Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service

Zhibo Sun

∗

, Adam Oest

∗

, Penghui Zhang

∗

, Carlos Rubio-Medrano

‡

Tiffany Bao

∗

, Adam Doupé

∗

, Gail-Joon Ahn

∗§

∗

Arizona State University,

‡

Texas A&M University - Corpus Christi

¶

Rochester Institute of Technology,

Samsung Research

protocols. Timely detection of such scams is difficult as they

are fueled by an extensive suite of criminal services, such

as credential theft, document forgery, and fake shipments.

Ultimately, the scam enables malicious actors to steal arbitrary

goods from merchants with minimal investment.

In this paper, we perform in-depth manual and automated

analysis of public and private messages from four large

underground forums to identify the malicious actors involved

in CAaaS, carefully study the operation of the scam, and

define attributes to fingerprint the scam and inform mitigation

1 Introduction

In concession abuse attacks, scammers leverage social

engineering techniques to exploit the return policies of

targeted merchants and obtain a concession (in the form

of a refund or a replacement item) without returning any

originally purchased products. Recent news of Amazon being

scammed out of

300,000 and $1.2M in 2017 and 2019 in

two targeted concession abuse attacks reveals the tremendous

(and growing) damage that such attacks can cause [

14

,

45

].

These attacks become particularly heinous when scammers

mitigation and the happiness of legitimate customers.

A perception by vendors who fall victim to concession

abuse may be that these attacks are isolated incidents and

a comprehensive analysis of underground forums and a

concession abuse provider, we find that such attacks operate

at scale, target merchants across multiple industry sectors,

actors, and overcome current industry best practices and

mitigations to reliably yield success for the criminals.

(service providers) engage with a targeted merchant to execute

the scam. The scam initiator’s ultimate goal is to obtain money

from a purchased order via a concession from the merchant

after paying a nominal commission to the service provider.

Despite its surface simplicity, CAaaS is a sophisticated

online criminal industry that coordinates a diverse range of

parties to facilitate key stages of the scam. An end-to-end

components such as stolen account credentials [

42

implementation of the attacks, and then conduct a survey as

a preliminary evaluation of the proposed mitigations.

targeted merchants are distributed globally, and we found

that CAaaS has not only remained active but is becoming

more prevalent in recent years, despite the evolution of retailer

return policies to prevent fraud. We identified underground

communities in which users discuss scam questions, share

their success and failure experiences, and even post tutorials

for beginners. We found that these resources help train

ill-intentioned users to become CAaaS service providers

people into performing actions or divulging confidential

information [

3

,

8

,

12

,

29

reshipping services [

return policies was studied in an offline context [

CAaaS combines and enhances these areas of cybercrime to

target a unique part of the attack surface against retailers.

By performing the first such study of CAaaS, we help

identify ways to disrupt the economics of the scam and

empower vulnerable retailers to implement proactive defenses.

Our contributions are thus as follows:

of such techniques.

We identify attributes to fingerprint CAaaS, propose mit-

approaches through merchant interviews and a user survey.

2 Overview

Concession abuse is a type of cybercrime that typically

targets online merchant services.

customer seeks to receive a concession—a free replacement or

a refund—from a targeted merchant by socially engineering

In this transition, each scammer’s role has expanded amid an

where individual cybercriminals can quickly gain expertise

in their specific roles. Consequently, the barrier to entry has

been greatly lowered such that even unskilled criminals can

leverage and profit from concession abuse.

In this paper, we study the ecosystem of concession abuse as

4.

How can merchants prevent concession abuse from

succeeding at scale (Section 6)?

We used a qualitative approach for

Question 1, a quantitative approach for Question 2, and hybrid

approaches for Questions 3 and 4. For clarity, we describe

each approach in its respective section.

We base our analysis of CAaaS on four

distinct data sources discussed throughout the remainder

of this paper: threads and posts from underground forums,

messages in private criminal groups, interviews with two large

the refund form if your order is already delivered.” The form

includes detailed questions regarding the order, account,

and the expected outcome (e.g., refund or replacement). For

example, if a scam initiator places an order, they need to

provide the type of payment, preferably “the last 4 digits

of the card”, and clarify if they have “received or signed for

the delivery.” For more information, we present a real-world

service form in Table 7 in Appendix A.

3.3 Execution

After the deal is made and the initial order is placed, service

providers contact the targeted merchant and attempt to deceive

the CSR into providing a concession. In the conversation

between the service provider and the CSR, there may be

conditions that prevent the concession abuse scam from suc-

ceeding. In these conditions, the service provider may leverage

the services provided by supporting agents. We list these

conditions with the associated supporting agents in categories

below, and we will elaborate on each category in Section 5.2.

Return Requirement.

Accountholder Notifications.

After the concession is

3.4 Monetization

via an e-gift card or a replacement sent to a specific address.

Replacement to Cash.

If the concession is a replacement

15

] as the reshipping agents. The

E-gift Card to Cash.

To quickly cash out an e-gift card, the

e-gift card to order an item and then resell it using the

aforementioned method.

a target merchant that sells this product. Finally, the provider

uses the refund(s) to purchase the designated product for the

initiator. As a result, the scam initiator gets a product at a price

payment for the service.

4 Analysis of CAaaS Features and Scale

As an emerging threat, CAaaS has a number of unexplored

aspects, therefore we focus on the following questions:

1. Which merchants and goods do scammers target? (§ 4.2)

2. How much do providers earn from the service? (§ 4.3)

scammers and other types of scammers? (§ 4.8)

4.1 Analysis Approach

To draw insights about large-scale activity in underground

forums that extend beyond the qualitative manual analysis

described in Section 3, we train a machine learning classifier

and apply it to the whole dataset. Our approach is composed

of three steps.

We randomly sampled 4,000 threads

(1,000 in each forum) from the crawled forum data using

Stratified Random Sampling [

23

], and we manually labeled

Advertisement, Purchasing Request, Discussion and

Support, and CAaaS-unrelated. These labels help to

identify CAaaS-related posts and actors and will be used

to answer all the questions.

Scamming Experience.

For Question 5, we classified CAaaS-

related threads by scamming experience: Successful,

Failed, and Neutral experiences. These labels help to

identify the conditions and the time that a scam succeeds

or fails.

providers.

labeled samples to train a well-performing machine learning

model and applied the model to the full dataset. We performed

three steps to process the raw data [39, 44]:

We first converted text to vectorized features with Term

Frequency-Inverse Document Frequency after the threads are

To understand what targeted merchants are advertised, we

used Standford NER [

merchants. We identify 264 targeted merchants from all

advertisements using this semi-automatic approach.

From a service provider’s perspective, as

shown in Table 14, the provider cares more about the store,

payment methods, order value, region, and the number of items

than the goods themselves. From a scam initiator’s perspective,

CAaaS threads from the NULLED database. Then, we used

the IP2Location service [

level [35], to determine the country of CAaaS scammers.

Figure 4: Trends in new scammer registrations and total forum

members, monthly from 2006 to 2018.

IP2Proxy, using IP2Proxy can provide insights into scammers’

geographical distribution by excluding popular and public

anonymous IP addresses.

merchants in Europe, Asia, and North America, such as

YOOX, Lenovo, and Microsoft. Also, scammers target large

merchants who have a presence in multiple countries, such

his capability of scamming Amazon in seven countries. The

provider can refund the highest value orders from Amazon

US and take the shortest time from Amazon Netherlands.

4.5 Scam Scale

We counted the number of newly registered scammers

In general underground forums, MPGH and SIN, where

Figure 5: Trends in newly created scam threads and total

threads, monthly from 2006 to 2018.

another general hacking forum, NULLED, we do not observe

that the data in NULLED is between 2015 and May 2016.

We also studied the activity of users discussing CAaaS in

underground forums. We considered the number of newly

created scam threads and overall threads in each forum (as

opposed to the number of replies) because new threads are

indicative of new instances not previously discussed. To

have stable or even decreasing trends. Although there is a

slightly increasing trend since 2017 in the SENet forum,

fewer threads were started compared with earlier. A possible

the underground communities, which states that the SENet

forum was taken down by law enforcement, and it now is a

trap for scammers.

4.6 From Novice to Seasoned Scammer

Based on our manual analysis of the four forums, we notice the

significant amount of resources for novices helps them learn

provide full-service guidance for scammers from learning

scam tricks to running their scam services.

Scammers share their scamming experience to inspire and

support other scammers as well. For example, one scammer

shares that “It was pretty easy, I ordered a laptop from DX and

I contacted them I didn’t got it so they sent a new one.”, and

another group of scammers provide suggestions as shown in

Figure 6.

Figure 6: Support received from experienced scammers.

Figure 7: The growth of scammers over time while learning.

and joined date extracted from the raw HTML files. We first

identified novices by finding the accounts that initiate a CAaaS-

Discussion & Support thread (to seek help), do not provide

any services. Then, we leveraged the scamming experience

classifier 4.1 to find scammers who share both failed and suc-

cessful scamming experience, and the first failed experience

date should be earlier than the first successful experience date.

Through this method, we identified 94 novice scammers that

sophisticated techniques such as starting a scam-related

business, based on our manual analysis of their posts.

We then identified the amount of time it took them to post

forum and their first successful scamming experience. The

top figure (“Novice”) in Figure 7 shows the growth of novice

scammers over the time of their experience.

We find out that 50% and 80% of these novice scammers

posted their first failure within 10.6 and 72.4 days, posted their

first success within 46.7 days and 293.1 days, and took an

Figure 8: Timeline of the activities of a scammer who

eventually switched roles and became a service provider.

shows the growth of these 116 scammers over time: 50% of

such service buyers take 67 days to start their business after

to hire a service provider 33 days later. Then, after learning

about the scam, the scammer started to defraud merchants

directly: As evidence, they attempted to buy a forged image

and sought help for scamming 51 days and 93 days after

joining the underground forum, respectively. Ultimately, they

became a service provider 142 days after joining the forum.

4.7 Financial Loss

It is impractical to directly estimate the financial loss caused

by CAaaS solely based on the posts in underground forums

because: (1) scam initiators do not frequently vouch for

on external platforms (such as Telegram) in which scammers

the financial loss caused by individual service providers.

To this end, we joined the Telegram group of a well-known

provider introduced in Section 4.2. We collected all public

messages, pictures, and member profiles visible in this

Telegram group.

Due to the popularity of CAaaS, the provider

converted the group to a supergroup (maximum 100,000 mem-

Table 5 shows the number and ratio of CAaaS actors in

non-scam activities and in non-CAaaS scams. We observe

However, few CAaaS actors are involved in other types of

scams. This may be because concession abuse shares little in

common with other scams and requires a different skillset.

There are three typical ways to contact a CSR: phone, live chat,

or e-mail. Scammers prefer phone calls for two reasons: First,

politely when interacting with CSRs. They call CSRs by

their names, express understanding of the mistakes, and

show appreciation for their help: “Fear or threats are not

recommended for scamming”, as a tutorial says “Be somewhat

charismatic and do not have an attitude with the reps.”

legal regulations to avoid returning the merchandise. For

example, a CAaaS service provider may complain about a

and lie to the latter CSR about an agreement with the previous

CSR. For example, a scammer states in a tutorial that if they

make two calls a few minutes apart, they are usually connected

to a different CSR in the second call. They then lie to the

CSR was processing the refund. In this way, they may receive

a concession from the second CSR without needing to provide

any concrete justification.

Failure of a package to arrive is the

For example, CSRs may ask if the scammer can ask their

family members and neighbors or check both front and back

doors. Scammers respond: “Yeah, I asked my parents, they

didn’t see it. But I haven’t checked with my neighbors. Can

you wait a minute and I can ask them.” Then a few minutes

later, they tell the CSRs that the neighbors do not see it.