As criminal tactics evolve, we continue to be amazed at the lengths to which bad actors will go in order to perpetuate fraud. The criminal underground is a busy place (we tracked over 3M illicit products including credentials, gift cards, and other forms of access for sale during the holiday season alone), but now we’ve got our eyes on the collision of the digital and physical worlds in the form of organized retail crime (ORC).
The ecommerce industry continues to be a prime target for fraud, and ORC is becoming more of a headache for retailers. According to surveys from National Retail Federation (NRF), the pandemic has been a contributing factor in the rise of ORC, which costs retailers an average of $700,000 per $1 billion in sales.
Let’s dig into this tactic, how it works, and how you (and your business) can defend against this fraudulent activity.
What is Organized Retail Crime (ORC)?
Oftentimes, a news story will emerge about what is considered a “smash and grab,” where the perception might be that it’s just a few criminals trying to get some free stolen items. But what some may not realize is that these activities are often executed by a professional crew that has planned the whole process from start to finish, including staking out the store, traveling to the location, executing the crime and the get away, and ultimately making money off the stolen goods. Law enforcement recognizes these professionals as criminal enterprises.
However, organized retail crime is not limited to seemingly elaborate robberies. As the pandemic brought about more online transactions and opportunities for fraud, criminals are also taking advantage of omni-channel approaches. Other forms of fraud related to ORC include buy online, pick up in store (BOPIS) using card-not-present transactions – where the criminal makes a fraudulent purchase online, then picks up the items in store or at curbside, which can then be resold for profit (perhaps even used as part of triangulation fraud schemes). In 2020, fraudulent BOPIS attempts grew 4x by December compared to January of that year.
It’s also necessary to broaden the term “retail” beyond what consumers might consider typical brick and mortar stores. Think of the transit of goods from distribution center to store – trucks full of pallets can also be stolen and then used in fraudulent schemes as well. Such theft of goods is known in the retail industry and to law enforcement as cargo theft.
Ultimately, a criminals’ main goal is to make money, and organized retail theft is one method of earning for a criminal enterprise. In criminal organizations, everyone involved has the potential to make a profit off the stolen property. Criminals continue to exploit vulnerabilities in person and online.
Barriers and Challenges to Resolving ORC Cases
When property is stolen, retail employees often start by obtaining a picture of a license plate and a description of the vehicle to share with law enforcement or their internal loss prevention or investigation teams, in hopes of catching the criminals. Large retailers typically have teams that investigate these types of crimes to develop additional evidence, but a license plate provides little information for an investigations team or law enforcement to pursue.
Not having enough or the right information can lead to frustrating dead ends when investigating ORC. Additionally, local law enforcement may be overwhelmed or not have the resources to investigate cases that have a low potential to solve.
Connecting the Dots with Physical and Digital Elements
Despite the challenges that come with resolving ORC cases, there is hope. Like any crime, criminals will often leave “breadcrumbs” or clues that can be avenues for investigators to delve into as they seek to unmask the bad actors or tie them to other crimes. Given the right tools, these crumbs can be the key to unlock ORC cases.
Consider that there’s a digital footprint for everyone. What if retailers could tie together both physical evidence and digital evidence to build a more solid case around ORC events? What if recaptured data from the criminal underground was used to put the pieces together? For example, while a license plate may not seem like a lot of information to kick off a legitimate case, it could open doors to additional information such as a name associated with an email address, or a social handle that could give more insights and blow the case wide open.
Putting all these pieces together, investigators can gather enough information to help law enforcement drive the case to a successful resolution.
Transform ORC Investigations with SpyCloud
Finding some potential identifying details on the criminals engaging in ORC is the only way to get these cases off the ground and make significant inroads in thwarting these criminals. To do this, retailers need a tool to combat ORC in a more robust way.
This is where SpyCloud can help. Our recaptured data can yield a lot of artifacts that aid retailers in building profiles on bad actors engaging in ORC. SpyCloud Investigations draws on billions of records recovered from third-party breaches, enabling investigators to piece together digital breadcrumbs to identify those engaging in fraud. This kind of information can aid loss prevention and ORC investigations teams to present a more solid case to law enforcement and ultimately bring criminals to justice. Additionally, this information could identify the vulnerabilities used by the criminals to commit fraud so they can be remediated.
While the ecommerce industry remains a prime target for criminals, protecting against physical and digital acts of fraud is becoming a focus for multiple teams across the organization. From local stores to LP teams to even financial and legal teams, it’s necessary to proactively prevent ORC and other forms of fraud to protect the company’s bottom line and ensure quality consumer experiences.
