Flashpoint observed underground schemes targeting retailers through fraudulent delivery disputes, refund-and-replacement abuse, gift card fraud, and fake customer-service accounts. The schemes exploit support processes and can cause a retailer to send replacement goods and then approve a fraudulent refund for the same order.
Fraud rings target retailer support and refund processes rather than technical systems. According to Flashpoint, the core tactic involves a customer falsely claiming that a delivery was missing, a package arrived empty, or an item was incorrect. The request then asks support staff to both ship a replacement and process a refund for the same order, letting the retailer lose value twice on a single transaction.
A second track of this activity involves fake customer-service accounts that impersonate a retailer. These accounts steer shoppers toward external channels that fall outside the retailer's official support process, where normal verification and case-record checks do not apply. Underground advertisements have also referenced access tied to ecommerce platforms including Shopify, Magento, and OpenCart.
These schemes work because refund, replacement, payment, and account-change actions are often handled by separate teams without shared visibility. An agent approving a refund may have no way to see that another team already issued a replacement for the same order. Urgent or emotional language from the customer can also push staff to resolve the issue quickly rather than complete the verification steps.
Retailers can reduce exposure by requiring a defined verification process and clear escalation route for refund, replacement, and account-change requests, especially when evidence conflicts. Giving agents visibility into whether another exception has already been granted for an order closes one of the main gaps fraudsters exploit. Staff also benefit from practicing how to handle urgent or emotional requests without skipping required checks.
For gift cards, reviewing purchase and redemption activity together is more reliable than flagging large purchases alone. Finally, publishing official support channels clearly and giving customers a simple way to report suspected impersonation accounts helps limit the reach of fake customer-service operations that try to move shoppers off-platform.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a scheme where a fraudster falsely claims a delivery was missing, empty, or incorrect in order to get both a replacement item shipped and a refund approved for the same order.
Some fraud operations set up fake customer-service accounts that impersonate a retailer and direct shoppers to external channels, bypassing the retailer's normal verification and case-record process.
Support and fraud teams need visibility into whether another team has already issued a replacement or refund for the same order before approving a new exception.
Review gift card purchasing and redemption activity together rather than flagging large purchases alone, since a flagged payment followed by rapid redemption is a stronger signal of fraud.
One order can cost us twice. An email says, ‘My delivery is missing. Please send a replacement and process my refund.’ Another version claims the box was empty or the item was wrong. Here’s the double-dip: one team ships a replacement; another refunds the same order. A request to skip verification, or records that conflict, is your warning. Before approving either exception, check the full order history for prior refunds or replacements.
An Australian Shopify store was advised to stay closed after a third‑party app/theme extension injected malicious code that redirected shoppers to a fake checkout page. Two app vendors (Logbase and HulkApps) reported unauthorized access or configuration changes that inserted scripts designed to…
Elastic researchers documented real intrusions in which attackers used deceptive verification pages, fake invitations, and phishing sign-in workflows to gain access. In confirmed infostealer cases, attackers used stolen credentials an average of eight minutes after infection, and one healthcare…
Retailers face a peak-season gift-card fraud campaign in which attackers use phishing emails and text messages to trick employees into giving up credentials. After gaining access, the attackers use cloud systems and sensitive data to issue unauthorized gift cards at scale and convert them into…
A commercial Android spyware kit called uCreator hides inside modified versions of legitimate messaging apps, including Telegram X. Victims who sideload these lookalike apps may expose Telegram two-step verification passwords or have WeChat account data copied, even while the altered app continues…
Attackers used fake Microsoft sign-in pages to capture already-authenticated Microsoft 365 sessions, then replayed those sessions to enter business accounts without passwords or new MFA prompts. The campaign affected 79 organizations and expanded access by registering rogue devices, changing MFA…
Keystone confirmed that an attacker accessed customer shipping and order information, and a customer reported a social-engineering phone call using those details. The exposed information can make fake support messages and calls about refunds, replacement devices, or order fixes sound credible.…
