Flashpoint details retail fraud schemes, from refund abuse to compromised ecommerce sites, circulating in underground communities before the holidays
1 fonte(s)
·
1 atualização(ões)
·
publicado 02/11/2026 17:24
·
coletado há 1 hora
Flashpoint analysts describe fraud tactics that illicit communities share against retailers ahead of the 2026 holiday shopping season. Seasonal spikes in transactions, promotions and customer service demand make suspicious activity harder to spot. The main schemes are refund and return abuse, social engineering of customer service, gift card fraud, sale of access to compromised ecommerce sites, and organized retail crime with resale of stolen goods.
Detalhes técnicos
- Refund fraud: Actors trade techniques such as Did Not Arrive (DNA) and Partial DNA (PDNA), Empty Box, Wrong Item, Double Dip and Lost in Transit Return (LITR). Flashpoint also saw discussion of fraudulent tracking information, manipulated shipping labels and claimed access to courier operations. Refund-as-a-service offerings are advertised.
- Social engineering: Fraudsters target customer service reps to bypass verification. They use "account seasoning", building a history of benign activity before committing fraud. Accounts impersonating retailer support on social media steer victims to WhatsApp and LemFi.
- Gift card fraud: Actors advertise gift card generators and balance checkers, buy gift cards with stolen payment cards, and drain card balances. Rings recruit through Telegram, WhatsApp and WeChat. Gift cards are also sold on peer-to-peer crypto exchanges, which does not by itself prove money laundering.
- Compromised ecommerce: Listings sell access to Shopify, Magento and OpenCart sites, including admin rights, customer records, order histories and financial data. Some target small shops with 200 or fewer orders per month. Access methods are usually not disclosed. The access can enable phishing, account abuse, card skimming, carding and fraudulent dropshipping.
- Organized retail crime: Telegram, Discord and forums host discussions of shoplifting, loss prevention evasion and fencing. Actors also claim insider contacts among retail and shipping staff, which Flashpoint says is not always verifiable.
Remediação
- Watch for unusual gift card purchasing patterns, rapid balance depletion and transactions tied to suspected card fraud.
- Align fraud, cybersecurity and loss prevention teams, which often operate separately.
Linha do tempo
-
Flashpoint details retail fraud schemes, from refund abuse to compromised ecommerce sites, circulating in underground communities before the holidays
ler a análise desta fonte ocultar
Flashpoint analysts describe fraud tactics that illicit communities share against retailers ahead of the 2026 holiday shopping season. Seasonal spikes in transactions, promotions and customer service demand make suspicious activity harder to spot. The main schemes are refund and return abuse, social engineering of customer service, gift card fraud, sale of access to compromised ecommerce sites, and organized retail crime with resale of stolen goods.
Technical Details
- Refund fraud: Actors trade techniques such as Did Not Arrive (DNA) and Partial DNA (PDNA), Empty Box, Wrong Item, Double Dip and Lost in Transit Return (LITR). Flashpoint also saw discussion of fraudulent tracking information, manipulated shipping labels and claimed access to courier operations. Refund-as-a-service offerings are advertised.
- Social engineering: Fraudsters target customer service reps to bypass verification. They use "account seasoning", building a history of benign activity before committing fraud. Accounts impersonating retailer support on social media steer victims to WhatsApp and LemFi.
- Gift card fraud: Actors advertise gift card generators and balance checkers, buy gift cards with stolen payment cards, and drain card balances. Rings recruit through Telegram, WhatsApp and WeChat. Gift cards are also sold on peer-to-peer crypto exchanges, which does not by itself prove money laundering.
- Compromised ecommerce: Listings sell access to Shopify, Magento and OpenCart sites, including admin rights, customer records, order histories and financial data. Some target small shops with 200 or fewer orders per month. Access methods are usually not disclosed. The access can enable phishing, account abuse, card skimming, carding and fraudulent dropshipping.
- Organized retail crime: Telegram, Discord and forums host discussions of shoplifting, loss prevention evasion and fencing. Actors also claim insider contacts among retail and shipping staff, which Flashpoint says is not always verifiable.
Remediation
- Watch for unusual gift card purchasing patterns, rapid balance depletion and transactions tied to suspected card fraud.
- Align fraud, cybersecurity and loss prevention teams, which often operate separately.