Paper Info
Title
Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service
Abstract
Concession Abuse as a Service (CAaaS) is a growing scam service in underground forums that defrauds online retailers through the systematic abuse of their return policies (via social engineering) and the exploitation of loopholes in company protocols. Timely detection of such scams is difficult as they are fueled by an extensive suite of criminal services, such as credential theft, document forgery, and fake shipments. Ultimately, the scam enables malicious actors to steal arbitrary goods from merchants with minimal investment. In this paper, we perform in-depth manual and automated analysis of public and private messages from four large underground forums to identify the malicious actors involved in CAaaS, carefully study the operation of the scam, and define attributes to fingerprint the scam and inform mitigation strategies. Additionally, we surveyed users to evaluate their attitudes toward these mitigations and understand the factors that merchants should consider before implementing these strategies. We find that the scam is easy to scale-and can bypass traditional anti-fraud efforts-and thus poses a notable threat to online retailers.
Year
Venue
DocType
2021
PROCEEDINGS OF THE 30TH USENIX SECURITY SYMPOSIUM
Conference
Citations 
PageRank 
References 
0
0.34
0
Authors
10
Name
Order
Citations
PageRank
Zhibo Sun100.34
Adam Oest262.82
Penghui Zhang311.06
Carlos E. Rubio-Medrano472.32
Tiffany Bao5648.17
Ruoyu Wang628216.23
Ziming Zhao732230.52
Yan Shoshitaishvili835826.98
Adam Doupé935733.14
Gail-Joon Ahn103012203.39