eBay Urges Congress To Fight Brick & Mortar Organized Retail Crime While Ignoring Digital Fraud & Theft

eBay's head of North America Criminal and Regulatory Investigations, Christian Hardman, has taken to the Fox News opinion section, urging Congress to pass the Combating Organized Retail Crime Act (CORCA) which would focus scrutiny on brick and mortar shoplifting while ignoring larger online fraud and digital theft problems that plague the marketplace.

In the opinion piece, Hardman says eBay's PROACT (Partnering with Retailers Offensively Against Crime and Theft) department works diligently with law enforcement to tackle Organized Retail Crime but that these efforts need additional help from Congress.

Hardman conjures up frightening images of smash and grab looting and cites statistics from the National Retail Federation reporting a 93% increase in the average number of shoplifting incidents per year in 2023 versus 2019 and a 90% increase in dollar loss due to shoplifting over the same time period, offering a carefully crafted message aimed at only one specific type of Organized Retail Crime.

I work for eBay. Businesses need Congress’s help to fight the scourge of retail crime

Most Americans have seen the results of the 93% spike in theft. Shopping has become difficult as stores try to fend off organized gangs. Businesses need congressional help to fix things.

Fox NewsChristian Hardman

We’ve all seen the videos on our local news of shoplifters brazenly grabbing goods off store shelves, filling up garbage bags and running out of a store. As a result, it has become increasingly common to find locked plastic cases lining the aisles of our favorite stores, making it harder to grab a razor, medicine or even soap.

While waiting for an employee to dispense your razor is just a minor inconvenience – the costs of organized retail theft (ORC) are a much bigger deal. Hundreds of millions of dollars of inventory are lost to theft each year. To combat this growing problem, retailers are spending more on security, technology and insurance – costs that are all passed on to consumers...

...Retailers, law enforcement and online marketplaces, such as eBay where I work, must partner to find and implement a solution that makes organized retail crime a thing of the past....

...Our industry-leading initiative, Partnering with Retailers Offensively Against Crime and Theft (PROACT), facilitates cooperation and partnerships that enable more effective investigations and prosecutions of those suspected of retail crime. In 2023 alone, we helped prevent an estimated $50 million from being stolen at CVS locations in 2023 through PROACT.

This experience has shown us that we cannot solve the problem alone. Successfully stopping organized retail crime requires collaboration between e-commerce companies, retailers, law enforcement and even Congress. Law enforcement and prosecutors need the tools to go after the sophisticated criminal syndicates behind organized retail crime.

Fortunately, Iowa Republican Senator Chuck Grassley and Nevada Democrat Senator Catherine Cortez Masto introduced the Combating Organized Retail Crime Act (CORCA), to address the escalation in theft, fraud and other property crimes against retail stores and elements of the supply chain.

CORCA is heavily influenced by National Retail Federation and other lobby groups who have their own incentives for framing Organized Retail Crime in this narrow brick and mortar retail light - and that bias is reflected in the language of the bill.

For example, SEC. 2. Findings explicitly refers to ORC as a crime involving "groups of individuals specifically targeting retail stores" and cites NRF reports on the use of violence in physical brick and mortar retail theft.

So why does eBay want to keep the focus on this narrow definition of Organized Retail Crime?

Because it helps divert attention from the massive amounts of digital fraud, theft, counterfeits and other illegal activity being funneled through the eBay marketplace while Hardman's PROACT turns a blind eye.

For example, triangulation fraud has run rampant across the marketplace with eBay's full knowledge and complacency for over a decade - I know because I personally experienced this fraud perpetrated through eBay in 2020, when it hit my then-employer to the tune of over $160,000 in less than 4 months, using over 150 suspected fake or hijacked eBay accounts.

Triangulation Fraud - What Is It & How Can You Protect Yourself?

Multi-channel ecommerce businesses using 3rd party marketplaces may be targeted by this sophisticated fraud.

Value Added ResourceLiz Morton

This sophisticated form of digital shoplifting occurs when a buyer makes a genuine purchase on a third-party marketplace, but the seller fraudulently purchases the product from another legitimate merchant, often using a stolen credit card for that purchase.

Krebs On Security wrote a fantastic article about triangulation fraud in 2015.

How Carders Can Use eBay as a Virtual ATM

How do fraudsters “cash out” stolen credit card data? Increasingly, they are selling in-demand but underpriced products on eBay that they don’t yet own. Once the auction is over, the auction fraudster uses stolen credit card data to buy the…

Krebs on SecuritySkip to content

Interestingly, the triangle graphic used in this article actually came from an eBay help page at the time - showing eBay has been aware of this fraud for over a decade at this point.

Dr. Nina Kollars, an Associate Professor in the Cyber and Innovation Policy Institute at the United States Naval War College, also shed light on what triangulation fraud is like from the buyer perspective in her Confessions of a Nespresso Money Mule presentation at DEFCon 2019.

In my experience, after contacting then Florida Attorney General Ashley Moody's Office with my concerns, the matter was punted back to eBay's PROACT department, citing a direct complaint process they had with eBay.

Upon receiving the complaint, eBay responded saying they would investigate and take appropriate action - which was enough to get a rubber stamped "case closed" from Moody's office.

Unfortunately, despite the cute acronym, PROACT was anything but proactive. They stonewalled, pretended to send emails that "must have gone to the spam folder" (they didn't), and then eventually just stopped responding at all.

I had undertaken an extensive investigation of this fraud in my role for the company and offered everything I had found to PROACT on a silver platter - including a list of ~4,000 tracking numbers for fraudulent purchases that eBay could have easily cross referenced in their systems to identify accounts used for fraud on their platform.

To my absolute and utter astonishment, PROACT declined to accept any of the information I offered, assuring me they had their own proprietary algorithms to flag fraudulent activity on accounts and appropriate action would be taken, which clearly never happened.

Since the company I worked for was one of the top 5 sellers in our category, as a last ditch effort I approached our category manager for help - he candidly admitted to me eBay had been aware of this kind of fraud for years, he was not surprised to hear about losses of $100k+ and he knew of several very large sellers who had quit selling on the platform after being targeted but (according to him) there was nothing eBay could do to stop it.

Since that time, I've spoken to over a dozen ecommerce business owners who have been targeted by some variation of this kind of fraud operating on eBay - and every one of them has relayed a similar experience of hitting dead ends when trying to get help from eBay.

It's difficult to pinpoint the exact costs of triangulation fraud as it's often lumped in with other types of general credit card fraud, but estimates range from ~$10 Billion to $30 Billion+ a year - which may be under-reported as, in my experience, many merchants may not even be aware of this type of fraud or how to distinguish it from normal chargebacks they may receive for other reasons.

If that number is anywhere close to reality, that puts it far above the "hundreds of millions of dollars in inventory" Hardman says is lost through brick and mortar retail theft every year.

And allowing this fraud to operate unchecked spawns other types of fraud and increased demand for stolen identity information as well.

For example, when eBay transitioned from using PayPal for payment processing to their own internal Managed Payments system eBay was required to issue 1099-Ks directly for the first time, exposing even more fraudulent activity as people who had never bought or sold on the the platform began to receive tax forms for tens of thousands of dollars in sales on fraudulent accounts created using their stolen identity information.

I tracked public and private reports totally over $750,000 across 76 account, many of which showed red flags of engaging in triangulation or other types of fraud.

Received An eBay 1099-K But Never Sold On The Platform?

eBay sends 1099-Ks to some who didn’t create accounts or sell on the platform - have stolen IDs been used for fraud?

Value Added ResourceLiz Morton

To be fair, online fraud isn't just an eBay issue - Amazon, Etsy, Mercari, Poshmark, Facebook Marketplace, Walmart, and others all have similar problems and all take a similar stance, proclaiming to take fraud and illegal activity on their sites very seriously but often failing to proactively protect users and prevent crime in practice.

In fact, a group of Amazon sellers who have been hit by a variation of triangulation fraud have even filed a lawsuit against Walmart, alleging the company profits from and fails to prevent this online organized retail crime perpetrated through their marketplace.

Plaintiffs Challenge Walmart’s Section 230 Defense In Organized Retail Crime Class Action Suit

Class action seeking to hold Walmart Marketplace liable for fraud & sale of stolen goods continues as ORC victims counter Section 230 defense.

Value Added ResourceLiz Morton

But eBay, Amazon, Walmart and the rest know they don't have to do anything beyond Minimum Viable Compliance box checking because they are protected by Section 230 of the Communications Decency Act of 1996 - also known as "the 26 words that created the internet."

Section 230 states:

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

Big Tech companies know they can wield Section 230 as a "get out of liability free" card with courts consistently ruling in their favor.

Meanwhile, many consumers and legitimate businesses suffer very real and devastating economic harm as international fraud rings are emboldened and enabled to continue expanding their criminal enterprises across the web.

Aside from the obvious fees and commissions collected on every sale, marketplaces have enormous financial incentives to lobby to keep Section 230 protections in place and oppose state level efforts to hold them accountable for product liability claims.

Just as one example, eBay faced a potential $2 Billion fine in a lawsuit brought by the EPA seeking to hold them accountable for prohibited chemicals and illegal emissions control cheat devices sold on the platform.

The company pursued a Section 230-based defense, arguing eBay is "never itself a seller" and only "a pure 3rd party, peer to peer marketplace" - a position that has been demonstrably false since August 2023, when eBay set up shop on its own platform as its owned-subsidiary TCGPlayer.

But that didn't stop US District Judge Orelia Merchant from siding with eBay and dismissing the case on Section 230 grounds - and while the Department of Justice had initially indicated they planned to appeal the decision, they have since dropped the appeal, leaving that ruling to stand as precedent which will certainly be used by Walmart and others in future cases.

DOJ Drops Appeal Of Section 230 Ruling In eBay EPA Case

Department of Justice drops appeal of Section 230 dismissal in EPA case which sought to hold eBay liable for illegal items sold on their site.

Value Added ResourceLiz Morton

Importantly, it's not just the spectre of direct fines or lawsuits that has eBay and others clamoring to hold onto the Section 230 shield at all costs - if that protection went away, it could expose just how much of their publicly reported Gross Merchandise Volume comes from illegal activity, potentially impacting stock prices and leading to shareholder action and/or SEC investigations.

In theory, the INFORM Consumers Act should have helped curb this type of fraud with provisions requiring marketplace to vet and verify "high volume sellers" - but in practice, it hasn't put a dent in it.

Will The INFORM Consumers Act Stop Stolen Goods On eBay?

Home Depot & other retailers push for online marketplaces to do more to stop sale of stolen goods sold on their sites.

Value Added ResourceLiz Morton

Some legislators and regulatory agencies have recently been considering reworking or sunsetting Section 230 completely, indicating they are open to the idea that these very large tech companies should bear at least some liability for activity on their sites.

US Rep. Spanberger Presses Amazon, Facebook, eBay Over Sale Of Stolen Goods

US Rep Abigail Spanberger presses Amazon, Facebook & eBay CEOs on efforts to curb resale of stolen goods & protect consumers from organized retail crime.

Value Added ResourceLiz Morton

The Trump administration could take steps to accelerate action on Section 230 with Federal Communications Commission, Brendan Carr already pushing for reforms, largely aimed at Big Tech battles over social media censorship.

FCC Chair Brendan Carr taking first steps in eroding key legal protection enjoyed by Big Tech

Federal Communications Commission Chair Brendan Carr is taking the first steps in eroding a key legal protection enjoyed by Big Tech.

New York PostCharles Gasparino

Carr, who wrote the Project 2025 chapter on the FCC, has said, “The FCC should work with Congress on more fundamental Section 230 reforms that go beyond interpreting its current terms. Congress should do so by ensuring that Internet companies no longer have carte blanche to censor protected speech while maintaining their Section 230 protections."

In the end, Hardman may be right that eBay and others need Congress to "help" in the fight against organized theft and crime - but it may not come in the form that eBay wants if Carr and others have their way with Section 230.

If the government truly wants to protect consumers in this area, they should pass bills and apply regulations forcing marketplaces to take accountability for cleaning up the massive amounts of fraud, counterfeit, stolen and illegal goods flooding their sites - or pay the price in fines and liability lawsuits.