Poshmark Triangulation Fraud Scheme Uncovered By Montgomery County, MD Police Investigation
Detectives from the Montgomery County, Maryland Department of Police are investigating fraudulent activity on Poshmark, seeking additional information and to identify any additional victims.
Gaithersburg, MD - Detectives from the Montgomery County Department of Police – 4th District Patrol Investigative Unit (PIU) are investigating a scam involving Poshmark. Detectives believe there may be additional victims.
The investigation has revealed that on Saturday, September 7, 2024, a victim in Montgomery County reported that their bank card had been fraudulently used to purchase an online order from Dick's Sporting Goods.
Through investigation, detectives were able to track the package purchased from Dick’s Sporting Goods to a different recipient. Detectives verified that the individual who received the package, had purchased the item on Poshmark from seller “@Valdez310,” and that it had been sent from Dick’s Sporting Goods.
Detectives learned that the original victim’s bank card had been used to buy the Dick’s Sporting Goods item and the suspect passed it off as a Poshmark item.
Through further investigation, detectives have determined that Poshmark seller, "@valdez310" has been using stolen credit card information to list and sell fraudulent orders on Poshmark.
Detectives believe there may be additional victims whose personal information has been stolen and used to list and sell fraudulent orders on Poshmark.
What the press release describes sounds like a textbook case of triangulation fraud - a sophisticated form of online shoplifting which occurs when a buyer makes a genuine purchase on a third-party marketplace, but the seller fraudulently purchases the product from another merchant or direct ecommerce website.
Krebs On Security wrote a fantastic article about triangulation fraud in 2015. Interestingly, the triangle graphic used in this article actually came from an eBay help page at the time.
Dr. Nina Kollars, an Associate Professor in the Cyber and Innovation Policy Institute at the United States Naval War College, also shed light on what triangulation fraud is like from the buyer perspective in her Confessions of an Nespresso Money Mule at DEFCon 2019.
And I personally experienced this fraud perpetrated through eBay in 2020, when it hit my then-employer to the tune of over $160,000 in less than 4 months.
Liz Morton
Triangulation fraud is rampant across many online marketplaces and often the accounts being used by fraudsters may even be hijacked compromised accounts or accounts set up using stolen identity information.
Liz Morton
The INFORM Consumers Act was supposed to help curb this kind of crime by requiring marketplaces to collect and in some cases report details about high volume selling accounts, but so far it doesn't seem to be doing much good as the sale of stolen goods continues to be a serious problem for many major marketplaces.
Liz Morton
Given the details in the Montgomery County Police press release above, here's what the order and payment flow for the Poshmark scheme they describe might look like:
Unfortunately for Montgomery County detectives, this kind of fraud is often perpetrated by massive overseas fraud rings with access to hundreds of thousands of stolen credit cards and ID info, not to mention the fact that the information attached to the fraudulent Poshmark selling account could possibly be a stolen ID that won't actually lead back to the real criminal(s) involved.
One might think that Poshmark's shipping policies would help prevent this fraud - since they provide a pre-paid shipping label to the seller and there would be no way for the fraudulent seller to have Dick's Sporting Good's use that Poshmark provided label to ship to the Poshmark buyer.
However, Poshmark sellers can still use their own labels if they chose to - and while there's not much incentive for legitimate sellers to do that, the fraudsters can and apparently do take advantage of it.
According to Poshmark's policies:
Why are Poshmark shipping labels required?
Our shipping labels allow our system to track the package and take care of any issues that may occur while it is in transit to the buyer.If our label is not used, we cannot offer insurance on the package and the buyer will not be able to accept the order through the app, causing a delay in your earnings being released to you.
If you accidentally used a different label, please reach out to Poshmark Support and provide us with the tracking information.
Since the fraudsters are not actually paying for the items, they don't particularly care if the shipment is insured.
That also means the fraudsters can afford to offer prices that are literally a steal, so while using a different tracking number may delay payouts, odds are they'll still get paid since the buyer will receive the exact item ordered at a fantastic price with no reason to suspect fraud has occured - likely leaving a positive rating and not raising any red flags, especially if there isn't an invoice in the box making it obvious the item shipped from a different company.
Typically, triangulation fraud will use a different, unrelated person's stolen credit card information to pay for the item being shipped to the unsuspecting buyer, with the legitimate seller receiving a chargeback after the item has been shipped, leaving them out both the item and the money.
But it can also take more complex forms like a recent case in which fraudulent sellers list items on Walmart's Marketplace, order the items from legitimate sellers on Amazon and take advantage of Amazon's notoriously buyer-friendly policies to obtain refunds by falsely claiming items are not received instead of using stolen credit cards.
A group of Amazon sellers who have been hit by this fraud have filled a class action lawsuit against Walmart, alleging the company profits from and fails to prevent this online organized retail crime perpetrated through the Walmart Marketplace.
Liz Morton
If all of that sounds confusing - that's the point...fraudsters who engage in this kind of sophisticated digital shoplifting depend on the complexity of the scheme to make it as difficult as possible for the victims (legitimate sellers) to put the pieces together or to take action to protect themselves.
The marketplaces often offer little to no help to victims of this fraud, hiding behind Section 230 legal protections that help them avoid liability for activity of third party sellers.
In fact, that's exactly what Walmart is doing, while also suggesting the plaintiffs in that lawsuit are targeting the wrong company and should be seeking compensation from Amazon instead.
Liz Morton
Walmart may make some logical and compelling points - but that's also the exact reason this kind of complex scheme has been allowed to proliferate across the internet for years, enabling vast, often international criminal rings to commit tens of billions of dollars in triangulation type fraud every year.
Unfortunately, the current legal and regulatory framework has allowed these multi-billion dollar tech giants to play ping pong, bouncing victims of fraud between themselves, with very little incentive to do anything to help as they know they are likely legally insulated from liability and can afford to keep litigation tied up for years should anyone try to challenge the status quo.
Meanwhile, many consumers and legitimate businesses suffer very real and devastating economic harm and international fraud rings are emboldened and enabled to continue expanding their criminal enterprises across the web.
The Montgomery County, Maryland Department of Police are urging anyone in their area who believes they may be a victim of this Poshmark scam to contact 4th District PIU detectives at 240-773-5476.
And if you been victimized by triangulation fraud across any marketplace, either as a consumer or a legitimate seller, I'd love to hear from you too! Leave a comment below or contact VAR - requests for confidentiality will absolutely be respected.
