How Noir’s Refunds Scammed Retailers Out Of Millions

Frank McKenna

March 23, 2024

Aiman Akram Kaif went by the handle @Dior on Telegram. Damion Wayne Scarlett was known as @Dash. Dhruv Gargi’s alias was @Panda.

On the surface, they appeared to be regular users of the popular encrypted messaging app. However, according to a federal indictment, this trio and six others were key members of a fraud ring that used Telegram to coordinate an elaborate scheme to defraud online retailers out of millions of dollars.

They are the latest in a long line of “Professional Refunders” who have been caught up in an FBI-sweeping crackdown called “Operation Chargeback.”

A Group That Loved Luxury Items and “Making Bread”

Operating under “Noir’s Organization,” the group allegedly recruited members and customers through various Telegram channels, notably one called “Noir’s Luxury Refunds.”

The group operated virtually out of their homes in New York, New Jersey, Arizona, Minnesota, Texas, California, Virginia, and Canada.

The group offered “professional refunding services” to obtain refunds and replacement products from retailers, allowing customers and themselves to obtain expensive items like electronics, designer clothing, and appliances for free while the retailers took the losses.

Customers would pay Noir’s Organization a percentage of the product price in exchange for the organization fraudulently refunding the item on the customer’s behalf. Noir’s Organization marketed itself as having the expertise to defraud retailers worldwide in various industries.

They even had Google Sheets indicating how much they could get at each retailer.

Their Telegram group sprouted up at the height of the pandemic in 2020 and, at one point, had over 5,900 followers.

The Noirs Luxury Refunds Playbook Included Double Dipping

Noir’s Organization deployed various tactics to trick retailers, often evolving their methods in response to companies’ anti-fraud measures.

The group used five different schemes to steal from merchants.

#1 The Did Not Receive Package Scheme

Customers of Noirs would contact “Dash” or “Panda” once an item was delivered, and the group would contact the retailers on their behalf, claiming the items were never delivered or boxes arrived empty to obtain refunds.

#2 The Fake Warranty Claim Scam

The group also operated to get replacement products through fake warranty claims. Noir Luxury Refunds would fraudulently claim that a product they ordered had purchased was defective, prompting the retailer to ship out a replacement item.

#3 The FTID Fraud Scheme

According to the complaint, the group manipulated shipping labels on return packages sent back to retailers. They altered the labels to remove identifying information about the customer and even changed the return shipping address.

This clever ruse made it appear as though the retailer had received a returned item when, in fact, no return had taken place. By obscuring the true origin and identity behind the return, Noir’s Organization could claim they had returned a product for a refund while keeping the item.

#4 They Recruited Insiders To Facilitate Return Fraud

The group knew that recruiting insiders at retailers was a surefire way to ensure the success of their schemes. So, they recruited insiders at major retailers to help them perpetrate the scheme.

#5 They Engaged In Double Dipping To Get Two For The Price Of One

“Double dipping” was another fraudulent tactic allegedly used by Noir’s Organization to maximize their illicit gains from retailers. The scheme worked like this:

Noirs would purchase an item from a retailer.
They would then claim that the item was defective and request a replacement.
The retailer would ship out a replacement product.
However, Noir’s would allegedly claim that the replacement was also unsatisfactory and request yet another replacement.
If successful, Noir’s would end up with two items which they could sell for pure profit.

They Installed Malware At Retailers To Circumvent Fraud Controls

The group was advanced, even allegedly creating malware targeting retailers’ websites. That malware was designed to circumvent the retailers’ fraud controls so that the orders would go through unabated.

They Ran A Large Resale Operation And Sold Items On eBay

According to the indictment, at one point, Noir’s Organization used Google Forms and Sheets to take refund orders from customers and track their progress, allegedly processing millions of dollars worth of refund claims.

Products obtained through fraud were allegedly sold on eBay and to wholesale resellers for profit.

$100,000 Profit In One Week With Video Proof

Brett Johnson, the godfather of the internet, provided a glimpse into Noir Refunds’ activities in 2020 when they were starting.

According to Johnson, the people at Noir and their customers were reaping huge profits while the pandemic took hold of the world.

“Customers of Noir regularly post the amounts they are profiting. ” he said, “Profits in the $2000 range seem normal. One individual claimed to have profited $100,000 in one week and posted a video of the storage locker of merchandise stolen during that week as proof.

Amazon – The Canary In The Coal Mine

Even though the FBI is cracking down on Professional Refunding fraud, the first alerts for the problem date back to 2016. At the time, Brett Johnson posted this alert on LinkedIn.

At the time, he exposed an exploit emerging on the dark web targeting Amazon. He called the article “Amazon Refunding: Meat and Potatoes for The CyberCime World”

But Johnson knew then that this would extend well beyond just Amazon. Amazon was just the canary in the coal mine in an issue that would probably hit every online retailer eventually.

“This isn’t confined to Amazon. The Microsoft Store can easily be hit for anything under $3500. Apple can be hit for $2000 with no problems. And it isn’t just electronics. A ready list of stores includes Nike, Footlocker, Zappos, Armani, Gucci, Rolex (to $4000), any car parts store, and many, many more. In fact, for any specific item you can order online and have it shipped to you, there is a way to refund it.“

It wasn’t until the pandemic hit in 2020 that all hell broke loose with professional refunding. At that time, it started to gain more attention within the senior ranks of retailers.

The FBI’s Operation Chargeback Crackdown Is In Full Effect

This case was brought as part of Operation Chargeback, an FBI investigation into organized refund fraud groups across the United States and internationally. So far, four major Telegram groups, including Simple Refunds, Rekk Refunds, Artemis Refunds, and Noir Luxury refunds, have been taken down.

Assistance was provided by Target, Amazon, Wal-Mart, Wayfair, Dell, Dick’s Sporting Goods, American Airlines, Hewlett Packard, Adidas, eBay and Google’s CyberCrime Investigation Group.

So, which professional refunding fraud group is next? Expect more announcements in the coming months as these criminals get in hot water.