Tactical Information Systems
Biometric Identification Software
SERVER.png

Tactical Information Systems Blog

Identity & Technology

eCommerce & Reshipping Scams

I first heard about reshipping scams when we were in the beginning of our Techstars program. One of the companies we interviewed as part of our market validation had been a victim. People were using stolen credit cards to buy items from their website, receiving the item at their home address and then reshipping it to an address in Russia.

Always read the fine print before accepting a job.

Always read the fine print before accepting a job.

The first question I had was "Why on earth would anyone do this?" I mean, that's clearly eCommerce fraud, right? And it turns out it's not so obviously illegal if you apply for a "work from home" job on the internet. Once hired, you are provided with access to a company email address and access to the company intranet which has a complete work flow for your "job". You sign in, follow the directions and use the "company credit card" to buy items. The items are shipped to you, for some reason you don't think to question, and then you ship them to the company. Lots of people fall for this - not realizing that their "job" is actually helping the Russian mafia launder money.

A recently published study Drops for Stuff: An Analysis of Reshipping Mule Scams indicates that about 1.6 million credit and debit cards are used to commit at least $1.8 billion in reshipping fraud each year. Brian Krebs of "Krebs on Security" wrote an excellent blog that goes into more detail here.

You can see the appeal. They use stolen credit cards to buy merchandise which they can resell. How hard is it to run a profitable business when your inventory cost you nothing? But also, many of the consumer goods typically purchased - laptops, phones or gaming systems - are sold in Russia with as much as a 50 percent mark up for various taxes and fees.

From the blog:

"For example, an Apple MacBook selling for 1,000 US dollars in the United States typically retails for for about 1,400 US dollar in Russia because a variety of customs duties, taxes and other fees increase their price.
 
It’s not hard to see how this can become a very lucrative form of fraud for everyone involved (except the drops). According to the researchers, the average damage from a reshipping scheme per cardholder is $1,156.93. In this case, the stuffer buys a card off the black market for $10, turns around and purchases more than $1,100 worth of goods. After the reshipping service takes its cut (~$550), and the stuffer pays for his reshipping label (~$100), the stuffer receives the stolen goods and sells them on the black market in Russia for $1,400. He has just turned a $10 investment into more than $700. Rinse, wash, and repeat."

So mostly these people are targeting big companies like Apple, Sprint or eBay, and those companies have large anti-fraud departments and layers of expensive and complicated anti-fraud tools. But they also take advantage of smaller eCommerce companies because they know these companies haven't had time to develop sophisticated internal process. BeehiveID can help.