SCAMMAGNIFIER: Piercing the Veil of Fraudulent Shopping Website Campaigns

SCAMMAGNIFIER: Piercing the Veil of Fraudulent Shopping Website Campaigns

Speakers: Marzieh Bitaab

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=1rkn6prsUIk

Overview

In an insightful presentation at the NDSS Symposium, Marzieh Bitaab unveiled SCAMMAGNIFIER, a novel research initiative designed to expose the intricate, large-scale operations behind fraudulent shopping websites. This talk delves into a critical and pervasive cybercrime problem where users are directly defrauded, often losing significant sums of money through non-delivery of goods or the shipment of counterfeit items. The research challenges conventional detection methods that rely on easily manipulable website features, instead proposing a deeper, infrastructure-centric approach.

The core of Bitaab's work focuses on understanding how these fraudulent operations generate revenue and evade detection by leveraging merchant IDs—unique identifiers used by payment processors. By analyzing the common threads connecting seemingly disparate scam websites, SCAMMAGNIFIER uncovers evidence of highly organized, campaign-driven fraud rather than isolated incidents. The findings not only highlight the sophisticated nature of these scams but also underscore the urgent need for cross-organizational collaboration to combat them effectively, offering a pathway toward more proactive and robust defense mechanisms against online shopping fraud.

This research is particularly pertinent given the escalating financial losses reported by consumers, exceeding $300 million annually since 2021 in the US alone, a figure widely acknowledged to be an underestimate. The impact extends beyond individual users, affecting financial institutions through increased chargeback disputes and damaging the reputation of legitimate brands. SCAMMAGNIFIER provides a crucial framework for understanding the adversary's operational model, enabling more resilient detection and takedown strategies in the ongoing battle against online fraud.

Background

▶ Watch: Introduction to fraudulent shopping websites problem (0:00)

Fraudulent shopping websites represent a significant and growing threat in the cybercrime landscape. These sites typically operate by advertising products, often branded or generic, with the intent to defraud users. Common modus operandi include failing to deliver purchased items altogether or shipping low-quality counterfeits that bear no resemblance to the advertised goods. The financial toll on consumers is staggering, with reported monetary losses to the FTC surpassing $300 million annually since 2021. This figure is, by most estimates, a mere fraction of the actual losses, as many victims do not report their experiences. Beyond direct consumer harm, these fraudulent activities also strain financial organizations due to increased chargeback disputes and severely damage the reputation of legitimate brands whose products are mimicked or falsely advertised.

Previous research in this domain has largely focused on collecting data from various sources, manually crafting features, performing feature engineering, and training machine learning models to detect these malicious websites. While these methods have yielded some success, they suffer from a fundamental flaw: the features used for detection—such as website content, design elements, or textual patterns—can be easily manipulated by attackers. Fraudsters can tweak their websites to alter these superficial features, thereby bypassing existing detection mechanisms and prolonging their illicit operations. This adaptability highlights a critical gap in current anti-fraud efforts, necessitating a more profound understanding of the underlying infrastructure and operational tactics employed by these criminals.

To address this gap, Bitaab's research shifts focus from surface-level features to the core mechanisms of financial transactions. Legitimate shopping websites, and by extension fraudulent ones, rely on payment processors (e.g., credit card gateways, Google Pay, Apple Pay, PayPal) to facilitate purchases. Crucially, these payment processors identify the ultimate recipient of funds through a unique identifier known as a merchant ID. This ID links a transaction to a specific individual or entity, providing a potential avenue for tracing fraudulent networks. The research aimed to answer two primary questions: first, how do these fraudulent websites leverage payment processors to make money and evade detection? Second, can the information gleaned from merchant IDs be used for more proactive detection? This particular talk primarily focused on the first question, investigating fraudulent operations from the perspective of their financial conduits.

Key Findings

▶ Watch: Discovery of shared merchant IDs and evasion techniques (4:00)

The investigation initiated by manually simulating the checkout process on several suspected fraudulent websites quickly revealed a critical insight: multiple distinct fraudulent websites were found to share identical merchant IDs. This observation immediately suggested that these were not isolated, ad-hoc operations, but rather orchestrated, large-scale campaigns managed by the same fraudster or group. This initial finding was a cornerstone, indicating a level of organization and connectivity previously underestimated by feature-based detection methods.

Further analysis uncovered a sophisticated evasion technique. When users proceeded to checkout on some fraudulent sites, and clicked a payment processor button, a deliberate redirection occurred before the user landed on the actual payment processor page. The purpose of this redirection is to obfuscate the original fraudulent website from the payment processor. Should a payment processor detect an increase in chargebacks associated with a particular merchant ID, tracing back the transaction path would only reveal the intermediary redirection site, effectively shielding the initial fraudulent storefront from direct scrutiny and potential blacklisting. This mechanism serves as a critical obfuscation mechanism to maintain their operational longevity.

To capture these insights at scale, the research developed the SCAMMAGNIFIER pipeline. Over a 13-month period, this pipeline collected data from over 1 million shopping websites, identifying approximately 46,000 as fraudulent. The auto-checkout process was successfully completed for about 41,000 of these, yielding 5,278 unique merchant IDs. Analysis of these IDs confirmed the initial findings regarding shared merchants. The collected data also revealed common domain registrars and hosting providers across these fraudulent sites, further indicating shared infrastructure.

A striking observation was the high degree of similarity among fraudulent websites. Samples displayed identical templates, reused textual and image artifacts, and even featured URLs that differed by only a single character, strongly suggesting mass-produced, templated campaigns. The true extent of this connectedness was visualized in a graph, where merchant IDs served as central nodes connecting numerous fraudulent domains. It was discovered that over half of the identified merchants were associated with a single payment processor.

Collaborating with this major payment processor, the research team shared 2,700 merchant IDs. The payment processor, leveraging its historical data, confirmed that these merchants were linked to over 14,000 domains, vastly exceeding the number initially discovered by SCAMMAGNIFIER's collection period. This collaboration definitively proved the campaign-driven nature of the fraud. A particularly alarming finding was the high concentration of fraud: 54.5% of these 14,000+ domains were operated by just 10 merchants. This statistic powerfully underscores that online shopping fraud is not an ad-hoc cybercrime but a highly organized, centrally controlled, and orchestrated endeavor. The research concluded by demonstrating a browser extension as a proof of concept, which showed improved detection rates by leveraging this connectivity information, and emphasized the critical necessity of cross-organizational collaboration for proactive fraud detection and prevention.

Technical Deep Dive

▶ Watch: Introducing SCAMMAGNIFIER: automated checkout pipeline (4:50)

The technical approach of SCAMMAGNIFIER is rooted in a fundamental shift from analyzing superficial website features to dissecting the underlying financial infrastructure. The core hypothesis is that by understanding how fraudulent websites make money through payment processors, and specifically by identifying the merchant IDs used, a more robust and evasive-resistant detection mechanism can be developed.

The methodology began with manual investigation, mimicking the user experience. Researchers would navigate to suspicious shopping websites, add items to a cart, and proceed to the checkout page. At this stage, if a payment processor option (e.g., PayPal, credit card gateway) was available, the website's source code or the URL of the payment processor's redirection page was inspected to extract the embedded merchant ID. This manual process confirmed that identical merchant IDs were indeed being reused across multiple fraudulent domains, providing the initial impetus for large-scale automation.

To scale this manual process, the SCAMMAGNIFIER pipeline was developed. This sophisticated system operates in several key stages:

1. Daily Domain Collection: The pipeline continuously monitors and collects newly registered domains. This proactive approach ensures that emerging fraudulent campaigns are identified early in their lifecycle.
2. Initial Information Storage: For each collected domain, comprehensive information is archived, including WHOIS data (domain registration details), website content, and full-page screenshots. This data serves as a rich source for initial classification and later analysis.
3. Machine Learning-Based Classifier: A preliminary machine learning model is employed to classify newly collected websites as either legitimate or potentially fraudulent. While the talk did not detail the specific features or model architecture, this step acts as an initial filter, directing suspicious sites to the more intensive auto-checkout process.
4. Auto-Checkout Emulator: This is the core component of SCAMMAGNIFIER. It functions as a highly capable, automated crawler designed to mimic human interaction with a shopping website. Its sequence of operations includes:

• Domain Access: Opening the target domain.
• Product Identification: Locating and clicking on product links.
• Form Filling: Automatically filling any necessary forms (e.g., shipping details, although actual personal data is not used).
• Payment Processor Interaction: Navigating to the checkout page and clicking on available payment processor buttons.
• Merchant ID Capture: Crucially, during the interaction with the payment processor gateway, the emulator extracts the merchant ID. This ID is typically embedded in the payment processor's page source code or within the redirected URL.
• Data Collection: Throughout this process, the emulator captures additional data points, including sequential screenshots of each step and detailed performance logs. These logs are vital, recording interaction details such as HTTP response codes, any errors encountered, and critically, all redirections that occur during the checkout flow. This last point is particularly important for detecting the evasion technique where fraudulent sites redirect away from the initial domain before reaching the payment processor, masking their true origin.

The pipeline was run for 13 months, processing over 1 million shopping websites. Out of these, approximately 46,000 were identified as fraudulent by the ML classifier. The auto-checkout emulator successfully completed its process for about 41,000 of these, yielding a dataset of 5,278 unique merchant IDs. This extensive dataset allowed for detailed analysis of the connections between domains and merchants.

The analysis of the collected data revealed compelling evidence of sophisticated, campaign-driven fraud:

• Shared Infrastructure: The prevalence of common domain registrars and hosting providers among fraudulent sites indicated a shared backend infrastructure, suggesting centralized control.
• Website Similarity: Visual and textual analysis showed that many fraudulent websites utilized identical templates, reused images, and copied text. Furthermore, some site URLs were almost identical, differing by only a single character, pointing to rapid, template-based deployment.
• Merchant ID Connectivity: The graph-based visualization of domain-merchant relationships clearly demonstrated that single merchant IDs were often linked to dozens or even hundreds of fraudulent domains. A significant finding was that over half of the discovered merchants were associated with a single major payment processor, highlighting a potential choke point for intervention.

The collaboration with the payment processor was a critical validation step. By sharing 2,700 identified merchant IDs, the processor was able to cross-reference against its own historical transaction data. This revealed that these 2,700 merchants were, in fact, connected to over 14,000 domains, a number far greater than what was observable during SCAMMAGNIFIER's active collection period. This historical perspective undeniably confirmed the long-standing and expansive nature of these campaigns. The revelation that 10 merchants were responsible for 54.5% of these 14,000+ domains underscores the highly concentrated and organized nature of this fraud, where a small number of bad actors can operate a vast network of scam sites. This deep technical understanding of their operational model empowers more targeted and effective defensive strategies.

Demo / Proof of Concept

▶ Watch: SCAMMAGNIFIER results: scale of fraudulent operations (6:10)

While the talk did not feature a live demonstration of the full SCAMMAGNIFIER pipeline, the speaker did reference a browser extension developed as a proof of concept. This extension serves to illustrate the practical application of the research findings, specifically how the identified connectivity information—derived from shared merchant IDs and infrastructural links—can be leveraged to improve real-time fraud detection for end-users.

The core idea behind the browser extension is to utilize the knowledge base built by SCAMMAGNIFIER. When a user visits a shopping website, the extension can query its internal database or an anti-fraud service informed by SCAMMAGNIFIER's data. If the visited site is linked to known fraudulent merchant IDs or belongs to a detected fraudulent campaign (e.g., sharing templates, registrars, or exhibiting the redirection evasion technique), the extension can alert the user.

The speaker mentioned that the browser extension, when run for a period, showed "very promising" results, significantly outperforming existing "off-the-shelf" browser extensions like Netcraft in terms of detection rates. This suggests that the infrastructure-centric approach, focusing on persistent identifiers like merchant IDs and campaign-level patterns, offers a more robust and harder-to-evade detection mechanism compared to methods relying on more superficial website characteristics. While specific technical details of the extension were deferred to the full research paper, its existence as a proof of concept validates the practical utility and improved efficacy of SCAMMAGNIFIER's methodology in the fight against online shopping fraud.

Defensive Implications

▶ Watch: Visualizing the network of fraudulent sites via merchants (7:20)

The findings from SCAMMAGNIFIER provide crucial intelligence for various stakeholders involved in combating online shopping fraud, necessitating a strategic shift in defensive approaches.

For Payment Processors and Financial Organizations, the message is clear: merchant IDs are a critical, underutilized forensic link. Instead of solely reacting to individual chargebacks, payment processors should proactively leverage merchant IDs to identify and ban bad actors much sooner. By implementing robust analytics that correlate merchant IDs with suspicious activity across multiple domains and utilizing historical data, they can detect fraudulent campaigns at their nascent stages. Monitoring for the redirection evasion technique, where initial fraudulent sites are hidden from the payment gateway, is also paramount. Enhancing internal fraud detection systems to flag patterns of rapid domain registration under a single merchant ID or unusual transaction volumes from newly linked sites can dramatically improve their effectiveness.

Domain Registrars and Hosting Providers also play a pivotal role. They should monitor for patterns indicative of fraudulent campaigns, such as bulk registrations of similar-sounding domains, rapid churn, or WHOIS information that appears consistently fraudulent across multiple registrations. Implementing more stringent verification processes for high-risk registrants and having clear, rapid takedown procedures for identified fraudulent infrastructure are essential.

For Security Researchers and Anti-Fraud Vendors, the research strongly advocates for moving beyond easily manipulated website features. The focus should shift towards infrastructure-level indicators, shared campaign elements, and persistent identifiers like merchant IDs. Developing tools and services that can map these connections, similar to SCAMMAGNIFIER, will provide a more resilient defense. This includes creating and sharing threat intelligence feeds that incorporate merchant ID to domain mappings and identified campaign patterns.

Consumers need to be educated about the sophisticated nature of these campaigns. They should be wary of websites with generic templates, suspiciously low prices, or subtle inconsistencies in branding. Understanding that even if a payment processor's page looks legitimate, the initial shopping site might be fraudulent, is key. Tools leveraging the SCAMMAGNIFIER approach (like the browser extension) could empower users with real-time warnings.

Above all, the research emphatically calls for cross-organization collaboration. The fact that 10 merchants can control over 54% of fraudulent domains across a vast network underscores that no single entity can effectively combat this problem alone. Payment processors, anti-fraud organizations, law enforcement, domain registrars, and security vendors must establish secure channels for sharing threat intelligence, merchant IDs of known bad actors, and identified campaign patterns. This collective intelligence sharing will enable platforms to ban fraudsters more swiftly, preventing them from establishing hundreds or thousands of new sites to lure victims. A unified, collaborative front is the most potent defense against these highly organized and adaptive cybercriminal enterprises.

Key Takeaways

• Fraudulent shopping is a large-scale, campaign-driven operation, not a collection of ad-hoc, isolated incidents. A small number of actors control vast networks of scam sites.
• Merchant IDs serve as critical forensic links, revealing shared infrastructure and operator identities across numerous seemingly distinct fraudulent websites.
• Attackers employ sophisticated evasion tactics, such as strategic redirections before the payment processor page, to hide the true origin of fraudulent transactions and avoid detection.
• The SCAMMAGNIFIER pipeline offers a robust, automated methodology for proactively identifying fraudulent shopping websites and mapping their underlying financial and infrastructural connections.
• A highly concentrated threat exists: a mere 10 merchants were found responsible for over 54.5% of the 14,000+ fraudulent domains identified through collaboration with a payment processor.
• Cross-organizational collaboration between payment processors, anti-fraud entities, and security researchers is absolutely essential for proactive detection, swift takedown, and ultimately, effective disruption of large-scale fraudulent campaigns.

About the Speaker(s)

The presentation was delivered by Marzieh Bitaab. While specific institutional affiliations or titles were not detailed in the provided metadata or transcript, the context of the NDSS Symposium and the congratulatory remarks regarding her graduation in the Q&A segment suggest she is a researcher, likely a PhD candidate or recent graduate, contributing significant work in the field of cybersecurity, specifically focusing on understanding and combating online fraud. Her research presented in "SCAMMAGNIFIER" demonstrates a deep technical understanding and a commitment to addressing real-world security challenges.