Security firm Flashpoint says criminals are trading in refund tricks, gift card fraud and hacked online stores ahead of the holidays. Shop owners should check their refund steps.
A retailer can lose money twice on one order. First it ships a replacement. Then it approves a refund for the same order. Security firm Flashpoint says that kind of trick is part of underground activity it saw ahead of the holiday shopping season, in an analysis published Nov. 2.
Flashpoint described criminals discussing and advertising several things: refund abuse, gift card fraud, fake retailer support accounts and access to compromised online stores. These are overlapping risks. A fake support account can trick a shopper. A hacked store can expose customer information. A weak refund process can leak cash.
The main targets are online and brick-and-mortar retailers, especially their customer support and payments teams. Shoppers who deal with support channels are also in the picture, because fake retailer accounts can pose as real help.
The risk is not only technical. Staff make judgment calls when a customer disputes a delivery, asks for a replacement or wants to change an account. Pushy or emotional requests can wear down checks. The material points to other cases where tricking employees led to leaked files with personal information, including incidents at the law firms Baker McKenzie and Troutman Pepper Locke.
The picture is not as alarming as it may sound. Flashpoint said the listings do not show flaws in the store platforms involved. It also said the way attackers got in was not consistently disclosed. Its analysis describes conversations and ads, and it did not measure an industrywide rise in successful fraud.
One test for a shop: can a support agent see that another team already issued a replacement or refund for the same order? If systems cannot show that history in one place, a documented manual check helps before approving another exception.
Checkout pages deserve a separate look. A normal-looking checkout can hide payment theft. In May 2022, Microsoft documented attackers hiding malicious code and disguising JavaScript as familiar analytics scripts. A purchase can pass fraud screening while the page itself has been tampered with.
The alert box above lists the steps. In short, tighten who can approve refunds, clean up who can log in to your store, and make your real support channels easy for customers to find.
If you run a shop, make sure no refund or replacement goes out without a check, and review who has admin access to your store.
Fake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourselfThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone number
