Marketplace Transparency & The INFORM Consumers Act
An increase in smash and grab, highly organized retail thefts has stoked tensions between large traditional brick and mortar retail operations and online marketplaces they say encourage and enable fraud, theft, and other criminal activity.
Daphne Howland
Major retailers and law enforcement groups have called on Congress to act, mainly by pushing legislation that would require greater transparency, verification, and discloser of the identities of online sellers like the INFORM Consumers Act.
This bill requires online marketplaces to collect, verify, and disclose certain information from high-volume, third-party sellers.
High-volume, third-party sellers include online marketplace participants that conduct 200 or more transactions resulting in total revenues of $5,000 or more during a continuous 12-month period. Online marketplaces must acquire these sellers' (1) bank account numbers, (2) government-issued identification, (3) tax identification numbers, and (4) contact information. Online marketplaces must verify this information and annually certify any changes to it.
Further, online marketplaces must make certain information (e.g., sellers' names and contact information) available to consumers through the sellers' product listings and provide consumers with methods to report electronically and by telephone any suspicious activity on the marketplace.
The bill provides the Federal Trade Commission with the authority to enforce these requirements.
Marketplaces and online sellers have raised safety and privacy concerns that are important to consider as well. While they initially fought the legislation, eBay has since gotten on board after certain changes and considerations were made that limit the scope of information that must be displayed publicly about the seller.
My take: the proposed legislation and similar solutions to the problem of online marketplaces being used for criminal activity all leave out one huge piece of the puzzle - the "bad guys" who have no qualms about smash and grab thefts or selling stolen or dangerous counterfeit goods also have no qualms about using stolen personally identifiable information and hacked marketplace accounts to commit their crimes.
While it's nowhere near the physical danger these brick and mortar stores are facing, I'm very familiar with what it's like to be targeted by an organized, sophisticated crime ring that uses online marketplaces to hide their tracks and also very familiar with how little marketplaces are willing to assist with bringing these criminals to justice.
Last year I went deep down the rabbit hole of triangulation fraud when my then employer was targeted by a fraud ring that would list items for sale on eBay that they did not have in their possession and when a sale was made they would order from our legitimate ecommerce website using stolen credit cards and have the item shipped to their eBay buyer.
Liz Morton
It was a massive operation that resulted in losses in excess of $160,000 for the company when the legitimate card holders filed credit card chargebacks. I personally reported over 150 hacked eBay accounts that were used to commit this fraud and eBay did very little to assist - their position was that since the theft via stolen credit cards occurred off their site, it wasn't their problem despite the fact that effectively stolen goods were being sold on their platform using compromised user accounts.
Similar account takeover fraud is used in many of the most popular eBay scams.
Liz Morton
Peter Craig
Here's one place where I think this legislation falls short - by focusing exclusively on requiring transparency and disclosure of accountholder information, they have missed the fact that in some cases involving sophisticated criminal enterprises the account could be hacked/compromised or using stolen identity information and therefore the person whose name and contact information is being used may actually be a victim, not an accomplice.
For example, the UK already has regulations requiring eBay to disclose the name, address and contact information for business accounts. I've seen many car scam listings where the fraudster has compromised and taken over an account, created thousands of fraudulent listings and every single one of them still has the legitimate accountholder's contact information at the bottom of the listing.
Requiring a legitimate businessperson to provide and disclose that information doesn't protect anyone if the account has been hacked and is being used fraudulently in the commission of a crime. Hacked accounts can be used to fence goods stolen from brick and mortar retail stores just as easily as they can be used for other types of online fraud.
Similarly, the kinds of AI/Machine Learning powered solutions that could be used to flag dormant accounts that suddenly become active selling $7,000 Rolex watches or recognize the same images being used for fraudulent car scams could be used to identify and track suspicious accounts being used for other criminal activity as well.
While stricter vetting and Know Your Customer requirements may be a good step, it is by no means a cure-all for online crime and in some ways I believe it's letting the marketplaces off too easily instead of holding them accountable for the safety and security of their own websites.
When I reported massive fraud using hacked accounts to eBay, I was stonewalled, shuffled to various departments and ultimately told "we know it's been a problem for years, but there's nothing we can do."
Another seller recently reported they've had over 100 suspicious sales from hacked accounts come through on the platform in a month and eBay has not taken their reports seriously.
Liz Morton
Connecticut Attorney General William Tong is cracking down on criminals who sell stolen goods online and has also put marketplaces on notice that they need to be doing more to help.
On Tuesday, Tong told Hearst Connecticut his expectation that online retailers like Amazon and eBay do more to identify those selling fenced goods and alert authorities, whether through artificial intelligence or people scanning transactions for red flags.
“I’m giving them the opportunity to show me that they are willing to make the investment of resources and time and energy to stopping the flow of illegal goods,” Tong said.
Tong said Amazon, eBay and other companies can start by sharply expanding the resources they are committing.
“My response to, ‘Well, this is hard,’ is ‘Well, it’s your job,’” Tong said. “It’s your responsibility — we don’t want excuses, we want action.”
I couldn't have said it better myself. 👏👏👏
