.S. retailer.

Fake receipts facilitate fraud by eliminating the need for malicious actors to make an initial purchase from the targeted retailer. They also make it more difficult for retailers to trace multiple instances of fraud to the same individual. Moreover, physical receipts may be used to return stolen items in exchange for money or store credit.

Image 3: A fake receipt vendor advertises a counterfeit packing slip for a $370.89 computer hardware purchase from an online retailer.

Digital receipts may be used to make false claims about an online order to elicit a refund or replacement shipment from the retailer. For example, fraudsters may claim they received an empty box, items were missing from their shipments, they received the wrong item, or the item arrived in a damaged state.

Flashpoint analysts discovered that several receipt vendors also offered product serial numbers to their clients as well. These serial numbers are likely used in conjunction with other tactics to obtain a refund or replacement shipment.

Based on DDW chatter, Flashpoint analysts assess with a low degree of confidence that these vendors may be using serial number generators—software capable of generating valid serial numbers—in order to supply their clients. Such generators can be found in DDW forums and in some surface-web communities.

Assessment

In 2018 cybercriminals will continue to leverage faked receipts to commit fraud. The rise in competition and transparency has led many retailers looking to differentiate themselves in the market to offer generous customer service and flexible return policies.

It is those gaps that these threat actors are seeking to penetrate. In an era of digital transformation, companies are exposing themselves to numerous threats. Cybercriminal activities are continuously advancing and businesses need to keep up with their pace in order to mitigate these threats.

By maintaining a robust, year-round intelligence operation that leverages insights gleaned from the DDW, retailers can keep up with emerging TTPs and fraud schemes used to target their sector, such as newly discovered loopholes or novel social engineering strategies.

Hopefully these insights can help retailers develop and implement comprehensive and effective anti-fraud policies and procedures.

Liv Rowley is an analyst at Flashpoint.