Triangulation Fraud & Managed Payments

[valueaddedresource]

For anyone who doesn't remember, my first posts here in the community were related to a sophisticated triangulation fraud scheme that was targeting the company I work for.

https://community.ebay.com/t5/Selling/Warning-Retail-Arbitrage-Credit-Card-Fraud/m-p/30822324#M15727...

It's been almost a year, and a lot has changed on eBay since then, so I thought it might be time to revisit.

First, I short rundown on what triangulation fraud is -

Fraudsters use possibly hijacked eBay accounts to list items and when they sell on eBay they "drop ship" it to their eBay buyer from another marketplace or legitimate retail website using a stolen credit card for that off eBay order.  The legitimate website then ends up being out both the product and the money when a chargeback is eventually filed.

This fraud hit my company for about $160K in 2020, eBay has been aware of this type of fraud for years and does very little about it.  Read my previous thread for all the details.

The reason I think it's worth bringing up again is, in more than one conversation with various eBay personnel I was told they expected the roll out of Managed Payments to significantly hamper this type of fraud.

I was assured multiple times by multiple trust and safety reps as well as a vertical manager for our category that "eBay will be able to do more to stop this kind of fraud with Managed Payments because payments will be handled by eBay not a third party(PayPal) and sellers will have to provide their financial info to us."

I've kept track of every account I have identified and reported to eBay as part of this fraud.  Out of about 150 accounts reported, 45 are currently still actively selling.

Back in November 2020, all 45 of those currently active were still using PayPal.  As of 2/13/2021, 19 of the 45 have been converted over to Managed Payments and are still actively selling fraudulent items.

It would seem that Managed Payments isn't slowing the fraudsters down much, nor has it prompted eBay to take action on any of these accounts that are very clearly being used for fraud. 😯

[mama_583368]

---

@valueaddedresource wrote:

Fraudsters use possibly hijacked eBay accounts to list items 

As of 2/13/2021, 19 [possibly hijacked eBay accounts] have been converted over to Managed Payments and are still actively selling fraudulent items.

---

[go-bad-chicken]

I am glad that you have started this post here on the eBay community payments board. As sellers, its really important that we stay up to date and educated on this subject because there is a whole bucket load of various types of financial frauds that exist in the world today. And they could strike anyone of us at any time now or in the near future. 

"I was assured multiple times..........that ""eBay will be able to do more to stop this kind of fraud with Managed Payments because payments will be handled by eBay not a third party(PayPal) and sellers will have to provide their financial info to us.""

I attended eBay Open in 2019. And just like you stated above, during that event these same reassurances where repeatedly given, over and over multiple times by both eBay executives as well mid level employees from the Managed Payments Team, who were presenting various different 50 minute long panels on the subject of Managed Payments. Its possible that somewhere on the internet there may be some form of record or transcripts available, from those sessions.

I wanted to add to this thread some information and articles produced and presented by Adyen (eBay's payment processor for Managed Payments) on the subject of financial fraud. This content is available and viewable directly on Adyen's website.

The first link is to an article titled "Beating Payments Fraud" that Adyen published on their blog this past September. The article not only talks about Triangulation Fraud, but a whole host of other types of financial frauds that I never even knew existed.

IMO its worth an eBay sellers time (about 10 minutes) to give it a read for the purpose of familiarizing oneself with what's out there.

https://www.adyen.com/blog/beating-payments-fraud 

Also here is a link to a plethora of information on the subject of "Fraud" produced by Adyen and found using their search function located within their website.

Happy reading.😃

https://www.adyen.com/?website%5Bquery%5D=Frau&query=Fraud#search-modal 

[valueaddedresource]

Thanks @go-bad-chicken , those are some great resources!

I've been pleasantly surprised at how much info is publicly available on Adyen's site.

I agree it is in every seller's interest to educate ourselves as much as we can both about fraud in general and eBay's chosen payment partner. 👍

[valueaddedresource]

@go-bad-chicken   - one thing I find interesting after going through those articles is they all speak to fraud occurring on the payments side from buyer, which doesn't exactly help on the eBay side of things in the case of triangulation fraud like I have been dealing with.

With this fraud, the initial payment from buyer to fraud seller on eBay is legitimate and would not raise any red flags.  The buyer is usually innocent/unaware and they are using their real, legitimate payment information.

Stolen credit cards are used by the fraudulent seller in the "drop ship" part of the triangle that occurs off eBay.

The part that eBay and Adyen need to be scrutinizing in regard to this specific kind of fraud should be the fraudulent seller's financial and personal information, not the buyer's.

That is what was presented to me by eBay as the reason this kind of fraud would greatly diminish under Managed Payments.  In theory, having to provide bank account, SSN, etc. would weed out the bad actors. 

And in all fairness, it may be weeding some of them out.  But almost half of the still active fraud accounts I've been tracking have been switched over to Managed Payments in the last 3 months and it doesn't seem to have slowed them down for even a second.

That causes me to have some serious concerns about eBay and Adyen's verification procedures at the very least.

[go-bad-chicken]

---

@valueaddedresource wrote:

@go-bad-chicken   - one thing I find interesting after going through those articles is they all speak to fraud occurring on the payments side from buyer, which doesn't exactly help on the eBay side of things in the case of triangulation fraud like I have been dealing with.

With this fraud, the initial payment from buyer to fraud seller on eBay is legitimate and would not raise any red flags.  The buyer is usually innocent/unaware and they are using their real, legitimate payment information.

Stolen credit cards are used by the fraudulent seller in the "drop ship" part of the triangle that occurs off eBay.

The part that eBay and Adyen need to be scrutinizing in regard to this specific kind of fraud should be the fraudulent seller's financial and personal information, not the buyer's.

That is what was presented to me by eBay as the reason this kind of fraud would greatly diminish under Managed Payments.  In theory, having to provide bank account, SSN, etc. would weed out the bad actors. 

And in all fairness, it may be weeding some of them out.  But almost half of the still active fraud accounts I've been tracking have been switched over to Managed Payments in the last 3 months and it doesn't seem to have slowed them down for even a second.

That causes me to have some serious concerns about eBay and Adyen's verification procedures at the very least.

---

I am curious. With the accounts that you have identified as being fraudsters, are those accounts and their associated listings registered as being located within the USA?

I ask because the one account of mine that is currently enrolled and active in Managed Payments, enrolled as a business account and was and is setup as an S Corp. That company has an EIN. When I enrolled in MP and provided eBay with all of my information I was under the misconception that I would just have to provide eBay with that company's EIN. That was not the case and I ended up having to provide eBay with personal information and SSNs of everyone individual who held more than a 25% share in that company.

I would assume and I could be very wrong that that alone would identify fraudulent accounts as those sellers would be providing information that if properly vetted would not or I should say should not pass mustard.

[valueaddedresource]

---

@go-bad-chicken wrote:

---

@valueaddedresource wrote:

@go-bad-chicken   - one thing I find interesting after going through those articles is they all speak to fraud occurring on the payments side from buyer, which doesn't exactly help on the eBay side of things in the case of triangulation fraud like I have been dealing with.

With this fraud, the initial payment from buyer to fraud seller on eBay is legitimate and would not raise any red flags.  The buyer is usually innocent/unaware and they are using their real, legitimate payment information.

Stolen credit cards are used by the fraudulent seller in the "drop ship" part of the triangle that occurs off eBay.

The part that eBay and Adyen need to be scrutinizing in regard to this specific kind of fraud should be the fraudulent seller's financial and personal information, not the buyer's.

That is what was presented to me by eBay as the reason this kind of fraud would greatly diminish under Managed Payments.  In theory, having to provide bank account, SSN, etc. would weed out the bad actors. 

And in all fairness, it may be weeding some of them out.  But almost half of the still active fraud accounts I've been tracking have been switched over to Managed Payments in the last 3 months and it doesn't seem to have slowed them down for even a second.

That causes me to have some serious concerns about eBay and Adyen's verification procedures at the very least.

---

I am curious. With the accounts that you have identified as being fraudsters, are those accounts and their associated listings registered as being located within the USA?

I ask because the one account of mine that is currently enrolled and active in Managed Payments, enrolled as a business account and was and is setup as an S Corp. That company has an EIN. When I enrolled in MP and provided eBay with all of my information I was under the misconception that I would just have to provide eBay with that company's EIN. That was not the case and I ended up having to provide eBay with personal information and SSNs of everyone individual who held more than a 25% share in that company.

I would assume and I could be very wrong that that alone would identify fraudulent accounts as those sellers would be providing information that if properly vetted would not or I should say should not pass mustard.

---

@go-bad-chicken  all of the listings show US locations.  A few are foreign registered (mostly Russia, Israel, and Vietnam it seems), but the large majority have been US registered accounts.

I was slightly skeptical, but cautiously optimistic, when eBay reps told me Managed Payments would cut down on this fraud exactly for the reasons you described. In theory, the Know Your Customer (KYC) provisions and requirements for personal info, SSN, etc. should be enough to catch and shut down fraudulent accounts.

I don't know why it doesn't seem to be working that way in practice, and again in all fairness it may be catching some of them, but all I can say is it doesn't seem to have slowed down the fraudsters I've been tracking in any significant way. 

[valueaddedresource]

@go-bad-chicken  I found some interesting info about Adyen and KYC here  https://docs.adyen.com/platforms/verification-checks 

Based on the varied experience sellers are having (some being asked for driver's license, bank statement etc. and some not), I'd say eBay has gone for the "staggered approach"

So maybe the fraudsters have gotten lucky and just had to provide the bank account & routing number and something that looks like a valid SSN...and then later on if asked for further info to verify they will just abandon that account and move on to another one?

Or I guess it's entirely possible the fraudsters have everything they need to pass KYC. ☹️ I've gone pretty deep down this rabbit hole and it's clear this is a very sophisticated, calculated fraud scheme.

They seem to have an almost endless trove of stolen credit card info, so I don't think it would be out of the question that they could also have all the PII necessary to open an online bank account and have matching documents to send to eBay for verification either using fake IDs or real ones that have been stolen. 

[valueaddedresource]

---

@valueaddedresource wrote:

---

@go-bad-chicken wrote:

---

@valueaddedresource wrote:

@go-bad-chicken   - one thing I find interesting after going through those articles is they all speak to fraud occurring on the payments side from buyer, which doesn't exactly help on the eBay side of things in the case of triangulation fraud like I have been dealing with.

With this fraud, the initial payment from buyer to fraud seller on eBay is legitimate and would not raise any red flags.  The buyer is usually innocent/unaware and they are using their real, legitimate payment information.

Stolen credit cards are used by the fraudulent seller in the "drop ship" part of the triangle that occurs off eBay.

The part that eBay and Adyen need to be scrutinizing in regard to this specific kind of fraud should be the fraudulent seller's financial and personal information, not the buyer's.

That is what was presented to me by eBay as the reason this kind of fraud would greatly diminish under Managed Payments.  In theory, having to provide bank account, SSN, etc. would weed out the bad actors. 

And in all fairness, it may be weeding some of them out.  But almost half of the still active fraud accounts I've been tracking have been switched over to Managed Payments in the last 3 months and it doesn't seem to have slowed them down for even a second.

That causes me to have some serious concerns about eBay and Adyen's verification procedures at the very least.

---

I am curious. With the accounts that you have identified as being fraudsters, are those accounts and their associated listings registered as being located within the USA?

I ask because the one account of mine that is currently enrolled and active in Managed Payments, enrolled as a business account and was and is setup as an S Corp. That company has an EIN. When I enrolled in MP and provided eBay with all of my information I was under the misconception that I would just have to provide eBay with that company's EIN. That was not the case and I ended up having to provide eBay with personal information and SSNs of everyone individual who held more than a 25% share in that company.

I would assume and I could be very wrong that that alone would identify fraudulent accounts as those sellers would be providing information that if properly vetted would not or I should say should not pass mustard.

---

@go-bad-chicken  all of the listings show US locations.  A few are foreign registered (mostly Russia, Israel, and Vietnam it seems), but the large majority have been US registered accounts.

---

@go-bad-chicken  I should clarify that all of the active fraud accounts on my list that have been switched to Managed Payments so far are registered in the US.

The few that are not US registered are still using PayPal at this time.

[simba6]

Buyers can do their part too.  Avoid too good to be true listings. Watch out for long dormant accounts selling popular, high value items all of a sudden. Accounts with user id's that look computer generated. Like SY234 and such.  A seller that has all their feedback from penny items now is selling high end items all of a sudden.

Item listings that charge far less for shipping than what it would cost. Example, large heave items with first class package listed as the shipping.

[valueaddedresource]

---

@simba6 wrote:

Buyers can do their part too.  Avoid too good to be true listings. Watch out for long dormant accounts selling popular, high value items all of a sudden. Accounts with user id's that look computer generated. Like SY234 and such.  A seller that has all their feedback from penny items now is selling high end items all of a sudden.

Item listings that charge far less for shipping than what it would cost. Example, large heave items with first class package listed as the shipping.

---

@simba6  I agree that buyers should absolutely vet their sellers before purchase. 

However, in my opinion, the responsibility for doing something about this fraud rests 100% on eBay - especially now that eBay has decided they want to be in the payments business and rake in all that extra $$$ from doing so.

This is wide ranging and systemic. eBay absolutely knows it and benefits financially from turning a blind eye.  That image I posted with the triangle (with my own additions to help explain the fraud), that was gleaned from a Krebs on Security article from 2015 and guess where he got it.....directly from an eBay help page.  https://krebsonsecurity.com/2015/11/how-carders-can-use-ebay-as-a-virtual-atm/ 

An eBay employee admitted to me that eBay senior management has been aware of this kind of fraud for years, $100K+ was not a surprising amount, and he was aware of several "very large accounts" that quit eBay after being targeted by this fraud.

eBay has a reputation as being a marketplace where you can find bargains. They've encouraged that reputation in many ways, even though in recent years they've tried to grow beyond that.  When your brand reputation is basically "this is where you can go to find a bargain", can we really blame buyers (especially new, inexperienced ones) for thinking that's exactly what they are getting without thinking there may be something more nefarious in play?

For some perspective, when I was first researching the triangulation fraud, one of the things that helped me connect the dots was a video from Nina Kollars called "Confessions of a Nespresso Money Mule" (Google it if you are interested).

This woman is a highly regarded cyber security expert - yet she ended up buying Nespresso coffee pods from a triangulation scammer on eBay and had no idea that was what was going on until the package showed up and things didn't add up.

So I'm sorry, but I am hesitant to throw the buyers under the bus here.  All of this rests squarely on eBay's shoulders and there is so much more they could be doing proactively to address it.

[simba6]

I was trying to say, everyone needs to do their part. Both buyers and eBay.

[valueaddedresource]

---

@simba6 wrote:

I was trying to say, everyone needs to do their part. Both buyers and eBay.

---

@simba6  I understand, I just personally don't think buyers have an obligation to "do their part" in quite the same way that eBay does.   It is eBay's responsibility to make this a safe and trusted platform for all users, so they are obligated to both buyers and sellers in this regard.

Buyers ideally should educate themselves to look for red flags and report those red flags to eBay, you'll get no argument from me on that.  But that is nowhere near the fiduciary responsibility that eBay has in this matter, especially now with Managed Payments.

What we may wish buyers would do and what eBay has a fiduciary responsibility to do are such completely different things - legally, ethically and otherwise - that in my mind they don't even belong in the same sentence.

[cornchop1]

My company is wasting hours per day looking for triangulation scam orders. We try to void the charges before they get batched so that we don't get chargebacks. It is challenging because the scammers continually change tactics. I don't waste time notifying eBay anymore. They haven't shut down any of the 25 scammer accounts I have notified them about. Some of these accounts have been around for years and have over 100 feedbacks and all of their listings are scams. EBay doesn't seem to care.

I bought an item from one of the scammers who got us as an experiment. It was never delivered because the company they tried to buy it from with a stolen credit card stopped the order. The scammer said he couldn't ship because of Covid and offered to pay me $5 for my trouble. I didn't respond and left negative feedback and reported them to eBay. EBay did nothing and the account is still active.

I think it would be helpful if there were a forum where sellers could keep a database of triangulation scam seller accounts. It might help us figure out which items they are targeting next and let buyers know who to avoid.

[simba6]

What allows that to happen is businesses that will ship items to other than the card holder's address.