Two-for-one: Amazon.com’s Socially Engineered Replacement Order Scam

http://www.htmlist.com/rants/two-for-one-amazon-coms-socially-engineered-replacement-order-scam/

by disillusioned • 14 years ago

478 143 14 years ago

Wow Amazon customer service is amazing.

I just wish they would add some challenge that wasn't publicly available information. The rep admitted to me on the phone that "that's all we need, and we can do a lot with just that." They can't place new orders or add billing methods, and she claimed they don't have access to even see your billing information anymore (perhaps since the Mat Honan debacle?) but yeah, eager to please, clearly.

vegardx2• 14 years ago

Actually, all the reps would need to do is look at your history. Like "You recently returned a book, can you tell me what book?", and it would be pretty hard to social engineer it from some other source.

vinhboy• 14 years ago

I don't get it. What does the dot-email have to do with them social engineering their way to your order numbers?

Is the fact that they used a dot-email the weak link here, and what thankfully allowed you to catch on to the problem early?

If that is the case, why would an attacker use a dot-email, when they could just use any email.

vegardx2• 14 years ago

I think they used the dot-notation to legitimate it, basically just a brick in the social engineering scheme pulled on the support rep.

disillusioned9• 14 years ago

That's my thinking. I assume they figured that because the account they were "chatting as" was so close, it might help. Or they thought it had a dot initially and found out they were wrong when the rep said there were no orders.

Amazon lets you chat without signing in and you can claim to have any email address you want at that point, so it's tricky to say if this was intentional (hoping the reps were "dot blind") or if it was just a mistake/bad initial guess.

damian20003• 14 years ago

Yeah that confused me too .. I assumed it had something to do with creating a new amazon account with the dot-email address?

Spoom• 14 years ago

Perhaps the CSRs use the email to pull up a history of previous chats, and by using a "new" email they can avoid the new CSR knowing about the previous ones?

nchlswu2• 14 years ago

as mentioned in some other replies, probably to legitimize it. As the author mentioned, they allowed the item to be shipped to a new address. If I'm not mistaken, a dot-email would be considered a new Amazon account, thus with no address associated with it, so maybe this helps the attacker in that regard?

ghshephard2• 14 years ago

90% of these attempts at scamming the CSRs could be prevented if Amazon allowed me to provide a SMS address that they could send a message to for confirmation.

Every time I login to gmail over the web from anywhere but my personal computer, I take an (at most) 5 second pause while Google SMS's my cellphone and has me enter the 6 digit code. Failing that, in my wallet, I have a list of 12 Backup "Nuclear Codes" should I for some reason lose my iPhone and need to login to email in the intervening period while I get it replaced.

Trivial to implement, very secure.

ProblemFactory• 14 years ago

GMail has a nice 2-factor scheme. While the SMS might need external services, the app-based verification keys are based on open standards and open-source code, and can be added to any web application with about 10 lines of code: http://code.google.com/p/google-authenticator/

There is even a Unix login module for adding it to SSH.

bigiain3• 14 years ago

Amazon use the same two factor auth too. I've got my AWS account secured with the Google Authenticator app using TOTP codes as well as passwords.

It worries me that "consumer friendly" customer service leaks information like this, that could potentially lead to my AWS account getting suspended while fraud is investigated.

cobbal• 14 years ago

Unfortunately, what Amazon has to secure is almost every account. 2 factor authentication is great for the more security-conscious, but that's a very small percentage of Amazon's customers. All the scammers would have to do is hit one of the 98% of accounts that just have default security.

Sure, it can protect your account, but it can't protect Amazon unless they force everyone to use it (which would obviously not be good for building customer loyalty.)

mseebach10• 14 years ago

The OP actually suggests a second factor for authentication: The last four digits of the card you paid the order with.

micro-ram• 14 years ago

Except that Amazon shows you the last 4 of your card when logged in. That should be removed and the cards should be named.

citricsquid• 14 years ago

I suspect this is a result of their attitude towards re-orders due to delivery issues, it would make sense that if CSR's are told "if a user wants a re-order, just do it" that they'd not really consider the implications of allowing them with a new address, because their attitude is do whatever to keep the customer happy.

I had a delivery of a game go missing (~$60 cost) so I opened a live chat and explained, then they shipped me a brand new order (which arrived!) without any hassle or confirmation that my prior delivery had really been stolen. This seems like a trivial thing to abuse (and I'm sure many do). After my free re-order was placed I thought "that was cool, I'll order from Amazon in the future just in case...".

city412• 14 years ago

I'm sure that is what they are counting on and once it happens to people they probably become very loyal customers. At a previous place I lived my neighbors stole two Amazon packages from my doorstep. Amazon had no problem not only sending out replacements, but sending them to my work address instead. It made me very much want to order from Amazon from then on.

hysan• 14 years ago

This customer service model, where the CSRs go above and beyond to help the customer with as little hassle as possible, is what built the initial customer base for Newegg. Those customers have largely remained loyal even though other online retailers have caught up in price. This is also what made Zappos very popular (eventually bought out by Amazon). So the strategy clearly works. I assume Amazon has calculated that the number of frauds is greatly outweighed by whatever business is generated from returning customers and great PR.

joshfraser• 14 years ago

I ordered a TV from Amazon last week that never showed up. I don't know if UPS messed up or if it was stolen off my front step. Either way, I appreciated Amazon trusting me and dropping another one in the mail without making a big deal out of it. While it seems like Amazon have ignored this issue to date for all the right reasons, they may need to start addressing it since it obviously affects their real customers with worrying emails & the chance of being viewed with suspicion later on.

hef198982• 14 years ago

What Amazon does after first time shipping adress changes (in Germany as of yesterday) is to re-ask for your full credit card number. After that the new shipping adress is part of the account and valid.

But what I confirm is great customer service. Last week my sound card broke down after almost 2 years and it took about 5 minutes to get the return information and the according refund once the item showed up at amazon. No hassle what-so-ever with waranty issues and replacement of the original item, just a plain and simple refund.

That's what customer service should be like. And that things like that can be exploited is true, but that's equaly true for almost all other things. If it's a calculated trade-off from amazon's side there shouldn't be a problem.

robflynn• 14 years ago

The same thing happened to me. Afterward, that prompted me to sign up for Amazon Prime. I had decided that if they were going to take care of me like that then I may as well dive right in. My Prime renewal is coming up in a few weeks and I will be renewing it. Hell, my girlfriend and I order light bulbs and various trivial household items via Amazon now. They've made it so easy for me. It sucks that people are taking advantage of that.

I once ordered an item by mistake (oops, one click shipping!) I should have paid attention. I requested to return the item and fully expected to pay the shipping costs back. I explained that it is MY fault. They still told me that it wasn't a big deal and that they would cover the shipping back.

I'm not sure what the proper solution is. I don't want to lose that helpfulness, but I hate for them to get ripped off, too, due to assholes. They've been very good to me and have quickly addressed any issue I've ever had.

Semaphor2• 14 years ago

When my kindle broke (within one year though only barely) I asked if they wanted a picture of the error (frozen screen). I was told they don't need it and my brand new kindle (with added 3g, the broken one was wifi-only) should arrive in the next 2-3 days. So yeah, I hope their service stays as awesome as it is.

On the other hand, the stuff recommended in the blog posts would be easy to implement without really making it more of a hassle (only ship to places already listed, ask for more than name, mail and address, collate chats).

michaelt• 14 years ago

  This seems like a trivial thing to abuse 
  (and I'm sure many do).

I can't speak for Amazon, but at my employer, when a customer phones up or e-mails the customer service rep immediately sees certain details - number of orders by address, lifetime spend, spend in last 6 months, age of account and address, percentage refunds, fraud flags and so on.

Needless to say, the more legitimate an account looks, the easier it is for them to get no-hassle refunds.

alxndr• 14 years ago

Corollary to that: the more legitimate an account looks, the more free stuff a scammer can get by pretending to be that account holder.

nmcfarl• 14 years ago

Heck, this happens at my company, and we're 2 co-founders and a CSR. This was literally one of the first things we built - as I imagine it must be for any biz that ships products to customers.

line4• 14 years ago

Thats true but I'm sure Amazon has some form of blacklist somewhere in their risk management process. Or maybe that is not tied to csr changes and only in order processing.

Having shipping patterns change especially to a ship forwarding sites is highly suspect. There are databases that can help flag these either done commercial or collected internally. I'm sure Amazon has a pretty extensive list.

yardie• 14 years ago

This seems like a trivial thing to abuse (and I'm sure many do).

I used to think the same of Netflix DVDs when I had the 5 out service. For the life of that subscription I had 2 never show up. I talked to the CSR and he assured me they keep track of these things.

tomkarlo2• 14 years ago

I suspect that part of what they do is look at your (likely very long) order history, and make the calculation that it's better to just reship rather than risk losing you as a customer. It's the benefit of having so much order activity over so much time - they know exactly how much a customer is worth to them. That's part of why this scam works - it trades on the existing goodwill / history of a longtime customer to get Amazon to do something un-economic.

damian20003• 14 years ago

Its amazing that this scam seems like its being pulled off from outside the US, via a re-shipping service in Oregon. Anyone know how vulnerable international Amazon customers are to this same scam? I'm thinking that the scammers require some sort of re-shipping service, which are generally not as widely available as they are within the US.

dminor2• 14 years ago

I work at a small online retailer and almost all of our fraudulent orders are from outside the US. Use of a mail forwarding service is also typical.

hannibalhorn• 14 years ago

When these fraudsters use mail forwarding services, do they have the address registered with the credit card company, and do you guys check that?

I ask because I live overseas and use a forwarding service quite a bit, but several smaller shops do flat refuse to ship to me, meaning I have to ship to my dad's and have him send it to my forwarding service, which ups the price a bit. And it's kinda frustrating, as I do have the address registered with my banks.

At least reading a story like this one explains to me a bit why things are the way they are.

andrewcooke• 14 years ago

as someone outside the usa can i (1) thank you for selling outside and (2) ask what we can do to help avoid fraud / re-assure sellers when we are legitimate buyers?

i recently bought something and first emailed the shop asking if it was ok, pointing them to my online existence (blog etc). i don't really know if it helped (but they shipped - according to fedex the box arrived in santiago at 3am this morning - may be here today :o).

i don't use a shipping service, but was wondering about doing so (because they have clearer fees - dhl at least, in my experience, adds random extra "customs charges"). i guess i should not bother trying that.

i use a "virtual credit card" (a one-off for internet use, generated by my bank's web page, with an upper limit that matches the price, short expiration date, and valid only for single use). i feel pretty safe using that, but i guess that just protects me, not the seller (although if you can tell someone is using one then i guess it is not a stolen card). recently i have started adding my postcode to shipping details (they exist in chile, but most people don't use them and it doesn't appear on my credit card bill). i do always ship to my billing address.

i don't know what else i can do. i really appreciate companies that do ship - the internal market here in chile is limited, so this is pretty much the only way to indulge when i want something unusual.

[one positive note - a chinese company called audiogd that makes electronics (hifi dac) gave really excellent service, letting me disassemble their hardware and return only a single logic board that was faulty, rather than the entire (heavy, expensive to ship) product. i wish there were some way to reward companies like that. http://www.audio-gd.com/En%20audio-gd.htm ]

rckrd• 14 years ago

I'm surprised Amazon was not suspicious that a service request had come from a location where the account has never been logged in from before.

forgingahead• 14 years ago

It's a scam, certainly, but it's actually great customer service policy. If the only risk is the loss of value of a product to Amazon, and there is no personal data loss for a customer directly, then it's actually an acceptable loss policy to Amazon.

They (and most good businesses) would prefer the majority of their customer base be able to get refunds and deal with order issues swiftly than have to jump through hoops to prove who they are. Certainly an SMS PIN or other authentication method would make it more secure, but there is no further customer benefit. The monetary loss to Amazon is basically a rounding error so why make things more complicated?

joshj19• 14 years ago

This exactly. The net benefit to Amazon from improved customer service is likely worth the potential for a few lost products. Sure may be wrong, but to them it may just be a cost of doing business. It's not unlike many department store's policy of not targeting a shoplifter-in-action in a mall, especially once they've left the store (mostly for liability reasons).

ghshephard2• 14 years ago

"many department store's policy of not targeting a shoplifter-in-action in a mall"

Citation? I've never heard of such a policy. Every mall I've had knowledge of had a very extensive security organization that was pretty effective at targeting shoplifters-in-action.

SyneRyder• 14 years ago

Interesting. I was at a mall last week where a security guard had caught a shoplifter, and the guard was downright friendly with the guy. It appeared that he was just going to let him go. The guard was asking the guy whether he'd shoplifted before, why he did it etc, but in a very relaxed conversational way. I hadn't thought of it as a customer service policy (both not to scare customers and keeping a potential future customer).

I also talked to a science-fiction / hobby store owner years ago, who mentioned that most of the shoplifters they caught had also been their best customers. (His policy was to ban them from the store, though.)

rizzom5000• 14 years ago

It surely appears a great customer service policy. Unfortunately, the cost of fraud, waste and loss is passed on to honest consumers in the form of overall higher prices.

It's probably true that Amazon can still offer generally competitive prices despite scams like this; but in principle, I agree with the OP. And not necessarily because it would mean slightly lower prices for myself or slightly higher profits for Amazon; but simply because I dislike knowing that I'm complicit in the scam for the sake of my own convenience. Especially when that convenience means having an item re-shipped to a different address that I never used before, which happens to be the address to a 're-shipping' organization.

salvadors3• 14 years ago

> Unfortunately, the cost of fraud, waste and loss is passed on to honest consumers in the form of overall higher prices.

In Amazon's case it's also possible to argue that the cost of fraud, waste and loss is passed on to honest consumers in the form of overall lower prices.

Customer service policies like this are a significant part of what allowed Amazon to grow to be the company it is today, and Amazon has used that power (some would say abused it), to drive prices lower than they would otherwise have been on many items.

> Especially when that convenience means having an item re-shipped to a different address that I never used before,

I'm personally very glad that they allow this, having had to had a broken Kindle replaced whilst on holiday in a different country.

sliverstorm• 14 years ago

It's great customer service, but what happens when the scam takes off and starts impacting their margins? Profits go down, prices go up, and customers start leaving.

bigiain3• 14 years ago

"If the only risk is the loss of value of a product to Amazon"

Unfortunately, that's externalizing the real cost to the customer of having their account flagged as "possibly fraudulent".

temphn• 14 years ago

The title of this link is very misleading. Amazon is actually going out of its way to provide excellent customer service, and is being exploited by a scammer. It is therefore not "Amazon's Scam", but a scam perpetrated against Amazon.

As to whether or not something should be done, this is a sensitivity/specificity tradeoff. Too far in the other direction of distrusting customers and Amazon ends up like Paypal.

Shenglong• 14 years ago

Paypal's customer service isn't bad because they don't trust the customer in terms of authentication - it's bad because they have horrible policies in place, and their reps are unintelligent, untrained, and unhelpful.

In any case, some authentication aside from "Full Name" would be nice. When I was with Liquid Web, I had a pass phrase set up, which I could pass off as regular conversation even in a crowded room without anyone suspecting it was my authentication. That works best. Even a birth date and city of birth would be better than a name.

jlgreco• 14 years ago

In case anyone is unfamiliar with the consequences of Paypal's customer service: http://techcrunch.com/2012/01/04/paypal-shreds-ostensibly-ra...

conradfr3• 14 years ago

As a former PayPal CSR I don't think I was unintelligent, untrained and unhelpful, oh well :)

Osmium• 14 years ago

> Paypal's customer service isn't bad because they don't trust the customer in terms of authentication - it's bad because they have horrible policies in place

This is true. I got locked out of my Paypal account because I had the audacity to log in from a nearby country (Germany). Fair enough, though maybe a bit overzealous. To get control back they then had to charge a small, random amount of money to my account and phone my registered phone number to give me a code to input. Reasonable, perhaps, except that it didn't work! and to this day still hasn't. I can't count the number of times I entered in the code. So I just created a new account with an alternative email instead . . .

This was a few years ago admittedly, so maybe they're better now, but it's one thing to have overzealous policies and quite another to implement those policies poorly. And that's not even getting into the one time I actually needed PayPal buyer protection, because I'm sure we could all be sharing PayPal horror stories all day if we go down that road.

eric_bullington• 14 years ago

Exactly. This is why we can't have nice things. Here is a company that has given its CSRs enough power to resolve issues, and someone is taking advantage of it. Clearly, they need to implement something like the pin number challenge Chris mentioned, but I for one am impressed that Amazon trusts their customers to this extent. Someone has just found a weak link to exploit, and Amazon needs to fix it, but I hope this doesn't make them change their policy of trusting the customer.

Firehed• 14 years ago

I'm mostly surprised they allow so much power to phone reps. In my way-too-many years of using Amazon I've had to call them precisely once, about trying to get an SSD replaced that had died just outside of warranty (yes, they did replace it). I've placed at least 150 orders with them in the last three years alone, probably closer to 200, and have had to perform a handful of returns; all but that one were done online, very easily, and that special case existed only because I was outside the standard return window.

As the article points out, their web-based security seems pretty darn solid. Nearly any account change requires reauthenticating with your password, and only recently did they start to roll out support for a more persistent auth for viewing what most people would consider non-critical info (order history, etc). With the exception of a phone-based password reset - which should not cause a problem like the one described here - they could require even a web-based PIN (behind the login-wall, of course) for chat and phone support; live chat could skip this if the user already has a fresh auth.

I hope for everyone's sake that Amazon is able to prevent this kind of problem without harming their fantastic customer support. There's a reason I've averaged an order every 5.3 days this year (I can stop any time I want to, but thank you for your concern!)

geofft• 14 years ago

As a customer, I would prefer they do _not_ trust people claiming to be me. I've called customer support all of once, and almost never buy anything from Amazon these days, so anyone claiming to be me probably isn't. I'm not impressed, and would like them to stop doing that, since otherwise the safest thing is for me to close my account.

javajosh4• 14 years ago

Hey, I have an idea: how about stop using Amazon and start buying and selling from your local community, small businesses, like with actual people who can get to know you and who aren't susceptible to this kind of nonsense?

The cool thing about dealing locally is that you no longer have to wade through bureaucracy to get customer service - you can walk up to a flesh-and-blood person and talk to them face to face! And, unless they have masks from "Mission: Impossible" you'll be very, very difficult to spoof!

runaway• 14 years ago

Because I personally don't value seeing a flesh-and-blood person very much. In my experience, Amazon has them beat in price, convenience, and customer service (they replace items and take my returns without an attitude, always). They also carry items my local stores wouldn't dream of carrying.

The only time I buy from local stores is when I absolutely must have it that day. And it looks like Amazon might even be doing that soon.

javajosh4• 14 years ago

Perhaps I'm spoiled but there are two very good camera shops nearby. They are more expensive than Amazon, but they are also the hubs of the local photographer community, and the people that run them are neighbors. They also have consignment, used gear, etc. and for those time when I shoot film they do a great job of developing.

The inconvenience of going there is far outweighed by the benefits. Perhaps that's why they have survived in the era of Amazon and Best Buy! But I really really encourage people to actively search for local independent photog places (I mean, not Scammy's, er I mean Sammy's) if you take photography seriously at all, the premium is worth it.

jahewson2• 14 years ago

My experience of local stores is one of cheap nasty products which break on the day you buy them, idiosyncratic opening hours, and an inability to handle even basic stock control. Oh and everything is overpriced by a factor of about four. No thanks.

That's presuming they even stock what I want, which they usually don't.

pbhjpbhj4• 14 years ago

Where do you live. What are you buying.

Could you give an example of something you bought local to you that was ~4 times the price of Amazon and broke soon after you purchase it? Presumably you got your money back; I wonder how the store is staying open if they have to refund all their customers.

Shank• 14 years ago

I'll vouch for the ease at which Amazon sends replacements for broken products. I've ordered obscure replacement phone parts (namely touch screens and lcd panels), but had issues with a couple. Amazon gladly refunded the defective ones on the spot, which allowed me to buy others right off the bat.

I really hope this gets stopped - I'd rather not have Amazon's generosity thrown down the drain because of a few scammers.

ars• 14 years ago

"And up until early this afternoon, the whois information for my domain"

Whois information is archived basically permanently by many online databases. Changing it doesn't help anything - the old values are easy to find.

disillusioned9• 14 years ago

Yep. Aware of that, mostly hoping to remove some of the low-hanging fruit. My fault for stupidly posting my real information in my domain records.

nraynaud• 14 years ago

That's not stupid, that's what is asked and for a long time it was not a problem. Times have changed, that's it.

munger• 14 years ago

Thanks to Chris Cardinal for taking the time to write this up! I think it's important to be aware of current fraud like this since a lot of HN readers are probably also amazon customers (as I am myself).

Also interesting to know about gmail "dot blindness" - kind of like "plus addressing" you could use it to track who adds you to spam lists, by giving out different versions of your gmail address to different vendors (not that most people have time for that - I've never done this).

Plus addressing looks like this: myusername+whatever@gmail.com sends to myusername@gmail.com, but some site's email regex check do not allow this, so dot addressing could be used instead.

prlin• 14 years ago

Witty how he flips the Amazon "smile from a to z" upside down into a frown.

prostoalex2• 14 years ago

How did this Chris Cardinal guy find out about the original camera order, if he didn't have access to htmlist@gmail.com?

disillusioned9• 14 years ago

Further down in the article I mention that a possible vector was that I tweeted from my personal Twitter that I was considering buying a T4i and that someone searching for that might consider me a target and try.

It's definitely an interesting question, but it's clear he was just hunting and pecking, which is why he wanted all the order numbers from November and December... not sure if he initiated a few other chat sessions to figure out what was in each order and found a high-ticket item to pursue, or what, but it's a good question... I don't know what made me an initial target at all.

Interestingly enough, Amazon offers a "Tweet this purchase" option which I did NOT avail myself of, but which would definitely exacerbate this problem.

(Also, my name is Chris Cardinal. I don't know the scammer's name, but of course he couldn't request Amazon to change the shipping address AND the name for the replacement order. That would be a bridge too far.)

prostoalex2• 14 years ago

Ah, didn't realize he used the same name. So potentially

1) first chat session with Amazon support to claim that he lost access to his email and needs order #s (which is what you've tested out, and it works)

2) subsequent sessions from different accounts with various dot placements to inquire about the status of specific order #s

3) when a high-value item is found, sticking to the original dotted address, and asking for replacement

Is your mailing address available from public sources?

shalmanese• 14 years ago

It could also be that Amazon waives it's same address policy only around Christmas as it knows that a) people are travelling and b) a missed Christmas present is a bigger deal than a normal missed package.

It might have figured that this would be an acceptable loss given that it can only be exploited once a year.

whyleyc• 14 years ago

Couldn't this be fixed by Amazon just requiring you to be logged in when you start a chat with them ?

Tiny bit of extra hassle for the user but is made up for by the fact that Amazon wouldn't need to bother asking any security questions to verify identity.

disillusioned9• 14 years ago

Yes, this. And in the few instances where they needed assistance resetting a password, that should be all they're allowed to do without logging in.

In the transcript, you'll see that the rep tries to offer a password reset before relenting and just giving the scammer every single order number for the past two months. Big mistake.

The "skip sign in" button is absolutely the vector being used to run these scams, and that's an incredibly good point. Though I can see there being some trouble for users who want a number to call off a packing slip without having to open the Amazon site to trigger the call first.

UnoriginalGuy• 14 years ago

In this case the fraudster was logged in to an Amazon account. They created a new account using the alternative e-mail address and set the address differently to the original account.

They then claimed that the original account was lost due to the e-mail address being "hacked" and that they needed the order numbers. They then used the order numbers to request a replacement using their new account.

pbhjpbhj4• 14 years ago

>They created a new account using the alternative e-mail address and set the address differently to the original account. //

You lost me.

So customer Andy Blogger has account ablogger@gmail.com.

Fraudster Bandy Logger creates account at Amazon using email address ab.logger@gmail.com and the verification email is sent to Andy's account (as gmail is dot blind in email addresses).

How does fraudster Bandy confirm ownership of the Amazon account so he can log in and change the accounts email address? Doesn't he have to create the account with the re-shippers postal address, then confirm the account with an email address they control, then change the email address to the one for the Gmail account ... doesn't that look pretty damn suspicious.

How about recording a short video on account creation, speaking/signing name or something similar. Then reps could confirm owner ship via video chat. Sure it would still be possible to abuse but would be a lot harder.

disillusioned9• 14 years ago

I will say this, since it's somewhat amusing, but it's the first time I've been scammed for negative $43 dollars. I wonder if the scammer figured that he could get me some hush money and hoped I'd let the rest slide?

jdietrich• 14 years ago

Sears built the reputation of Craftsman tools based on their unconditional lifetime guarantee; They also created a cottage industry of people searching yard sales, thrift stores and scrapyards for rusted old tools. A British clothing retailer (Marks & Spencer) was famous for an extremely liberal refund policy, which also made them a magnet for shoplifters and petty fraudsters.

I'm sure Amazon know how much this sort of fraud is costing them. I'm sure they've calculated that it's worth the cost, at least for now. Shrinkage is just another cost of doing business.

devcpp• 14 years ago

Worth the cost of asking for more information for the replacement of expensive items? It just takes a few more seconds to each rep and is surely shorter than all the new orders being placed for scammers.

kamjam• 14 years ago

Exactly. And what happens when a user needs a legitimate refund/exchange and Amazon then refuse because their account has had so much fraudulent account gone unnoticed? Not very good customer service at this point...

zobzu• 14 years ago

I'd like to point out that this is almost ALWAYS the problem. People ALWAYS get hacked, not because they use "love123" as their passwords, not because their pc/mac wasn't up to date.

Nope. They get hacked because the security question ask for a pet name, or a school name, or a friend name. Freaking easy. They get hacked because support gives information without authenticating people.And so on.

Dear companies, stop doing that. Thanks.

damian20003• 14 years ago

You can add in there passwords not being secured properly by application developers too ... probably the biggest source of being hacked.

michaelhoffman• 14 years ago

I reported this to a friend of mine who works in fraud detection at Amazon.

bcoates• 14 years ago

What's the deal with these reshippers? It seems like the weak point in the scam, Amazon should either blacklist their addresses or coordinate with them to authenticate where the package is actually going.

mseebach10• 14 years ago

A much easier way would be to refuse to ship to an address that's not already active in your address book. If you really need to ship to another address, it's not too much to ask that you go through the full account recovery process and enter the new address (which will prompt you to re-enter your credit card number).

line4• 14 years ago

While there are higher risk, you can't really just blacklist them all since there are a lot of legit orders that get sent to reshippers. For example, customers buying from overseas and the merchant may not offer international shipping. So you have to look at other data points as well.

In this case, having an established order and delivery history and then to have it shipped to reshipping is odd and should've raised a flag.

I'm sure Amazon's fraud system knows about that address. But maybe that flag is not exposed or given to the csrs. That particular one in Oregon is used fairly frequently by fraudsters. We've seen it a number of times among our merchants.

nchlswu2• 14 years ago

I had a strange issue with my Amazon account a while back where I couldn't log in and when I finally could, all my account history was lost. I can't recall if it was my mistake (I've used dot-emails before), but this definitely reminds me of it.

As a Canadian shopper, the abuse of these shipping depots is a bit concerning to me, as I've used one of the depots mentioned in the post. These are such high volume shipping locations (to so many different addressees), I'm sure Amazon has shipped tonnes of orders to these locations and I'm wondering if they've investigated them before? These centers are very easy targets for abuse and I know Nike keeps a database of these addresses and blacklist them.

I'm not sure if they do it to prevent grey market exports or fraud, but (from a consumer perspective), I hope Amazon doesn't go this route.

edanm2• 14 years ago

This thread reads like a giant love-letter to Amazon. As well it should.

Amazon is one of the best companies in the world . I've been buying physical books from them for the last 8 years. I've recently started buying audiobooks at Audible, and have even more recently purchased the new Kindle Paperwhite, and have been burning through many, many ebooks. The one time I had a problem with a physical shipment, they resent the book, no-questions-asked. From the looks of this thread, their customer service has stayed amazing.

My favorite Bezos quote, showing an approach that, over the long term, is amazingly profitable: "There are two types of companies: those that work hard to charge customers more, and those that work hard to charge customers less. Both approaches can work. We are firmly in the second camp."

By the way, I agree with the OP, asking a simple question to verify the credit card number would not hurt the customer service process, and would probably prevent some fraud.

martincmartin• 14 years ago

Richard Stallman vehemently disagrees with you.

http://stallman.org/amazon.html

He cites DRM, remote wiping of Kindles, sweatshop conditions in some shipping facilities, cutting off service to Wikileaks, squeezing small publishers, not paying enough UK taxes, and being a member of a right-wing lobbying group.

mst• 14 years ago

Actually, I don't see that they do disagree.

"One of the most pleasant companies in the world to do business with" isn't really anything to do with the morality of their backend operations.

illuminate• 14 years ago

"being a member of a right-wing lobbying group"

http://www.rawstory.com/rs/2012/05/24/amazon-becomes-18th-co...

Not anymore, at least.

edanm2• 14 years ago

Most of what he talks about, I don't care about. I used to care a lot about DRM, I in fact swore I'd never do business with Audible because of DRM. Turns out, I care less about the DRM than about getting good content at a good price. It's also part of moving everything to the cloud - I'm more used to the idea of not having a "physical" bookshelf full of books, but rather a bookshelf keep by Amazon. It actually makes things easier for me as a consumer. Remote wipe I assume was a one-off.

About the other stuff, it doesn't really impact me as an Amazon user. The only thing I'm interested in is them squeezing small publishers, because I do want to make sure I keep having good content... but so does Amazon, so I trust them to work it out. I don't mind if Amazon becomes a large publisher themselves, it'll probably work in my favor.

In general, almost everything Stallman cares about is uninteresting to me, and the few stuff I think he's "right" about I think he takes to extremes that are, frankly, crazy.

mikeash• 14 years ago

I often find the vehement disagreement of Richard Stallman to be a decent indicator that something might be true.

wpietri• 14 years ago

I have a lot of respect for Amazon; Bezos's quote definitely explains a lot of their appeal. So many businesspeople are so focused on short-term costs that they are unable to make long-term wins. Bezos has been busily crushing those people for nearly 20 years. I really hope American business culture eventually unlearns the MBA-school dogma that leads them to the charge-customers-more approach.

That said, Amazon definitely has problems. E.g., how they treat employees:

http://www.motherjones.com/politics/2012/02/mac-mcclelland-f...

http://news.ycombinator.com/item?id=3101876

mjt0229• 14 years ago

As I recall, Apple was the weak link in that identity theft, although Amazon was not blameless.

IheartApplesDix• 14 years ago

Everywhere I've ever shopped and every ATM I've used shows you the last 4 digits of your CC#, why Apple decided to use the first 4 is beyond me. Maybe they just wanted to think different?

brechin• 14 years ago

Amazon actually distinguishes between accounts with the SAME email address but different passwords. I don't know of any other site that uses email as an account identifier and lets multiple people use the same one.

xxpor• 14 years ago

They don't allow you to do this anymore. Back when Amazon started, lots of families only had one email address from their ISP. They allowed you to make multiple accounts with different passwords for this reason.

If you try to set it up today, it won't work.

jneal• 14 years ago

I accidentally did something similar. I ordered an item, and paid for overnight shipping on a Thursday morning. The item didn't arrive as promised on Friday, in fact it didn't arrive until Wednesday the next week. That weekend, I called in complaining that I hadn't received my item. The label was printed Thursday, but UPS never picked up the package. They assumed it was lost and re-shipped my package. Low and behold, I received both packages and ended up with a 2 for 1. I kept the extra still in the box for a month, figuring I'd get a call from Amazon eventually asking for it back - when I never heard from them I decided to sell it.

mseebach10• 14 years ago

So you're guilty of theft and fencing - and of abusing the trust Amazon extends to it's customers.

function_seven• 14 years ago

Why didn't you call Amazon to let them know, instead of waiting for them to call you?

robododo• 14 years ago

I, unwittingly, nearly pulled the same scam with Dell about 10 years ago.

I had a new notebook shipped to my house. It cost about $1600 new. The tracking information said it was delivered, so I hurried home to get it as I didn't want it on my doorstep. I get there, and no box. I checked the deck out back (where the UPS guy would sometimes leave things), and nothing. Crap.

So I call Dell, and after working with them for 20 minutes, I have a new replacement on the way. I basically had to "super pinky promise" that the notebook never really made it to me.

10 minutes later, my neighbor comes by and says "Hey, got a package for you!". Holy moly... I just social engineered the poor Indian lady at Dell. After a quick call back, the replacement is canceled.

To this day, I'm both shocked and very happy that Dell made it so easy. I like that they trusted me (a return customer) and tried to do the right thing. However, that trust is so easy to exploit.

I'm not sure what the answer is here. In this case, I can't blame amzn. I mean, they are trying to be helpful. How do you setup a system that's truly helpful w/o leaving wide gaps for scammers? Things like 2-factor auth, sms codes, etc will annoy most non techies (IMO).

Evbn• 14 years ago

In passing, not fair to blame Amazon because Apple uses effectively public information (last 4 of CC, which is known to every restaurant waiter and shop clerk in America), as a secret key.

npsimons• 14 years ago

I find it interesting that people are still blaming Amazon for the Mat Honan iCloud hack, when it was Apple who was so lax in letting someone reset a password with as little as the last four digits of a credit card number.

city412• 14 years ago

I wonder if I am being the target of this scam now too?

I just got an email from Amazon customer service asking if my recent customer serivce inquiry was handled satisfactory. I've not contacted Amazon or ordered from them in quite some time. So I wrote them and told them that (I also linked to this blog post on htmlist). Their reply:

> Thanks for bringing this to our attention.

> It looks like one of our customers mistyped his or her e-mail

> address when placing an order with us. You have not been

> charged for anything as you didn't order.

mistyped their email address? This seems unlikely to me, as my gmail address is pretty unique and not likely "near" other people's addresses. I dunno, feels suspicious to me.

disillusioned9• 14 years ago

Annnnnnnnnnnnnnnnnnnd Amazon terminated my account. Great. (And that of the other woman this happened to.) EDIT: Being told that it was just on hold despite the customer service email and my account being locked out. Oy.

Two-for-one: Amazon.com’s Socially Engineered Replacement Order Scam

Related Stories