Inside the Retail Fraud Underground: The Schemes Targeting Retailers Ahead of the Holiday Season

As retailers prepare for the holiday shopping season, increased transaction volumes, promotional activity, and customer service demands create additional opportunities for fraud. Fraudsters exploit routine retail operations, including shipping, returns, and payment processing, while the seasonal surge in legitimate activity can make suspicious transactions more difficult to identify.

Across illicit online communities, threat actors exchange refund fraud techniques, advertise access to compromised ecommerce sites, recruit participants for gift card schemes, and share methods for circumventing retailers’ loss prevention controls. Flashpoint analysts monitor these communities to understand how fraud schemes operate, how tactics are shared, and where retailers may face increased exposure. 

Refund Fraud: Exploiting Retail Policies and Shipping Processes

Fraudulent returns and refunds remain persistent challenges for retailers, with threat actors sharing methods designed to exploit delivery verification, return policies, and customer service procedures. In illicit communities monitored by Flashpoint, actors exchange advice on which retailers to target, which claims are most likely to succeed, and how to circumvent existing fraud prevention measures.

Several recurring techniques appear in these discussions:

• Did Not Arrive (DNA): Fraudsters falsely claim that a delivered package never arrived. A variation, known as Partial DNA (PDNA), involves claiming that only certain items within an order were missing.
• Empty Box: Actors acknowledge receiving a shipment but claim that the package contained no merchandise. Discussions surrounding this method frequently address shipping weights and delivery records.
• Wrong Item: Fraudsters claim to have received an incorrect or lower-value product, sometimes returning a substitute item while retaining the original purchase.
• Double Dip: Actors seek a replacement shipment following an alleged delivery issue, then submit a subsequent refund claim.
• Lost in Transit Return (LITR): Fraudsters claim that merchandise was returned but lost before reaching the retailer, complicating verification of the return.

These methods vary in complexity, but many depend on creating uncertainty around what was shipped, delivered, or returned. Flashpoint has also observed discussions involving fraudulent tracking information, manipulated shipping labels, and individuals claiming access to shipping or courier operations.

Some schemes extend beyond individual fraudsters. Illicit communities include advertisements for refund services and discussions of methods that can be applied against multiple retailers, demonstrating how knowledge of successful techniques circulates among participants.

Customer Service as a Target for Social Engineering

Retail customer service representatives are frequently targeted by fraudsters attempting to obtain refunds, replacement merchandise, or access to customer accounts. Flashpoint analysts regularly identify discussions describing ways to bypass verification procedures and persuade representatives to authorize transactions that would otherwise be rejected.

These schemes often rely on familiar customer complaints, including missing deliveries, damaged products, and incorrect orders. Threat actors may combine these claims with additional social engineering techniques, such as expressing frustration, presenting sympathetic circumstances, or contacting support teams during periods of high demand.

Another technique, known as account seasoning, involves establishing a history of seemingly legitimate activity before attempting fraud. Actors may browse merchandise, add products to shopping carts, or make small purchases to give an account the appearance of normal customer behavior.

Flashpoint analysts have also identified accounts impersonating retailers’ customer service departments on social media. These accounts respond to customers seeking assistance with refunds and direct them toward external communication channels or payment applications, including WhatsApp and LemFi. Such impersonation creates opportunities to exploit customers already expecting contact from a retailer.

Gift Card Fraud and the Monetization of Stolen Payment Data

Gift cards remain an attractive target because they can be purchased using compromised payment information, transferred between individuals, and exchanged for merchandise or other forms of value.

Flashpoint analysts have observed threat actors advertising gift card generators, balance checkers, and related services across illicit communities. Some schemes involve using stolen payment cards to purchase gift cards, while others focus on draining the balances of cards obtained through fraudulent means.

These operations can involve multiple participants with distinct responsibilities. In some gift card fraud rings, individuals are recruited through social media platforms and messaging applications, including Telegram, WhatsApp, and WeChat, to obtain cards, purchase merchandise, or facilitate the conversion of stolen value into goods.

Flashpoint has also documented activity involving the use of fraudulently obtained gift cards to purchase electronics and luxury merchandise. The availability of gift cards through peer-to-peer cryptocurrency exchanges creates additional potential avenues for transferring value, although the presence of gift cards on these platforms does not independently establish money laundering activity.

With gift card purchasing and redemption activity expected to increase during the holiday season, retailers should pay particular attention to unusual purchasing patterns, rapid balance depletion, and transactions associated with suspected payment card fraud.

Compromised Ecommerce Sites Create Additional Fraud Opportunities

Beyond transaction-level fraud, threat actors also target the ecommerce infrastructure that retailers depend on to process orders and manage customer information.

Across Flashpoint’s collections, analysts have observed advertisements offering access to compromised ecommerce websites, including sites operating on Shopify, Magento, and OpenCart. Depending on the access obtained, these listings may include administrative privileges, customer records, order histories, financial information, and the ability to modify website content.

Some advertisements involve relatively small ecommerce businesses, including sites reportedly processing 200 or fewer orders per month. Others claim access to higher-volume stores. Although these advertisements do not consistently disclose how access was obtained, they illustrate the range of retail environments represented in underground access markets.

Compromised ecommerce infrastructure can support several types of fraud. Access to customer information and order histories may facilitate targeted phishing or account abuse, while control over website functionality can create opportunities for payment card skimming and other malicious activity.

Flashpoint has also observed tutorials and advertisements discussing the use of ecommerce platforms for carding, phishing, and fraudulent dropshipping operations. These findings demonstrate how compromised retail infrastructure can become a resource for subsequent fraud activity, extending the impact beyond the initial unauthorized access.

Organized Retail Crime and the Resale of Stolen Merchandise

Retail fraud also intersects with physical theft and organized resale operations. Flashpoint monitors online communities where individuals discuss shoplifting techniques, loss prevention procedures, and methods for reselling stolen merchandise.

These discussions appear across platforms including Telegram, Discord, and online forums, where participants exchange information about retail security practices and merchandise targeted for theft. Electronics, clothing, cosmetics, and other easily resold products feature prominently in these conversations.

Organized retail crime operations may involve individuals responsible for obtaining merchandise, intermediaries who purchase stolen goods, and participants who manage resale or distribution. Flashpoint analysts have observed advertisements seeking partners for fencing operations, as well as discussions about selling stolen merchandise through online marketplaces and classified advertising services.

Insider access can also play a role. Across illicit communities, actors have claimed connections to retail employees, shipping personnel, or individuals with knowledge of loss prevention procedures. Although these claims are not always independently verifiable, they demonstrate the value fraudsters place on operational knowledge and access to retail systems.

The overlap between physical theft, online resale, and fraudulent transactions creates challenges for organizations whose fraud prevention, cybersecurity, and loss prevention functions operate independently.

Understand the Fraud Underground With Flashpoint

Interested in learning more? Join Flashpoint Intelligence Analysts Jason Kimbrel and Ethan Alfery on November 4, 2026, at 2:00 PM ET for our upcoming webinar, Inside the Fraud Underground: What Retail and Financial Services Teams Need to Know. They’ll examine emerging fraud schemes, seasonal threats, and how primary-source intelligence can strengthen fraud investigations. Register for the webinar to save your seat.

Flashpoint continuously monitors illicit communities and emerging fraud tactics, combining primary-source intelligence with analyst research to help organizations identify threats and investigate fraudulent activity. Request a demo to see how Flashpoint can help your team strengthen fraud detection and investigations.