ZeroTrace


> 👨‍💻 Written with curiosity by `NemeSys@`

### What Are Buyer's Clubs? (And Why Should You Care?)

Picture this: You join an exclusive club where you're told exactly what to buy on any major e-commerce platform (eBay, Amazon, Etsy, Walmart, etc.), ship it to a specific address (operated by the Buyer’s Club, of course), and get paid back - all while earning sweet credit card rewards. Five nights in Bali paid for by rewards at no cost to you? Sounds too good to be true, right? Well, it's real, and it's called a Buyer's Club!

### 🧾 The Basic Breakdown:

- Members buy specific items (usually electronics)  
- Ship to designated addresses  
- Get reimbursed (sometimes with a small profit or stipend)  
- Rack up credit card points/miles  
- Some clubs even help with tax exemptions! 🤑

### The Dark Side of the Deal

But here's where things get spicy. Many e-commerce investigations teams, myself included,  have uncovered some challenges with Buyer’s Clubs and exposed the criminal underbelly of some of these groups. While the basic concept of a Buyer’s Club isn't illegal, some bad actors use these clubs as a front for less-than-honest activities. Think "lost" packages that weren't really lost, if you catch my drift.

### When Buyer's Clubs Go Bad

While many buyer's clubs operate legitimately, investigators have identified these operations as potential havens for various criminal enterprises. Let's dive into the concerning trends (I’ll provide my exact investigation methodology in a little bit):

### Money Laundering Highway 🚩

- Criminal groups can easily wash illicit funds through high-volume purchases
- Rapid turnover of goods helps legitimize suspicious money flows
- Tax documentation can be manipulated to create paper trails

### The Double-Dip Scheme 💸

- Members claim items weren't received while selling them through clubs
- Exploitation of liberal return policies
- Coordinated fraud rings disguised as legitimate buyers

### Identity Theft & Account Takeover 🕵️

- Stolen credentials used to make purchases
- Compromised business accounts exploited for tax exemptions
- Stolen goods trafficked through seemingly legitimate channels

### The Perfect Cover 🎭

- Complex network of addresses provides anonymity
- Business registrations create legitimate facades
- High volume of transactions masks suspicious patterns
- Multiple layers of shipping make tracking difficult

### Why It's Hard to Stop

The genius of criminal exploitation of buyer's clubs lies in their ability to hide in plain sight:

- Legitimate members provide cover for bad actors, making it difficult to sort out who is a bad actor and who isn’t
- Complex shipping networks obscure final destinations, wherein we might never be able to identify where the products ultimately go after being delivered to the Buyer’s Club
- Business documentation appears authentic
- High transaction volumes make pattern detection challenging

## Is it Detectable?

For e-commerce security professionals and retail loss prevention teams, several key indicators can help identify organized buyer's club activities:

**Order Pattern Analysis**

- Multiple orders from different accounts shipping to the same address
- High-volume purchases of the same SKU within short timeframes
- Unusual geographical patterns (orders from multiple states to a single location)
- Frequent bulk purchases of high-demand items

**Product Indicators**

- Focus on high-margin electronics and gaming consoles
- Consistent purchasing of newly released products
- Pattern of buying items with strong resale value
- Bulk purchases of limited-edition items
- Multiple orders of maximum quantity limits

**Advanced Detection Methods**

- Machine learning algorithms to identify unusual buying patterns
- Cross-reference shipping addresses with known reseller locations based on open source findings
- Monitoring of bulk shipping activity to commercial addresses

The best practice for e-commerce platforms is to implement a layered approach combining multiple detection methods while ensuring legitimate bulk buyers aren't impacted.

## Case Study/ Investigative Plan 📝

As a fraud investigator, I have investigated many complex schemes involving buyer's clubs that challenged our traditional detection methods. This case study shares my methodology and provides practical tools for identifying similar patterns in your own investigations.

**The Initial Trigger**

The investigation began with what seemed like a routine alert: a cluster of "Did Not Receive" (DNR) refund claims all pointing to a single PO box in New Hampshire. This simple data point would unravel a sophisticated fraud operation masked behind legitimate buyer's club activities.

**Following the Data Trail**

Initial analysis of orders shipped to the suspicious PO box revealed a clear pattern. The purchases concentrated on high-value electronics - Apple MacBooks, iPads, Samsung phones, and Amazon tablets, just to name a few.. More tellingly, the accounts were predominantly business accounts, which allowed them to bypass quantity limits on high-demand products (remember the PS5 shortage?)  and claim tax exemptions in certain states.

The breakthrough came when I noticed a peculiar naming convention in the shipping addresses: "BFRMxxxx", where 'xxxx' represented varying numbers. This led to my first investigative query:

```SQL
SELECT * 

FROM shipping_table

WHERE shipping_name REGEXP 'BFMR[0-9]+'
```
This expanded search revealed additional addresses that followed the same pattern explained above. At this point, I took to open source research to determine what this pattern might be - first creating a general Google search based on the acronym “BFMR” and the shipping address “51 S BROADWAY UNIT 2220, Salem NH.” This allowed me to find the website “bfmr.com.” 

**Findings**

 When I first started examining the data, the numbers seemed unremarkable. The overall refund rate for the Buyer's Club location was about 13% - a figure that wouldn't typically raise red flags. Traditional address-based risk signals weren't triggering our usual thresholds for fraudulent behavior. Yet something felt off.

After diving deeper into account-level analysis of thousands of orders shipping to Buy For Me Retail, a different picture emerged. Approximately 6% of accounts displayed clear signs of fraudulent activity. These weren't just one-off instances - we found a pattern of sophisticated fraud hiding beneath the surface of legitimate business operations.

The fraudulent accounts followed a distinct pattern. They weren't just using one Buyer's Club - they were spreading their activity across multiple clubs while al taking advantage of refund policies on personal shipments. Here's what we found when we looked closer:

**Order Patterns That Raised Red Flags**

The most suspicious accounts showed aggressive ordering behavior. We're talking about accounts placing more than three orders per hour, or new accounts spending over $1,000 in their first 24 hours. Perhaps most telling was the pattern of ordering more than five electronics items within a single day - a clear Buyer’s Club signature.

**Payment Behaviors That Didn't Add Up**

The payment patterns were equally suspicious. These accounts would cycle through multiple payment methods - often more than three different cards within 24 hours. We saw instances of split payments across multiple cards and a high volume of failed payment attempts before successful transactions.

**Shipping: The Shell Game**

The shipping patterns revealed another layer of sophistication. These accounts would frequently use more than three different shipping addresses within a week, often mixing residential addresses with wholesale, freight forwarder, or commercial locations. The mismatch between shipping and billing addresses became a crucial indicator.

**The Refund Red Flags**

Perhaps the most telling patterns emerged in the refund behavior:

- Multiple refund requests within a month
- Refund values exceeding 30% of purchase history
- Suspicious timing (either immediate or significantly delayed refund requests)
- Partial returns from multi-item orders
- Multiple "Did Not Receive" claims despite clear delivery confirmation

**Why This Matters**

This investigation highlighted a crucial lesson in fraud detection: surface-level metrics can be deceiving. While the overall refund rate appeared normal, the account-level analysis revealed a sophisticated fraud operation taking advantage of legitimate business infrastructure.

These findings have changed how we approach fraud detection in Buyer's Club scenarios. Rather than relying solely on address-based signals or overall refund rates, we've developed a multi-layered detection approach that considers:

Account-level behavior patterns

Cross-club shipping activity

Sophisticated payment analysis

Detailed refund pattern monitoring

The key is looking beyond individual transactions to understand the broader pattern of behavior across multiple accounts and platforms.

## Building the Detection Framework

Here's how we structured our analysis:

**Order Velocity Analysis**
```SQL
 SELECT account_id

FROM orders

WHERE orders_per_hour > 3

  OR daily_total > 1000

  OR electronics_count > 5
```

This query identified accounts exceeding normal purchasing patterns, particularly focusing on high-value electronics orders.

**Payment Pattern Detection**
```SQL
 SELECT account_id

FROM payments

WHERE unique_cards > 3

  OR failed_attempts > 3

  OR payments_per_order > 2 
```

By tracking payment methods and patterns, we could identify accounts using multiple cards or displaying suspicious payment behavior.

**Shipping and Refund Analysis**
```SQL
 SELECT account_id

FROM orders o

JOIN refunds r ON o.order_id = r.order_id

WHERE unique_addresses > 3

   OR refund_percentage > 30

   OR suspicious_timing_count > 0
```

This combined shipping patterns with refund behavior to identify potentially fraudulent activities.

**The Comprehensive Detection System**

Our final solution combined all these elements into a sophisticated detection system. The complete query includes:

- Order velocity monitoring
- Payment pattern analysis
- Shipping behavior tracking
- Refund pattern detection
- Risk score calculation
```SQL
SELECT DISTINCT

    a.account_id,

a.email,

    a.creation_date,

    ov.orders_per_hour,

    ov.daily_total,

    ov.electronics_count,

    pp.unique_cards,

    pp.failed_attempts,

    sp.unique_addresses,

    sp.address_mismatches,

 rp.refund_count,

    rp.refund_percentage,

    rp.false_dnr_claims,

 -- Risk Score Calculation

 CASE

     WHEN ov.orders_per_hour > 3 THEN 30

     WHEN pp.unique_cards > 3 THEN 25

     WHEN sp.unique_addresses > 3 THEN 20

     WHEN rp.refund_count > 2 THEN 25

     ELSE 0

 END +

 CASE

     WHEN rp.false_dnr_claims > 0 THEN 30

     WHEN pp.failed_attempts > 3 THEN 20

     WHEN sp.address_mismatches > 0 THEN 15

     ELSE 0

 END as risk_score

FROM accounts a

LEFT JOIN order_velocity ov ON a.account_id = ov.account_id

LEFT JOIN payment_patterns pp ON a.account_id = pp.account_id

LEFT JOIN shipping_patterns sp ON a.account_id = sp.account_id

LEFT JOIN refund_patterns rp ON a.account_id = rp.account_id

WHERE

 ov.account_id IS NOT NULL

 OR pp.account_id IS NOT NULL

 OR sp.account_id IS NOT NULL

 OR rp.account_id IS NOT NULL

HAVING risk_score >= 50

ORDER BY risk_score DESC;

 ```

### The Bottom Line

Buyer's Clubs are the perfect haven for criminal activity. Most Machine Learning models or rule engines that rely on shipping address risk signals alone may miss account level details that indicate fraud, abuse, and criminal activity. To implement similar detection methods in your organization, start by establishing baseline metrics for normal buyer's club behavior. Gradually layer in the various detection components, adjusting thresholds based on your specific business context. Regular reviews and updates of the detection criteria ensure the system remains effective as fraudsters evolve their techniques.

Remember, the key to successful fraud detection isn't just in the technical implementation, but in understanding the broader context of how legitimate businesses operate and how fraudsters attempt to exploit them.

This framework serves as a starting point - adapt and modify it based on your specific needs and emerging fraud patterns in your industry.



A must-read blog written by a dear friend of mine in the fraud space, @NemeSys. Ever wondered how some people seem to rack up endless credit card points while making money on the side? Welcome to the fascinating (and somewhat controversial) world of Buyer's Clubs! 🧑‍💻💰


Posts tagged with #Fraud

[First Guest Post!] Inside the Wild World of Buyer's Clubs: The Digital Gold Rush You've Never Heard Of