Refund fraud schemes promoted on TikTok, Telegram are costing Amazon and other retailers billions of dollars
A UPS seasonal worker delivers packages on Cyber Monday in New York on Nov. 27, 2023.
Stephanie Keith | Bloomberg | Getty Images
Just before midnight on May 4, 2023, police were called to an Amazon warehouse in Chattanooga, Tennessee, to investigate a reported theft.
They were met by a loss prevention employee, who directed them to a warehouse worker named Noah Page, the suspected culprit, according to a police report of the incident that was obtained by CNBC.
When confronted by police, according to the report, Page admitted that he’d marked a customer’s order in Amazon’s internal system as returned even though the products were never actually sent back to the company. Page received $3,500 for his part in the scheme, the report said.
Page didn’t know the customer but had chosen to call him “Ralph,” the report said. Ralph, it turned out, was part of a group named Rekk, an expansive refund fraud organization that targeted major retailers and recruited company employees by promising them a cut of the profits, Amazon alleged in a lawsuit.
Refund fraud, which involves tricking retailers into refunding a customer for a purchase without an item being physically returned, has become so pervasive that groups now market their services on Reddit, TikTok and Telegram. Type in “refund method” — or “r3fund,” to skirt content moderators — on TikTok and videos will pop up of users showing off piles of cash, sneakers and iPhones. One video has the caption, “me after realizing you can get a refund on any Rick Owens if the ‘package never came,'” referring to the minimalist fashion brand. The clip shows a hand endlessly tossing shoes to the ground.
Fraud groups are taking advantage of retailers’ lenient return policies, experts told CNBC, which often include unlimited free returns and sometimes even a preference that customers keep the items. It’s ballooned into a massive problem for retailers, costing them more than $101 billion last year, according to a survey by the National Retail Federation and Appriss Retail. The figure includes multiple forms of fraud, such as sending back clothing after it’s been worn, known as “wardrobing,” and returning shoplifted merchandise, the survey said.
In December, Amazon filed a lawsuit against Page and 47 other people across the globe with alleged ties to Rekk, accusing them of conspiring to steal millions of dollars worth of products in a refund fraud operation. Amazon described these services as “illegitimate ‘businesses'” that look to “exploit the refund process for their own financial gain to the detriment of honest consumers and retailers who must bear the brunt of increased costs, decreased inventory, and service disruption that impacts genuine customers.”
Amazon also suffered more than $700,000 in losses at the hands of another alleged fraud ring in which 10 people were indicted last year, according to documents from a suit filed in 2023.
Robots transport goods to the employees in warehouse at Amazon fulfillment center in Eastvale on Tuesday, Aug. 31, 2021.
the Riverside Press-enterprise | Medianews Group | Getty Images
An Amazon spokesperson said the company is addressing the issue “head on” through specialized teams and machine learning tools that detect and prevent refund fraud. Amazon says its work with law enforcement has led to arrests, the dismantling of organized retail crime groups and civil lawsuits.
“We continue to make progress in identifying and stopping fraud before it happens, as well as dismantling the groups that attempt to damage the integrity of our store and the stores of retailers across the retail industry,” the spokesperson said in a statement.
Here’s how it works: A shopper buys a product online and sends the order information to a group such as Rekk, which then poses as the customer in requesting a refund. Amazon refunds the money to the customer, who then pays the fraud group usually between 15% and 30% of the refund amount, often via PayPal or with bitcoin. That means the customer ends up buying the product for what amounts to a huge discount.
The fraud group then pays the conspiring employee at the retailer, typically a certain amount for a batch of packages the employee scans as returned.
Retailers and law enforcement agencies are catching onto the trend. In September, a 25-year-old man in Michigan, Sajed Al-Maarej, was arrested and charged with conspiracy, wire fraud and mail fraud after he allegedly ran a return fraud service called Simple Refunds that targeted more than 50 retailers. The following month, 10 men were indicted in Oklahoma, charged with conspiracy to commit wire fraud for allegedly operating a refund fraud service named Artemis Refund Group. And a 24-year-old U.K. man was convicted of fraud in December after running the KeptSecrets refund service, which targeted retailers including Amazon, Walmart and Wayfair, according to court documents.
Following the Rekk scheme, Page was arrested when police showed up at the Chattanooga warehouse in May, and he was charged with theft of property worth more than $60,000. He pleaded guilty and was sentenced in November to three years of probation, as well as ordered to pay Amazon $5,000.
Page didn’t respond to requests for comment.
A thriving refund fraud market
For every refund fraud service shut down by law enforcement, swarms of similar groups remain open for business.
CNBC viewed several active refund fraud services on encrypted messaging app Telegram, each with thousands of followers. Updates are posted almost daily of new stores on their services, or new retailers that have been successfully targeted. Amazon and Apple are frequently hit, along with Nike, eBay, Saks Fifth Avenue and Ralph Lauren. Some groups even offer their services for DoorDash and Uber Eats orders, claiming users can “eat for free.”
The groups are highly organized and run like businesses, providing customer service, cataloging orders and creating fake shipping labels. Some sell how-to guides.
A Google form from an active refund fraud service explaining which stores it targets and how much it charges customers.
Source: Google
Fraudsters employ multiple strategies. A common one is to claim a package never arrived so that the retailer issues a refund. According to Amazon’s lawsuit, a Rekk user received a full refund for two MacBook Air laptops after filing a police report falsely claiming the products never arrived.
Mail-in fraud involves a user filling out a company’s return form, but instead of sending back the purchased product, users will mail an empty box or a package filled with junk. In the case of Simple Refunds, Al-Maarej, the man who allegedly operated the group, sent an unnamed retailer “an envelope filled with plastic toy frogs” instead of the tools he claimed he was returning, prosecutors said.
Al-Maarej also recruited employees at UPS and the U.S. Postal Service who either manipulated a package’s tracking history or input false “return to sender” notices to fool the retailer into thinking an item couldn’t be delivered or that it was sent to the wrong address, according to court documents.
Chris Black, an attorney for Al-Maarej, declined to comment. Amazon said its own internal investigation identified Al-Maarej’s scheme and contributed to the eventual indictment.
The company didn’t respond to questions specifically about how it monitors and handles bribery of its employees by ORC and refund fraud groups.
Rekk allegedly used bribes, offering Amazon staffers thousands of dollars a day to approve customer returns for products that were never sent back.
In a text message last year to Page, a Rekk representative said they’d been working with two other Amazon employees for about two months and offered them $4,000 for 30 orders marked as returned, according to court documents.
“They usually do 30 scans per day per shift,” the Rekk user wrote. “Sometimes they choose to do more. So at least 12k a week.”
According to the complaint, Rekk also recruited one of Page’s colleagues at CHA1, Amazon’s name for the Chattanooga facility. Between February 2023 and May 2023, the CHA1 employee allegedly approved product returns for 76 orders at Rekk’s request, causing Amazon to refund over $100,000 to customers, and netting $3,500 from the scheme.
A refund fraud service claims to have access to Amazon insiders in a Telegram post.
Source: Telegram
Amazon said it has tried to address the bribery problem. In its lawsuit against Rekk, the company said it has an internal customer protection and enforcement team made up of attorneys, former prosecutors, and analysts investigating organized crime schemes such as refund fraud. The company has also reportedly fired employees who were allegedly bribed to leak confidential data on third-party sellers.
Cyril Noel-Tagoe, a cybersecurity expert who has studied refund fraud extensively, said the economic incentive for low-wage workers to get involved with these schemes creates a perpetual challenge for retailers.
“If you’re offering an employee much more than they’re getting paid, then it’s quite hard to combat that,” Noel-Tagoe, who works as a principal security researcher at bot detection software company Netacea, told CNBC.
‘All you need is a phone’
Those on the lookout for moneymaking opportunities will find no shortage of promotional videos across social media. For a fee, you can learn how to play the game.
One TikTok video on the topic shows bags of Louis Vuitton, Gucci and Apple products and reads, “[Point of view]: You mastered the art of r3funding and started to teach others.” TikTok clips often serve as advertisements for a user’s Telegram channel that’s linked in the bio of their account.
Similar tactics are used on Reddit.
In the “Illegal Life Pro Tips” forum on Reddit, which is no longer active but counts 1.1 million members, refund scammers shared their tips and tricks. In recent days, Reddit banned an offshoot of that subreddit, called “illegallifeprotips2,” saying it violates the site’s rules “against transactions involving prohibited goods or services.” Users quickly resurfaced on a new subreddit, “ELegalLifeProTips.” After CNBC flagged “ELegalLifeProTips,” Reddit took down the subreddit for violating its ban evasion policy.
In the past, such illicit behavior ran rampant on the dark web and required VPNs and a special browser, said Brittany Allen, a trust and safety architect at fraud detection software company Sift. These days the perpetrators regularly discuss their activities openly on forums and in messaging apps, which Allen described as the “democratization of fraud.”
“You don’t need to be that specialist that can figure out how to find these deep web groups,” Allen said. “All you need is to have a phone that can go to Reddit, or a TikTok account you’re already on, and you’ll potentially be exposed to fraud that doesn’t take as much uplift to participate in.”
Remi Vaughn, a spokesperson for Telegram, told CNBC in an email that the company moderates “harmful content” on its platform, including posts that promote fraud. “Moderators use a combination of proactive moderation on public parts of the platform and accept user reports in order to remove content which breaches Telegram’s terms,” Vaughn added.
A Reddit spokesperson said it uses a combination of automated tooling and human moderators to enforce its content policies, which prohibit users from soliciting or facilitating any transaction that involves fraudulent services.
After CNBC provided TikTok with examples of videos about refund fraud, the company said it removed them for violating its community guidelines. It said it also blocked hashtags that were used to promote refund fraud.
The use of mainstream apps in these schemes has made it easier for investigators to do their work. Noel-Tagoe referenced a case in which a retailer was able to track down an individual whose email address was in an Instagram post.
Allen said she’s been able to identify fraudsters through “vouches,” or screenshots of successful fraudulent returns. Some of the images show order numbers, store pickup locations or cart items, according to Allen, all useful intel for retailers investigating return fraud.
David Johnston, vice president of asset protection and retail operations at the National Retail Federation, said an increasing number of companies are “tightening up their return policies” in response to customer abuse and fraudulent activity.
Delivery workers, for example, are encouraged to photograph a package once it reaches its destination, and retailers are looking more closely for suspicious behavior in analyzing returns.
“There are some retailers that monitor the number of returns you make in-store, and if you return too much too frequently, they might put you on pause,” Johnston said. “We’re starting to see more of that now on the e-commerce side.”
WATCH: The ‘shopping journey will drastically look different’
Nscale, the UK-headquartered AI infrastructure provider.
Courtesy: Nscale
Two years ago, Nscale was a brand new startup in the U.K. that had yet to raise any outside funding or officially announce its existence.
Last year the London-based company came out of stealth, and in December announced that it had raised its Series A fundraising, totaling $155 million.
Now, Nscale finds itself at the center of the action in the hottest market on the planet: artificial intelligence. And it has close to $700 million in fresh capital from Nvidia, the world’s most valuable company.
In press releases on Tuesday, Nscale was named as an AI infrastructure partner for Nvidia, Microsoft and OpenAI, as the companies expand their buildouts in the U.K. Nscale then said it signed a five-year $6.2 billion agreement with Microsoft and Aker to develop “hyperscale AI infrastructure” in Europe, specifically Norway, where Aker is headquartered.
OpenAI made prior headlines with Nscale, announcing plans in July for a data center in Norway for a Stargate-branded AI data center. Nscale agreed to commit $1 billion for the project, with the goal of racking up 100,000 Nvidia graphics processing units (GPUs) at the site before 2027.
It’s a remarkably quick rise for a company that wasn’t even around when OpenAI kicked off the generative AI boom with the launch of ChatGPT in late 2022. At that time, what’s now Nscale was part of Arkon Energy, which was established a year earlier to provide infrastructure for cryptocurrency mining. Nscale was spun out to address soaring demand for data centers capable of handling AI workloads.
Like CoreWeave, which went public this year and now sports a market cap of $58 billion, Nscale is combining data center space, power and lots of GPUs with its own software in order to an provide end-to-end service for AI infrastructure.
CoreWeave, which supplies infrastructure to Microsoft, Google, Nvidia and OpenAI, also has roots in crypto. Founded in 2017, the company built up its initial fleet of Nvidia GPUs for ethereum mining before pivoting to AI.
Nscale didn’t respond to a request for comment following this week’s announcements, but CEO Josh Payne, who previously founded Arkon, told CNBC in late July that the company was targeting two big problems in Europe. One is a lack of sufficient computing capacity and the other is a “very fragmented market.”
“What the continent needs is large AI infrastructure projects deploying compute [power],” Payne said, after the announcement with OpenAI for the Norway buildout. “The ecosystem can consume from the project to build AI products, to generate productivity growth and economic benefit.”
Payne wrote in a LinkedIn post on Wednesday that the agreement with Microsoft and Aker is a “huge win for European-owned AI infrastructure.”
Europe has been pushing the concept of “sovereign AI,” requiring data centers and AI workloads to be located and processed on European soil. Nscale has quickly emerged as an important player in the U.K.’s bid to evolve into a global leader in AI. In January, Britain laid out an AI “action plan,” promising to reduce bureaucracy to help its domestic AI sector thrive.
While Nscale is addressing the European market, many of its early partners are big U.S. AI vendors. They timed their announcements on Tuesday to President Donald Trump’s state visit to the U.K.
On Wednesday, Trump visited Windsor Castle and met with King Charles, Queen Camilla and other members of the royal family. His trip comes at a contentious moment for U.K. Prime Minister Keir Starmer, who is under pressure to bring stability to the country after the exit of Deputy Prime Minister Angela Rayner over a house tax scandal and a major cabinet reshuffle.
Microsoft headlined the U.K. announcements, committing $15.5 billion of new investment to computing equipment. The software giant said it plans to work with Nscale to construct what will become the U.K.’s largest supercomputer in Loughton, a suburban town in the English county of Essex.
The site will initially house 23,040 Nvidia Blackwell GPUs to be delivered in the first quarter of 2027. When it goes live, it will generate 50 megawatts of AI capacity, scalable to 90 megawatts, according to a statement from Nscale.
“No one can make that kind of capital investment unless they’ve got somebody already committed to spend the money once the work is complete, and that’s the role we’re playing,” Microsoft President Brad Smith said Tuesday, adding the deal represents a major vote of confidence in Nscale.
OpenAI said it would launch a U.K. version of Stargate through a partnership with Nscale and Nvidia. OpenAI will deploy 8,000 GPUs in the project’s first phase early next year, with the option to expand capacity to approximately 31,000 GPUs over time.
Stargate U.K. will operate across a number of sites in the country — one of the early ones being Cobalt Park, an industrial state in the Northern English city Newcastle. Stargate was initially spawned in the U.S. in January as part of President Trump’s effort to push investments in AI infrastructure.
Nvidia CEO Jensen Huang attends the “Winning the AI Race” Summit in Washington D.C., U.S., July 23, 2025.
Kent Nishimura | Reuters
Nvidia’s announcement on Tuesday included an investment of up to £11 billion ($15 billion) with Nscale and CoreWeave to boost U.K. AI infrastructure.
Nvidia CEO Jensen Huang separately revealed on Wednesday that the chipmaker had made a £500 million ($683 million) equity investment into Nscale.
“We convinced ourselves that Nscale could be a national champion for AI infrastructure in the U.K.,” Huang told journalists at a press conference in London.
Nick Patience, AI practice lead at the Futurum Group, told CNBC that Nscale is “a key part of Nvidia’s push in the U.K. market and an acknowledgment by the government that it has to do something to get the AI infrastructure built here, which has been a long slog.”
Rapid growth
After exiting stealth in May of last year, Nscale’s first public announcement came two months later, when the company partnered with UAE’s Open Innovation AI to deploy 30,000 GPUs. Around the same time, Nscale said it was acquiring Kontena, which was founded in 2018 and specialized in high-performance computing data centers.
The next month, Nscale announced an agreement with Asian telecom company Singtel to offer a “GPU-as-a-Service (GPUaaS),” and serve customers in Europe and Southeast Asia. Initially, Nscale’s infrastructure relied on GPUs from Advanced Micro Devices. Today, the startup promotes various offerings from market leader Nvidia.
Nscale’s big financing landed in December, when the company said it raised $155 million in a round led by Sandton Capital Partners, with participation from Kestrel0x1, Blue Sky Capital Managers and Florence Capital.
Sandton co-founder Rael Nurick said in the press release that with its “unique vertically integrated approach, Nscale is building the hyperscale AI platform to power AI at scale.”
Nscale said at the time that it had grown its AI data center pipeline to 1.3 gigawatts from 300 megawatts the prior year to and that it was aiming to have 350,000 GPUs running by the end of 2027.
By comparison, CoreWeave said at a banking conference last week that its portfolio consists of “about 2.2 gigawatts of capacity that’s coming online.” The company said in its IPO prospectus in March that its 32 data centers were running 250,000 GPUs.
It’s been a whirlwind few years for Payne, Nscale’s founder. While he was serving as executive chairman of Arkon, he was also operating chief at Australia’s Battery Future Acquisition Corp., a blank check company that says it’s “targeting critical battery minerals and related supply chains.”
He’s got a lot of work in front of him.
Building out AI data centers with costly GPUs is a capital intensive process that’s historically required a hefty amount of debt. CoreWeave had raised a total of $12.4 billion in debt through the end of 2024, in addition to well over $1 billion in equity financing before its IPO. It announced a $1.5 billion bond sale in July after a $2 billion debt offering in May.
Nscale was trying to raise $1.8 billion earlier this year through a private credit deal led by bankers at Goldman Sachs, according to Bloomberg.
In the December video tied to Nscale’s equity fundraising, Payne called it “one of the largest Series As raised in U.K., European history.” He said the company would use the cash to deploy up to another 4,000 GPUs in its data center in Norway and to develop up to 180 megawatts of capacity in the company’s portfolio.
The aim, Payne said, was to deploy 50,000 GPUs by the end of 2025 and 150,000 by the end of next year.
“The key challenges that we see in the market is the significant increase in density at the GPU level,” he said. “This funding allows us to scale up materially” he said, and to become “one of the largest players in Europe.”
Eric Baker, co-founder and CEO of Ticket reseller StubHub, rings the opening bell during his company’s IPO at the New York Stock Exchange in New York City, U.S., September 17, 2025.
Brendan McDermid | Reuters
StubHub shares opened at $25.35 in their New York Stock Exchange debut on Wednesday after the online ticket seller priced its IPO in the middle of its expected range.
The pricing late Tuesday at $23.50 per share raised $800 million for the company, now trading under ticker symbol “STUB.”
StubHub’s long-awaited IPO comes after the company paused its plans in April, when President Donald Trump’s “Liberation Day” tariffs sent the stock market into a tailspin. It was the second such delay, after market volatility forced StubHub to temporarily shelve its IPO plans in July 2024.
The IPO is the latest in a flurry of tech offerings as the market rebounds from a dismal few years. Swedish buy now, pay later firm Klarna and Gemini, the crypto firm founded by Cameron and Tyler Winklevoss, rose in their respective debuts last week. Peter Thiel-backed cryptocurrency exchange Bullish, design software company Figma and stablecoin issuer Circle have also hit the market in recent months.
StubHub has been through a number of transactions in its 25-year history to get to this point. It was purchased by eBay for $310 million in 2007, but was reacquired by its co-founder Eric Baker in 2020 for roughly $4 billion through his new company Viagogo.
StubHub has benefited from a resurgence in the live events market in the years following the Covid lockdowns. Sales have also boomed from massively popular shows like Taylor Swift’s Eras Tour and Beyoncé’s Renaissance Tour, as well as sporting events like the Super Bowl.
The company said in its updated prospectus filed last month that those sorts of events can also make StubHub’s revenues lumpy and difficult to predict.
In the first quarter, StubHub reported revenue growth of 10% from a year earlier to $397.6 million. Its net loss widened to $35.9 million from $29.7 million a year ago. Gross merchandise sales, which represent the total dollar value paid by ticket buyers, reached $2.08 billion in the three months ended March 31.
StubHub primarily generates revenue from connecting buyers with ticket resellers. More than 40 million tickets were sold on StubHub’s marketplace last year from roughly one million sellers, the company said in August.
It competes with Vivid Seats, which was taken public via a special purpose acquisition company in 2021, SeatGeek and Ticketmaster parent Live Nation Entertainment.
The Federal Trade Commission is in the advanced stages of probing Ticketmaster over whether it’s done enough to keep automated bots from circumventing its per-person ticket limits for popular events, Bloomberg reported Monday, citing people familiar with the matter.
The FTC in May sent a warning letter to StubHub saying it must comply with the agency’s “junk fees” rule and alleging some of its ticket listings failed to display the total price, including all mandatory fees and charges.
Madrone Partners is StubHub’s largest investor with ownership of 24.5% of Class A shares prior to the offering. WestCap is second at 12.3%, followed by Bessemer Venture Partners at 8.8%.
WATCH: StubHub CEO on IPO
Technology
Ten years after selling Periscope to Twitter, startup’s co-founder raises $40 million for Macroscope
Macroscope employees.
Macroscope
It’s been a decade since Kayvon Beykpour sold Periscope to Twitter for a reported $100 million, allowing the social media site to jump into livestreaming.
Twitter shuttered Periscope in 2021, and the parent company, now called X and owned by Elon Musk, gravitated to a live events product called Spaces.
Meanwhile, Beykpour, who spent seven years at Twitter after the acquisition, is back with Macroscope. He said on Wednesday that he’s raised $40 million from venture investors, including GV (formerly Google Ventures), Lightspeed Venture Partners and Thrive Capital.
While Periscope targeted a consumer audience, Macroscope is going squarely after businesses. Beykpour’s idea is to help software developers easily spot issues in their code, and show managers what their engineers are doing.
Beykpour said the lack of transparency in the software development process was a big problem in his former gig.
“So much of my job as the head of product at Twitter was just understanding what the hell was happening,” Beykpour, said in an interview. “You have all these engineers at the company and all these very important things that we need to get done with absolute opaqueness around, like, What progress did we make? What are all these people working on?”
He said the startup set out to help product leaders first and added features for programmers later.
Macroscope integrates with Microsoft-owned GitHub’s source code repositories and project management software from Atlassian and Linear. Its technology connects to artificial intelligence models from Anthropic, Google and OpenAI that can propose alternative code and answer questions from developers and product executives.
Products like GitHub Copilot and Cursor’s BugBot already can review code with help from AI. Beykpour said that in testing Macroscope outperformed competitors when it came to correctly identifying known software bugs.
And when it comes to tools to help managers stay on top of developers’ activity, there’s not much available, Beykpour said.
“They’re solving it with meetings,” he said. “If we cannot surpass the bar of, people call a meeting to ask a bunch of engineers what’s happening, we’ve failed miserably.”
Macroscope costs $30 per developer per month, which includes the status-checking components for bosses, while Cursor is priced at $32 per month when purchased annually.
Early users include film studio A24, online learning startup Class and probiotics company Seed Health.
Beykpour started Macroscope in 2023 with Periscope co-founder Joseph Bernstein and Rob Bishop, founder of AI startup Magic Pony, which Twitter acquired in 2016. The company has 17 employees and is based in San Francisco.
WATCH: AI startups raise $104 billion so far in 2025 but most investors are still waiting for a payout
-
Sports3 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports1 year agoStory injured on diving stop, exits Red Sox game
-
Sports2 years agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoButton battles heat exhaustion in NASCAR debut
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports4 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment12 months agoHere are the best electric bikes you can buy at every price level in October 2024