Shortly before midnight on May 4, 2023, the police were called to Amazon
at a warehouse in Chattanooza, Tennessee, to investigate a reported theft.
According to a police report on the incident obtained by CNBC, they were met by a damage prevention officer, who referred them to a warehouse worker in the name of Noah Page, the suspected culprit.
According to the report, in front of police, Page admitted that he marked a customer's order in Amazon's internal system as returned, even though the products were never actually returned back to the company. Page received $ 3,500 for his participation in the scheme, the report said.
Page didn't know the client, but decided to call him "Ralph," the report says. Ralph, it turns out, was part of a group called Rekk, an expansive refund fraud organization that targeted large retailers and recruited company employees by promising them a cut in profits, as Amazon claimed in the lawsuit.
Refund fraud, which involves retailers tricking a customer into returning money for a purchase without physically returning the item, has become so widespread that groups are now selling their services on Reddit, TikTok, and Telegram. Enter "refund method" - or "r3fund" to bypass content moderators - on TikTok, and videos of users showing off piles of cash, sneakers, and iPhones will pop up. One video has a caption: "I was after realizing that you can get a refund for any Rick Owens if 'the package never arrived', " referring to the minimalist fashion brand. In the video, the hand can be seen endlessly throwing shoes to the ground.
According to CNBC experts, fraudulent groups take advantage of retailers ' soft return policies, which often include unlimited free returns, and sometimes even the advantage of customers leaving items. According to a survey conducted by the National Retail Federation and Appriss Retail, this has become a huge problem for retailers, costing them more than $ 101 billion last year. This figure includes numerous forms of fraud, such as sending clothing after it has been dressed, known as a "wardrobe", and returning stolen goods, the survey said.
In December, Amazon filed a lawsuit against Page and 47 other people around the world who are allegedly connected to Rekk, accusing them of conspiring to steal millions of dollars ' worth of products as part of a refund fraud deal. Amazon described these services as an "illegitimate' business '" that seeks to "use the refund process for its own financial gain to the detriment of honest consumers and retailers, who must bear the brunt of rising costs, dwindling inventory, and disruptions in service delivery that affect their customers."
Amazon also suffered more than $ 700,000 in damages due to another alleged fraud ring that involved 10 people last year, according to documents in a lawsuit filed in 2023.
On Tuesday, August 31, 2021, workers transport goods to employees in a warehouse at the Amazon Fulfillment Center in Eastvale.
Riverside Press Enterprise | Medianews Group | Getty Images
An Amazon spokesperson said the company solves the problem "directly" by using specialized teams and machine learning tools that detect and prevent refund fraud. Amazon says its cooperation with law enforcement has led to arrests, the dismantling of organized criminal retail groups, and civil lawsuits.
"We continue to make progress in identifying and stopping fraud before it occurs, as well as in eliminating groups that attempt to damage the integrity of our store and the stores of retailers throughout the retail industry," the spokesperson said in a statement.
Here's how it works: A customer buys a product online and sends the order information to a group like Rekk, which then impersonates the customer by requesting a refund. Amazon returns the money to the customer, who then pays a group of scammers usually between 15% and 30% of the refund amount, often via PayPal or with bitcoins
. This means that the customer buys the product at a huge discount.
The group of scammers then pays the conspirator a retail employee, usually a certain amount for a batch of packages that the employee scans after returning.
Retailers and law enforcement agencies are picking up on this trend. In September, a 25-year-old Michigan man, Sajed Al-Maarej, was arrested and charged with conspiracy, email fraud, and mail fraud after allegedly running a fraudulent refund service called Simple Refunds that targeted more than 50 merchants. The following month, 10 men were charged in Oklahoma with conspiracy to commit fraud through the Artemis Refund Group. In December, a 24-year-old British man was found guilty of fraud after he launched a refund service called KeptSecrets, aimed at retailers including Amazon, Walmart and Wayfair, according to court filings.
• Source: https://www.justice.gov/usao-wdwa/p...y-wire-and-mail-fraud-nearly-4-million-refund
• Source: https://www.justice.gov/usao-ndok/p...d-ring-indicted-refund-fraud-scheme-targeting
Following Recca's pattern, Page was arrested when police showed up at a Chattanooza warehouse in May and charged with stealing more than $ 60,000 worth of property. He pleaded guilty and in November was sentenced to three years of probation and ordered to pay Amazon $ 5,000.
A thriving market for refund scams
After each fraudulent refund service closed by law enforcement agencies, swarms of such groups remain open.
CNBC took a look at several active fraudulent refund services in the encrypted messaging app Telegram, each with thousands of subscribers. Updates are posted almost daily regarding new stores in their services or new retailers that have been successfully targeted. Amazon and Apple are frequently hit, as are Nike, eBay, Saks Fifth Avenue, and Ralph Lauren. Some groups even offer their services for DoorDash and Uber Eats orders, claiming that users can "eat for free".
The groups are well organized and run like a business, serving customers, cataloging orders, and creating fake shipping labels. Some sell instructions.
A Google form from an active fraudulent refund service explaining which stores it targets and how much it charges customers.
Scammers use several strategies. A statement was issued that the package was not received, so that the retailer would return the funds. According to Amazon's lawsuit, a Rekk user received a full refund for two MacBook Air laptops after he filed a police report, where he falsely claimed that the products never arrived.
A mail-in scam involves a user filling out a company's refund form, but instead of sending back the purchased product, users mail in an empty box or bag filled with trash. In the case of Simple Refunds, Al-Maarej, who allegedly directed the group, sent an unnamed seller "an envelope filled with plastic toy frogs" instead of the tools he claimed to be returning, prosecutors said.
Al-Maarej also hired UPS and U.S. Postal Service employees who either manipulated the parcel's tracking history or entered erroneous "return to sender" notifications to trick the retailer into thinking that the item couldn't be delivered or that it was sent incorrectly. address, according to court records.
Chris Black, an attorney for Al-Maarej, declined to comment. Amazon said its own internal investigation revealed Al-Maarej's scheme and contributed to the final prosecution.
The company did not respond to a question about how it tracks and combats the bribery of its employees by ORCS and groups of refund scammers.
Reck allegedly used bribes, offering Amazon employees thousands of dollars a day for customer approval to return never-returned products.
In Page's text message last year, a Rekk representative said they worked with two other Amazon employees for about two months and offered them $ 4,000 for 30 orders designated as returned, according to court documents.
"They usually do 30 scans a day per shift," wrote user Rekk. "Sometimes they decide to do more. Therefore, at least 12 thousand a week."
According to the complaint, Reck also hired one of Page's colleagues at CHA1, as Amazon calls the Chattanooga facility. Between February 2023 and May 2023, a CHA1 employee allegedly approved product refunds for 76 orders at Reck's request, resulting in Amazon returning more than $ 100,000 to customers and receiving $ 3,500 from the scheme.
The refund fraud service claims to have access to Amazon insiders in a Telegram message.
Amazon said it was trying to solve the problem of bribery. In its lawsuit against Rekk, the company said it has an internal customer protection and enforcement team consisting of lawyers, former prosecutors, and analysts investigating organized crime schemes such as refund fraud. It is reported that the company also fired employees who were allegedly bribed for leaking confidential data about third-party sellers.
Cyril Noel-Tago, a cybersecurity expert who has thoroughly studied refund fraud, said the economic incentive for low-paid workers to participate in these schemes creates a persistent problem for retailers.
"If you're offering an employee a lot more than they're being paid, it's pretty hard to fight," Noel-Tago, who works as chief security researcher at Netacea, a bot-detection software company, told CNBC.
"All you need is a phone"
Those looking for money-making opportunities will find no shortage of promotional videos on social media. For a fee, you can learn how to play the game.
One TikTok video on this topic shows bags with Louis Vuitton, Gucci and Apple products and says: "[Opinion]: You have mastered the art of r3funding and started teaching others." TikTok videos often serve as ads for the user's Telegram channel, which is linked to in the user's account bio.
A similar tactic is used on Reddit.
On the Illegal Life Pro Tips forum on Reddit, which is no longer active but has 1.1 million members, the scammers shared their tips and tricks. In recent days, Reddit has banned an offshoot of this subreddit called "illegallifeprotips2", saying that it violates the site's rules "against transactions involving prohibited goods or services". Users quickly reappeared in the new "ELegalLifeProTips" subreddit. After CNBC labeled ELegalLifeProTips, Reddit removed the subreddit for violating the ban evasion policy.
In the past, such illegal behavior was common on the dark web and required a VPN and a dedicated browser, said Brittany Allen, a trust and security architect at Sift, a fraud detection company. These days, attackers regularly openly discuss their activities on forums and messaging apps, which Allen called " democratizing fraud."
"You don't need to be an expert to figure out how to find these deep web groups," Allen said. "All you have to do is have a phone that can go to Reddit, or a TikTok account that you already have, and you're potentially exposed to a scam that doesn't require as much growth to participate in."
Remy Vaughn, a Telegram spokesperson, told CNBC in an email that the company moderates "harmful content" on its platform, including posts promoting fraud. "Moderators use a combination of proactive moderation on publicly accessible parts of the platform and accept user reports to remove content that violates Telegram's terms," Vaughn added.
A Reddit spokesperson said it uses a combination of automated tools and human moderators to enforce its content policy, which prohibits users from requesting or facilitating any transactions involving fraudulent services.
After CNBC provided TikTok with examples of videos about refund fraud, the company said it removed them for violating community guidelines. It also said that it also blocked hashtags that were used to promote refund scams.
The use of core applications in these schemes has made the work of investigators easier. Noel-Tago referred to a case where a retailer was able to track down the identity of the person whose email address was in an Instagram post.
Allen said she was able to identify the scammers through "vouchers" or screenshots of successful fraudulent returns. According to Allen, some of the images show order numbers, pick-up locations in stores, or items in the cart, all of which are useful information for retailers investigating return fraud.
David Johnston, vice president of asset protection and retail operations at the National Retail Federation, said more companies are "increasing their return policies" in response to customer abuse and fraud.
Delivery workers, for example, are encouraged to take photos of a package when it reaches its destination, and retailers are more careful to look for suspicious behavior by analyzing returns.
"There are some retailers that track the number of returns you make in - store, and if you return too often, they can put you on pause," Johnston said. "Now we're starting to see more of that on the ecommerce side."
at a warehouse in Chattanooza, Tennessee, to investigate a reported theft.
According to a police report on the incident obtained by CNBC, they were met by a damage prevention officer, who referred them to a warehouse worker in the name of Noah Page, the suspected culprit.
According to the report, in front of police, Page admitted that he marked a customer's order in Amazon's internal system as returned, even though the products were never actually returned back to the company. Page received $ 3,500 for his participation in the scheme, the report said.
Page didn't know the client, but decided to call him "Ralph," the report says. Ralph, it turns out, was part of a group called Rekk, an expansive refund fraud organization that targeted large retailers and recruited company employees by promising them a cut in profits, as Amazon claimed in the lawsuit.
Refund fraud, which involves retailers tricking a customer into returning money for a purchase without physically returning the item, has become so widespread that groups are now selling their services on Reddit, TikTok, and Telegram. Enter "refund method" - or "r3fund" to bypass content moderators - on TikTok, and videos of users showing off piles of cash, sneakers, and iPhones will pop up. One video has a caption: "I was after realizing that you can get a refund for any Rick Owens if 'the package never arrived', " referring to the minimalist fashion brand. In the video, the hand can be seen endlessly throwing shoes to the ground.
According to CNBC experts, fraudulent groups take advantage of retailers ' soft return policies, which often include unlimited free returns, and sometimes even the advantage of customers leaving items. According to a survey conducted by the National Retail Federation and Appriss Retail, this has become a huge problem for retailers, costing them more than $ 101 billion last year. This figure includes numerous forms of fraud, such as sending clothing after it has been dressed, known as a "wardrobe", and returning stolen goods, the survey said.
In December, Amazon filed a lawsuit against Page and 47 other people around the world who are allegedly connected to Rekk, accusing them of conspiring to steal millions of dollars ' worth of products as part of a refund fraud deal. Amazon described these services as an "illegitimate' business '" that seeks to "use the refund process for its own financial gain to the detriment of honest consumers and retailers, who must bear the brunt of rising costs, dwindling inventory, and disruptions in service delivery that affect their customers."
Amazon also suffered more than $ 700,000 in damages due to another alleged fraud ring that involved 10 people last year, according to documents in a lawsuit filed in 2023.
On Tuesday, August 31, 2021, workers transport goods to employees in a warehouse at the Amazon Fulfillment Center in Eastvale.
Riverside Press Enterprise | Medianews Group | Getty Images
An Amazon spokesperson said the company solves the problem "directly" by using specialized teams and machine learning tools that detect and prevent refund fraud. Amazon says its cooperation with law enforcement has led to arrests, the dismantling of organized criminal retail groups, and civil lawsuits.
"We continue to make progress in identifying and stopping fraud before it occurs, as well as in eliminating groups that attempt to damage the integrity of our store and the stores of retailers throughout the retail industry," the spokesperson said in a statement.
Here's how it works: A customer buys a product online and sends the order information to a group like Rekk, which then impersonates the customer by requesting a refund. Amazon returns the money to the customer, who then pays a group of scammers usually between 15% and 30% of the refund amount, often via PayPal or with bitcoins
. This means that the customer buys the product at a huge discount.
The group of scammers then pays the conspirator a retail employee, usually a certain amount for a batch of packages that the employee scans after returning.
Retailers and law enforcement agencies are picking up on this trend. In September, a 25-year-old Michigan man, Sajed Al-Maarej, was arrested and charged with conspiracy, email fraud, and mail fraud after allegedly running a fraudulent refund service called Simple Refunds that targeted more than 50 merchants. The following month, 10 men were charged in Oklahoma with conspiracy to commit fraud through the Artemis Refund Group. In December, a 24-year-old British man was found guilty of fraud after he launched a refund service called KeptSecrets, aimed at retailers including Amazon, Walmart and Wayfair, according to court filings.
• Source: https://www.justice.gov/usao-wdwa/p...y-wire-and-mail-fraud-nearly-4-million-refund
• Source: https://www.justice.gov/usao-ndok/p...d-ring-indicted-refund-fraud-scheme-targeting
Following Recca's pattern, Page was arrested when police showed up at a Chattanooza warehouse in May and charged with stealing more than $ 60,000 worth of property. He pleaded guilty and in November was sentenced to three years of probation and ordered to pay Amazon $ 5,000.
A thriving market for refund scams
After each fraudulent refund service closed by law enforcement agencies, swarms of such groups remain open.
CNBC took a look at several active fraudulent refund services in the encrypted messaging app Telegram, each with thousands of subscribers. Updates are posted almost daily regarding new stores in their services or new retailers that have been successfully targeted. Amazon and Apple are frequently hit, as are Nike, eBay, Saks Fifth Avenue, and Ralph Lauren. Some groups even offer their services for DoorDash and Uber Eats orders, claiming that users can "eat for free".
The groups are well organized and run like a business, serving customers, cataloging orders, and creating fake shipping labels. Some sell instructions.
A Google form from an active fraudulent refund service explaining which stores it targets and how much it charges customers.
Scammers use several strategies. A statement was issued that the package was not received, so that the retailer would return the funds. According to Amazon's lawsuit, a Rekk user received a full refund for two MacBook Air laptops after he filed a police report, where he falsely claimed that the products never arrived.
A mail-in scam involves a user filling out a company's refund form, but instead of sending back the purchased product, users mail in an empty box or bag filled with trash. In the case of Simple Refunds, Al-Maarej, who allegedly directed the group, sent an unnamed seller "an envelope filled with plastic toy frogs" instead of the tools he claimed to be returning, prosecutors said.
Al-Maarej also hired UPS and U.S. Postal Service employees who either manipulated the parcel's tracking history or entered erroneous "return to sender" notifications to trick the retailer into thinking that the item couldn't be delivered or that it was sent incorrectly. address, according to court records.
Chris Black, an attorney for Al-Maarej, declined to comment. Amazon said its own internal investigation revealed Al-Maarej's scheme and contributed to the final prosecution.
The company did not respond to a question about how it tracks and combats the bribery of its employees by ORCS and groups of refund scammers.
Reck allegedly used bribes, offering Amazon employees thousands of dollars a day for customer approval to return never-returned products.
In Page's text message last year, a Rekk representative said they worked with two other Amazon employees for about two months and offered them $ 4,000 for 30 orders designated as returned, according to court documents.
"They usually do 30 scans a day per shift," wrote user Rekk. "Sometimes they decide to do more. Therefore, at least 12 thousand a week."
According to the complaint, Reck also hired one of Page's colleagues at CHA1, as Amazon calls the Chattanooga facility. Between February 2023 and May 2023, a CHA1 employee allegedly approved product refunds for 76 orders at Reck's request, resulting in Amazon returning more than $ 100,000 to customers and receiving $ 3,500 from the scheme.
The refund fraud service claims to have access to Amazon insiders in a Telegram message.
Amazon said it was trying to solve the problem of bribery. In its lawsuit against Rekk, the company said it has an internal customer protection and enforcement team consisting of lawyers, former prosecutors, and analysts investigating organized crime schemes such as refund fraud. It is reported that the company also fired employees who were allegedly bribed for leaking confidential data about third-party sellers.
Cyril Noel-Tago, a cybersecurity expert who has thoroughly studied refund fraud, said the economic incentive for low-paid workers to participate in these schemes creates a persistent problem for retailers.
"If you're offering an employee a lot more than they're being paid, it's pretty hard to fight," Noel-Tago, who works as chief security researcher at Netacea, a bot-detection software company, told CNBC.
"All you need is a phone"
Those looking for money-making opportunities will find no shortage of promotional videos on social media. For a fee, you can learn how to play the game.
One TikTok video on this topic shows bags with Louis Vuitton, Gucci and Apple products and says: "[Opinion]: You have mastered the art of r3funding and started teaching others." TikTok videos often serve as ads for the user's Telegram channel, which is linked to in the user's account bio.
A similar tactic is used on Reddit.
On the Illegal Life Pro Tips forum on Reddit, which is no longer active but has 1.1 million members, the scammers shared their tips and tricks. In recent days, Reddit has banned an offshoot of this subreddit called "illegallifeprotips2", saying that it violates the site's rules "against transactions involving prohibited goods or services". Users quickly reappeared in the new "ELegalLifeProTips" subreddit. After CNBC labeled ELegalLifeProTips, Reddit removed the subreddit for violating the ban evasion policy.
In the past, such illegal behavior was common on the dark web and required a VPN and a dedicated browser, said Brittany Allen, a trust and security architect at Sift, a fraud detection company. These days, attackers regularly openly discuss their activities on forums and messaging apps, which Allen called " democratizing fraud."
"You don't need to be an expert to figure out how to find these deep web groups," Allen said. "All you have to do is have a phone that can go to Reddit, or a TikTok account that you already have, and you're potentially exposed to a scam that doesn't require as much growth to participate in."
Remy Vaughn, a Telegram spokesperson, told CNBC in an email that the company moderates "harmful content" on its platform, including posts promoting fraud. "Moderators use a combination of proactive moderation on publicly accessible parts of the platform and accept user reports to remove content that violates Telegram's terms," Vaughn added.
A Reddit spokesperson said it uses a combination of automated tools and human moderators to enforce its content policy, which prohibits users from requesting or facilitating any transactions involving fraudulent services.
After CNBC provided TikTok with examples of videos about refund fraud, the company said it removed them for violating community guidelines. It also said that it also blocked hashtags that were used to promote refund scams.
The use of core applications in these schemes has made the work of investigators easier. Noel-Tago referred to a case where a retailer was able to track down the identity of the person whose email address was in an Instagram post.
Allen said she was able to identify the scammers through "vouchers" or screenshots of successful fraudulent returns. According to Allen, some of the images show order numbers, pick-up locations in stores, or items in the cart, all of which are useful information for retailers investigating return fraud.
David Johnston, vice president of asset protection and retail operations at the National Retail Federation, said more companies are "increasing their return policies" in response to customer abuse and fraud.
Delivery workers, for example, are encouraged to take photos of a package when it reaches its destination, and retailers are more careful to look for suspicious behavior by analyzing returns.
"There are some retailers that track the number of returns you make in - store, and if you return too often, they can put you on pause," Johnston said. "Now we're starting to see more of that on the ecommerce side."
