Flashpoint: underground markets fuel retail and financial fraud ahead of the 2026 holiday season, from refund abuse to compromised ecommerce sites
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 11/11/2026 12:20; os links antigos trazem para cá.
Fontes: flashpoint.io ×2 ↗
Flashpoint analysts (flashpoint.io) describe fraud tactics that illicit communities share against retailers ahead of the 2026 holiday shopping season. Seasonal spikes in transactions, promotions and customer service demand make suspicious activity harder to spot. The main schemes are refund and return abuse, social engineering of customer service, gift card fraud, sale of access to compromised ecommerce sites, and organized retail crime with resale of stolen goods. A later Flashpoint webinar summary (11 November 2026, flashpoint.io) frames these underground markets as interconnected economies. Threat actors there trade stolen credentials, account takeover tools, refund fraud services and illicit payment methods at scale. Flashpoint says seasonal periods such as Black Friday can amplify these schemes, and that monitoring the activity can help organizations spot emerging fraud methods before losses occur.
Detalhes técnicos
- Refund fraud: Actors trade techniques such as Did Not Arrive (DNA) and Partial DNA (PDNA), Empty Box, Wrong Item, Double Dip and Lost in Transit Return (LITR). Flashpoint also saw discussion of fraudulent tracking information, manipulated shipping labels and claimed access to courier operations. Refund-as-a-service offerings are advertised (flashpoint.io).
- Social engineering: Fraudsters target customer service reps to bypass verification. They use "account seasoning", building a history of benign activity before committing fraud. Accounts impersonating retailer support on social media steer victims to WhatsApp and LemFi (flashpoint.io).
- Gift card fraud: Actors advertise gift card generators and balance checkers, buy gift cards with stolen payment cards, and drain card balances. Rings recruit through Telegram, WhatsApp and WeChat. Gift cards are also sold on peer-to-peer crypto exchanges, which does not by itself prove money laundering (flashpoint.io).
- Compromised ecommerce: Listings sell access to Shopify, Magento and OpenCart sites, including admin rights, customer records, order histories and financial data. Some target small shops with 200 or fewer orders per month. Access methods are usually not disclosed. The access can enable phishing, account abuse, card skimming, carding and fraudulent dropshipping (flashpoint.io).
- Organized retail crime: Telegram, Discord and forums host discussions of shoplifting, loss prevention evasion and fencing. Actors also claim insider contacts among retail and shipping staff, which Flashpoint says is not always verifiable (flashpoint.io).
- Other areas covered by the webinar: compromised accounts, refund scams, insider recruitment, gift card fraud and cash-out techniques (flashpoint.io).
Remediação
- Watch for unusual gift card purchasing patterns, rapid balance depletion and transactions tied to suspected card fraud (flashpoint.io).
- Align fraud, cybersecurity and loss prevention teams, which often operate separately (flashpoint.io).
- Monitor underground markets proactively to identify threats and emerging fraud methods before financial losses occur, especially around peak shopping periods (flashpoint.io).
Linha do tempo
-
Underground Markets Fueling Retail and Financial Fraud with Sophisticated Tactics
ler a análise desta fonte ocultar
Flashpoint's recent webinar reveals how underground markets operate as interconnected economies that facilitate retail and financial fraud. Threat actors buy and sell stolen credentials, account takeover tools, refund fraud services, and illicit payment methods at scale. Monitoring these activities can help organizations identify potential threats and emerging fraud methods before financial losses occur. Key areas include compromised accounts, refund scams, insider recruitment, gift card fraud, and cash-out techniques. Seasonal shopping periods, such as Black Friday, can amplify these schemes, necessitating proactive defense measures.
-
Flashpoint details retail fraud schemes, from refund abuse to compromised ecommerce sites, circulating in underground communities before the holidays
ler a análise desta fonte ocultar
Flashpoint analysts describe fraud tactics that illicit communities share against retailers ahead of the 2026 holiday shopping season. Seasonal spikes in transactions, promotions and customer service demand make suspicious activity harder to spot. The main schemes are refund and return abuse, social engineering of customer service, gift card fraud, sale of access to compromised ecommerce sites, and organized retail crime with resale of stolen goods.
Technical Details
- Refund fraud: Actors trade techniques such as Did Not Arrive (DNA) and Partial DNA (PDNA), Empty Box, Wrong Item, Double Dip and Lost in Transit Return (LITR). Flashpoint also saw discussion of fraudulent tracking information, manipulated shipping labels and claimed access to courier operations. Refund-as-a-service offerings are advertised.
- Social engineering: Fraudsters target customer service reps to bypass verification. They use "account seasoning", building a history of benign activity before committing fraud. Accounts impersonating retailer support on social media steer victims to WhatsApp and LemFi.
- Gift card fraud: Actors advertise gift card generators and balance checkers, buy gift cards with stolen payment cards, and drain card balances. Rings recruit through Telegram, WhatsApp and WeChat. Gift cards are also sold on peer-to-peer crypto exchanges, which does not by itself prove money laundering.
- Compromised ecommerce: Listings sell access to Shopify, Magento and OpenCart sites, including admin rights, customer records, order histories and financial data. Some target small shops with 200 or fewer orders per month. Access methods are usually not disclosed. The access can enable phishing, account abuse, card skimming, carding and fraudulent dropshipping.
- Organized retail crime: Telegram, Discord and forums host discussions of shoplifting, loss prevention evasion and fencing. Actors also claim insider contacts among retail and shipping staff, which Flashpoint says is not always verifiable.
Remediation
- Watch for unusual gift card purchasing patterns, rapid balance depletion and transactions tied to suspected card fraud.
- Align fraud, cybersecurity and loss prevention teams, which often operate separately.