Refund Fraud and Fake Receipts Proliferate on the Deep & Dark Web

Flashpoint

March 7, 2018

Table Of Contents

Table of Contents

Assessment

Recognizing customer satisfaction as a key driver of retention, many retailers have implemented generous refund or replacement policies. Unfortunately, these policies can be susceptible to various forms of merchant abuse. Refund fraud is a pervasive form of merchant abuse in which a threat actor purchases a product from an online store and has it shipped to their home or a drop site. After delivery, the actor falsely claims that there was an issue in the delivery of the product, prompting the company to issue a refund. For example, fraudsters may claim they never received the item, received an empty box, items were missing from their shipments, they received the wrong item, or the item arrived in a damaged state. Thus, the fraudster receives their chosen product at no cost.

Refund fraud is openly discussed on the underground forums of the Deep & Dark Web (DDW), where illicit vendors offering fraudulent refund services are commonplace. These vendors offer their service in securing fraudulent refunds on behalf of clients. Since accomplishing a successful refund depends more on a vendor’s social engineering skills than on bypassing any particular type of anti-fraud measure, many vendors offer refunds for a variety of companies.

Image 1: A screenshot shared by a client of a DDW refund fraud vendor showing an email reply from the customer service team of a high-end clothing retailer. The email indicates that the client received a $512 refund after using the vendor’s social engineering services to convince the retailer that they had purchased a package that was never delivered. — **Image 1:** A screenshot shared by a client of a DDW refund fraud vendor showing an email reply from the customer service team of a high-end clothing retailer. The email indicates that the client received a $512 refund after using the vendor’s social engineering services to convince the retailer that they had purchased a package that was never delivered.

Successful refund vendors have gained loyal followings within their cybercriminal communities. Indeed, satisfied customers have been known to leave positive reviews accompanied by screenshots of emails sent by impacted stores issuing refunds. After finding a reliable refund vendor, forum members will often become repeat customers, requesting refunds from a variety of companies the vendor targets.

Flashpoint analysts have also observed numerous vendors advertising fraudulent receipts for sale on the DDW. These actors are capable of producing counterfeit receipts in a variety of formats, including physical store receipts, packing slips, and digital receipts. Fake receipts typically target retailers that sell technology products, and they are often available for fewer than $10 USD per receipt. However, fake receipt vendors are often capable of targeting a variety of companies and are able to adjust their tactics, techniques and procedures (TTPs) in response to customer concerns and demands.

Image 2: A fake receipt vendor advertises an image of an allegedly counterfeit physical store receipt for a $201.90 entertainment/electronics purchase from a major U.S. retailer. — **Image 2:** A fake receipt vendor advertises an image of an allegedly counterfeit physical store receipt for a $201.90 entertainment/electronics purchase from a major U.S. retailer.

Fake receipts allow malicious actors to commit fraud without making any purchase from the targeted retailer. They also make it more difficult for retailers to trace multiple instances of fraud to the same individual. Moreover, physical receipts may be used to return stolen items in exchange for money or store credit.

Image 3: A fake receipt vendor advertises a counterfeit packing slip showing a purchase for a $370.89 computer hardware purchase from an online retailer. — **Image 3:** A fake receipt vendor advertises a counterfeit packing slip showing a purchase for a $370.89 computer hardware purchase from an online retailer.

Digital receipts may be used to make false claims about an online order to elicit a “refund” or “replacement” shipment from the retailer, despite never having made an actual purchase.

Flashpoint analysts discovered that several receipt vendors also offered product serial numbers to their clients as well. These serial numbers are likely used in conjunction with other tactics to obtain a refund or replacement shipment. Based on DDW chatter, Flashpoint analysts assess with a low degree of confidence that these vendors may be using serial number generators—software capable of generating valid serial numbers—in order to supply their clients. Such generators can be found in DDW forums and in some surface-web communities.

Assessment

Moving forward, Flashpoint analysts assess with a moderate degree of confidence that cybercriminals will continue to leverage faked receipts to commit fraud. Meanwhile, rising competition and transparency has led many retailers seeking to differentiate themselves in the market to offer generous customer service and flexible return policies. However, the benefits of many such policies may be outweighed by the security challenges they create.

By maintaining a robust, year-round intelligence operation that leverages insights gleaned from the DDW, retailers can keep up with emerging TTPs and fraud schemes used to target their sector, such as newly discovered loopholes or novel social engineering strategies. These insights can help retailers develop and implement comprehensive and effective anti-fraud policies and procedures.

Block has been deleted or is unavailable.