https://www.smh.com.au/technology/how-scammers-use-ebay-as-a-personal-atm-20151104-gkq3aq.html
How scammers use eBay as a personal ATM
By Brian Krebs
Updated November 4, 2015
Normal text sizeLarger text sizeVery large text size
How do fraudsters "cash out" stolen credit card data? Increasingly, they are selling in-demand but underpriced products on eBay that they don't yet own. Once the auction is over, the auction fraudster uses stolen credit card data to buy the merchandise from an e-commerce store and have it shipped to the auction winner. Because the auction winners actually get what they bid on and unwittingly pay the fraudster, very often the only party left to dispute the charge is the legitimate cardholder.
So-called "triangulation fraud" — scammers using stolen cards to buy merchandise won at auction by other eBay members — is not a new scam. But it's a crime that's getting more sophisticated and automated, at least according to a victim retailer who reached out to me recently after he was walloped in one such fraud scheme.
Once a scammer steals credit card details online, they can launder the money on eBay before too many red flags go off. CREDIT:GETTY IMAGES
The victim company — which spoke on condition of anonymity — has a fairly strong e-commerce presence, and is growing rapidly. For the past two years, it was among the Top 500 online retailers as ranked by InternetRetailer.com.
The company was hit with over 40 orders across three weeks for products that later traced back to stolen credit card data. The victimised retailer said it was able to stop a few of the fraudulent transactions before the items shipped, but most of the sales were losses that the victim firm had to absorb.
How triangulation fraud works.CREDIT:EBAY ENTERPRISE
The scheme works like this: An auction fraudster sets up one (or multiple) eBay accounts and sells legitimate products. A customer buys the item from the seller (fraudster) on eBay and the money gets deposited in the fraudster's PayPal account.
The fraudster then takes the eBay order information to another online retailer which sells the same item, buys the item using stolen credit card data, and has the item shipped to the address of the eBay customer that is expecting the item. The fraudster then walks away with the money.
One reason this scheme is so sneaky is that the eBay customers are happy because they got their product, so they never complain or question the company that sent them the product. For the retailer, the order looks normal: The customer contact info in the order form is partially accurate: It has the customer's correct shipping address and name, but may list a phone number that goes somewhere else — perhaps to a voicemail owned and controlled by the fraudster.
"For the retailer who ships thousands of orders every day, this fraudulent activity really doesn't raise any red flags," my source — we'll call him "Bill," — told me. "The only way they eventually find out is with a sophisticated fraud screening program, or when the 'chargeback' from Visa or MasterCard finally comes to them from the owner of the stolen card."
In an emailed statement, eBay said the use of stolen or fraudulent credit card numbers to purchase goods on eBay is by no means unique to eBay.
"We believe collaboration and cooperation is the best way to combat fraud and organised retail crime of this nature, working in partnership with retailers and law enforcement," wrote Ryan Moore, eBay's senior manager of global corporate affairs. Detecting this type of fraud, Moore said, "relies heavily on the tools that merchants use themselves, which includes understanding their customers and implementing the correct credit card authorisation protocols."
Moore declined to discuss the technology and approaches that eBay uses to fight triangulation fraud — saying eBay doesn't want to tip its hand to cybercriminals. But he said the company uses internal tools and risk models to identify suspicious activity on its platform, and that it trains hundreds of retailers and law enforcement on various types of fraud, including triangulation fraud.
Quad fraudMoore pointed to one education campaign on eBay's site, which adds another wrinkle to this fraud scheme: Very often the people listing the item for sale on eBay are existing, long-time eBay members with good standing who get recruited to sell items via work-at-home job scams. These schemes typically advertise that the seller gets to keep a significant cut of the sale price — typically 30 per cent.
Interestingly, the guy selling carded goods stolen from Bill's company has been on eBay for more than a decade and has a near-perfect customer feedback score. That seller is not being referenced in this story because his feedback page directly links to transactions from Bill's company.
Bill said he believes fraudsters targeted his company because it is relatively small, and is less likely to rely on sophisticated fraud tools that can sort out fraudulent orders. In his company's case, it wasn't spending any money on such fraud prevention tools until all this eBay fraud started.
"It wasn't a huge order size, just random products we sell," Bill said. "They're going after us as a medium-sized retailer because we're not yet to the size where we have all the fraud software built-in."
Tri-fraud botsAccording to Bill, the company thought it had figured out a fraud pattern to help block future phony charges, which it found all came from different internet addresses at Amazon's Elastic Compute Cloud (EC2) service. After a block was put in place, visitors coming from EC2 servers could still browse the site, but they would be blocked from placing orders.
Bill said he believes the orders may have been placed by automated "bot" programs running on instances of Amazon's EC2 platform (instances that were also likely paid for with stolen card data).
"The fraud kept going until we put in some things that blocked his bots at Amazon EC2 from transacting with our site," Bill said.
Bill allowed that he can't prove it wasn't just a human manually transacting from all those EC2 systems. However, another security measure that Bill's company established to fight triangulation fraud lends credence to the theory that some sort of automated EC2-based bots may indeed be involved in placing the unauthorised product orders. Bill's firm put new data fields in the part of the checkout process where customers type in their name and address. This trick uses data fields that are hidden from regular website visitors but that are still visible on the site to computers and web crawlers.
The idea is to separate orders made by humans from those entered by automated bots. Although the latter may dutifully supply some phony requested data in the new data fields, legitimate, human customers would never input data into those extra fields because they can't see the information being requested in the first place.
'Blocking EC2 purchases and the data fields have worked really well blocking this fraudster's bots from spamming our email forms," Bill said.
Bill's company also just signed up with MaxMind, a company that gives retailers multiple clues about potentially fraudulent orders based on the geography of the order. For example, was the order placed from an internet address that is located near the shipping address?
For its part, eBay says merchants can fight triangulation fraud by focusing on the products being sold by suspect eBay accounts. "Collaborate with auction and marketplaces that are known to have fraudulent sellers," the company said in its tri-fraud primer. "Together, you may be able to uncover additional orders that may be part of the scam to help identify fraudulent sellers and/or employers."
@retroragsaustralia,
I wonder if perhaps you have complicated your replies in the disputes... I'm sorry you've had this issue; it is really (or should be) a straightforward INR (items not received) case. You paid; you didn't receive.
Can you clarify the following points?
- What was the Estimated Date of Arrival range for these items to be received by you?
- When does the tracking status say? Dates, any delivery/return status, that sort of thing. (Exactly what the tracking says... not a summary of it. Just remove identifying information, of course.)
- When did you open a dispute? (Exact date.)
- (Did you open multiple disputes? Then exact date for each dispute.)
- Did you open the dispute on eBay under its Money Back Guarantee, or did you open a dispute through PayPal?
- What did you say on the dispute?
- Was any information requested within the dispute?
- Did you upload any evidence within the dispute?
- What is the current status within each dispute? (Are you aware that disputes are time-sensitive not only in terms of by when you must open a dispute, but also in terms of by when you must escalate a dispute?)
- Have you escalated?
- Have you spoken to eBay/PayPal via chat in relation to the dispute/s?
The basic message I would say at this stage is... DON'T DELAY on any required action that must be taken. Once a dispute is closed, it's impossible to open it again... except in exceptional circumstances when you can convince a CS rep to manually re-open the case.
I would also say... DON'T COMPLICATE THE DISPUTE. Your case is that you never received the items. Apparently the seller breached eBay's Third-party fulfilment policy 
Quoting from that policy:
❝
Not allowed
- Fulfilling your orders from a third-party supplier when the above conditions are not met
- Listing an item on eBay and then purchasing the item from another retailer or marketplace that sends it directly to your customer.❞
(Rubrication mine.)
You must break it down in this very simple way. There is positely no need to be talking about triangulation scam/triangulation fraud. It's not terminology that elucidates the situation, and when you're talking through an eBay dispute, it is (in my opinion) best to phrase what's happened in terms of eBay's own policies.
- You purchased an item/several items and paid the eBay "seller".
- The items were purchased by the eBay "seller" AFTER you have paid him/her. (That is, the goods were not in the "seller's" possession.)
- The "seller" did not use his/her own funds, or your funds, for the purchase of the items that you "purchased" from him; rather, he/she used stolen credit card details to place the order with the actual company possessing the items, with your name and address being used for the shipping address.
- The actual company possessing the items became aware that a stolen credit card was used for the purchase from the "seller", and instructed Australia Post to return the in-transit goods to them.
- You did not receive the items.
- You hereby want the full refund to be actioned ASAP.
That is putting it point by point, which I think is the best way to convey this information.
If you have requested a refund through eBay, under its Money Back Guarantee, the responders here can quote what you can say in order to get this moving.
If you have requested a refund through PayPal, it's not eBay policy that you'll need to quote. The timeframes are also different. That's why it's important to know through whom you have raised the dispute/s.
I hope we can help talk you through how to resolve this.
