https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-triangle-of-e-commerce-fraud/ Advertisement [17] Advertisement [22] Krebs on Security Skip to content * Home * About the Author * Advertising/Speaking Canadian Man Stuck in Triangle of E-Commerce Fraud January 19, 2024 11 Comments A Canadian man who says he's been falsely charged with orchestrating a complex e-commerce scam is seeking to clear his name. His case appears to involve "triangulation fraud," which occurs when a consumer purchases something online -- from a seller on Amazon or eBay , for example -- but the seller doesn't actually own the item for sale. Instead, the seller purchases the item from an online retailer using stolen payment card data. In this scam, the unwitting buyer pays the scammer and receives what they ordered, and very often the only party left to dispute the transaction is the owner of the stolen payment card. [triangulationfraud] Triangulation fraud. Image: eBay Enterprise. Timothy Barker, 56, was until recently a Band Manager at Duncan's First Nation, a First Nation in northwestern Alberta, Canada. A Band Manager is responsible for overseeing the delivery of all Band programs, including community health services, education, housing, social assistance, and administration. Barker told KrebsOnSecurity that during the week of March 31, 2023 he and the director of the Band's daycare program discussed the need to purchase items for the community before the program's budget expired for the year. "There was a rush to purchase items on the Fiscal Year 2023 timeline as the year ended on March 31," Barker recalled. Barker said he bought seven "Step2 All Around Playtime Patio with Canopy" sets from a seller on Amazon.ca, using his payment card on file to pay nearly $2,000 for the items. On the morning of April 7, Barker awoke to a series of nasty messages and voice calls on Facebook from an Ontario woman he'd never met. She demanded to know why he'd hacked her Walmart account and used it to buy things that were being shipped to his residence. Barker shared a follow-up message from the woman, who later apologized for losing her temper. [tri-fbmsg] One of several messages from the Ontario woman whose Walmart account was used to purchase the goods that Barker ordered from Amazon. "If this is not the person who did this to me, I'm sorry, I'm pissed," the lady from Ontario said. "This order is being delivered April 14th to the address above. If not you, then someone who has the same name. Now I feel foolish." On April 12, 2023, before the Amazon purchases had even arrived at his home, Barker received a call from an investigator with the Royal Canadian Mounted Police (RCMP), who said Barker urgently needed to come down to the local RCMP office for an interview related to "an investigation." Barker said the officer wouldn't elaborate at the time on the nature of the investigation, and that he told the officer he was in Halifax for several days but could meet after his return home. According to Barker, the investigator visited his home anyway the following day and began questioning his wife, asking about his whereabouts, his work, and when he might return home. On April 14, six boxes arrived to partially fulfill his Amazon order; another box was delayed, and the Amazon.ca seller he'd purchased from said the remaining box was expected to ship the following week. Barker said he was confused because all six boxes came from Walmart instead of Amazon, and the shipping labels had his name and address on them but carried a contact phone number in Mexico. Three days later, the investigator called again, demanding he submit to an interview. "He then asked where my wife was and what her name is," Barker said. "He wanted to know her itinerary for the day. I am now alarmed and frightened -- this doesn't feel right." Barker said he inquired with a local attorney about a consultation, but that the RCMP investigator showed up at his house before he could speak to the lawyer. The investigator began taking pictures of the boxes from his Amazon order. "The [investigator] derisively asked why would anyone order so many play sets?" Barker said. "I started to give the very logical answer that we are helping families improve their children's home life and learning for toddlers when he cut me off and gave the little speech about giving a statement after my arrest. He finally told me that he believes that I used someone's credit card in Ontario to purchase the Walmart products." Eager to clear his name, Barker said he shared with the police copies of his credit card bills and purchase history at Amazon. But on April 21, the investigator called again to say he was coming to arrest Barker for theft. "He said that if I was home at five o'clock then he would serve the papers at the house and it would go easy and I wouldn't have to go to the station," Barker recalled. "If I wasn't home, then he would send a search team to locate me and drag me to the station. He said he would kick the door down if I didn't answer my phone. He said he had every right to break our door down." Barker said he briefly conferred with an attorney about how to handle the arrest. Later that evening, the RCMP arrived with five squad cars and six officers. "I asked if handcuffs were necessary - there is no danger of violence," Barker said. "I was going to cooperate. His response was to turn me around and cuff me. He walked me outside and stood me beside the car for a full 4 or 5 minutes in full view of all the neighbors." [barker-k-div] Barker believes he and the Ontario woman are both victims of triangulation fraud, and that someone likely hacked the Ontario woman's Walmart account and added his name and address as a recipient. But he says he has since lost his job as a result of the arrest, and now he can't find new employment because he has a criminal record. Barker's former employer -- Duncan's First Nation -- did not respond to requests for comment. "In Canada, a criminal record is not a record of conviction, it's a record of charges and that's why I can't work now," Barker said. "Potential employers never find out what the nature of it is, they just find out that I have a criminal arrest record." Barker said that right after his arrest, the RCMP called the Ontario woman and told her they'd solved the crime and arrested the perpetrator. "They even told her my employer had put me on administrative leave," he said. "Surely, they're not allowed to do that." Contacted by KrebsOnSecurity, the woman whose Walmart account was used to fraudulently purchase the child play sets said she's not convinced this was a case of triangulation fraud. She declined to elaborate on why she believed this, other than to say the police told her Barker was a bad guy. "I don't think triangulation fraud was used in this case," she said. "My actual Walmart.ca account was hacked and an order was placed on my account, using my credit card. The only thing Mr. Barker did was to order the item to be delivered to his address in Alberta." Barker shared with this author all of the documentation he gave to the RCMP, including screenshots of his Amazon.ca account showing that the items in dispute were sold by a seller named "Adavio," and that the merchant behind this name was based in Turkey. [adavio-convo] That Adavio account belongs to a young computer engineering student and "SEO expert" based in Adana, Turkey who did not respond to requests for comment. Amazon.ca said it conducted an investigation and found that Mr. Barker never filed a complaint about the seller or transaction in question. The company noted that Adavio currently has a feedback rating of 4.5 stars out of 5. "Amazon works hard to provide customers with a great experience and it's our commitment to go above and beyond to make things right for customers," Amazon.ca said in a written statement. "If a customer has an issue with an order, they may flag to Amazon through our Customer Service page." Barker said when he went to file a complaint with Amazon last year he could no longer find the Adavio account on the website, and that the site didn't have a category for the type of complaint he wanted to file. When he first approached KrebsOnSecurity about his plight last summer, Barker said he didn't want any media attention to derail the chances of having his day in court, and confronting the RCMP investigator with evidence proving that he was being wrongfully prosecuted and maligned. But a week before his court date arrived at the end of November 2023, prosecutors announced the charges against him would be stayed, meaning they had no immediate plans to prosecute the case further but that the investigation could still be reopened at some point in the future. The RCMP declined to comment for this story, other than to confirm they had issued a stay of proceedings in the case. Barker says the stay has left him in legal limbo -- denying him the ability to clear his name, while giving the RCMP a free pass for a botched investigation. He says he has considered suing the investigating officer for defamation, but has been told by his attorney that the bar for success in such cases against the government is extremely high. "I'm a 56-year-old law-abiding citizen, and I haven't broken any laws," Barker said, wondering aloud who would be stupid enough to use someone else's credit card and have the stolen items shipped directly to their home. "Their putting a stay on the proceedings without giving any evidence or explanation allows them to cover up bad police work," he said. "It's all so stupid." Triangulation fraud is hardly a new thing. KrebsOnSecurity first wrote about it from an e-commerce vendor's perspective in 2015, but the scam predates that story by many years and is now a well-understood problem. The Canadian authorities should either let Mr. Barker have his day in court, or drop the charges altogether. This entry was posted on Friday 19th of January 2024 10:34 AM A Little Sunshine The Coming Storm Web Fraud 2.0 Adavio Amazon.ca Duncan's First Nation RCMP Royal Canadian Mounted Police Timothy Barker triangulation fraud Walmart Post navigation - E-Crime Rapper 'Punchmade Dev' Debuts Card Shop 11 thoughts on "Canadian Man Stuck in Triangle of E-Commerce Fraud" 1. John Neithercutt January 19, 2024 You don't mention it, and I'm surprised, but Mr. Barker would only have to show the receipt for his purchase showing the money came from his own credit card account and went to the Amazon vendor to dispute this criminal charge. That would shift the investigation to the user of the wal-mart account to actually order the items since Mr. Barker paid with a different source. Is there some unreported reason he isn't able to provide this? Amazon always keeps receipts and tracks your order, and banks will provide you with receipts for your purchases.....? Reply - 1. Grey January 19, 2024 He already did. "Eager to clear his name, Barker said he shared with the police copies of his credit card bills and purchase history at Amazon. But on April 21, the investigator called again to say he was coming to arrest Barker for theft." Reply - 2. Rommel Andersson January 19, 2024 "Eager to clear his name, Barker said he shared with the police copies of his credit card bills and purchase history at Amazon. But on April 21, the investigator called again to say he was coming to arrest Barker for theft." "Their putting a stay on the proceedings without giving any evidence or explanation allows them to cover up bad police work," he said. "It's all so stupid." It sounds like Barker did exactly what you've suggested and it didn't matter. They chose to arrest him despite the obvious evidence that he had paid to Amazon and somehow magically, the delivery came from Walmart instead. Reply - 2. Casey January 19, 2024 This happened to me, only on a much smaller scale. I bought an iPad on Amazon and about two months later got a call from a police department on the other side of the country. Someone had stolen a credit card from a car in Florida, went straight to Walmart and bought a bunch of devices and then sold them to someone on Amazon who turned around and sold the iPad to me. It took me quite a while to wrap my mind around what the heck the officer was telling me over the phone. Fortunately I'd kept the packaging it came in and sent pictures of everything to the police. And I had to promise not to post about it on social media until they'd closed the case. I never heard how it was resolved, but I did get to keep the iPad. Reply - 3. AJT January 19, 2024 He did show the police his credit card statement and receipt: "Eager to clear his name, Barker said he shared with the police copies of his credit card bills and purchase history at Amazon.Eager to clear his name, Barker said he shared with the police copies of his credit card bills and purchase history at Amazon." Reply - 4. RCMP January 19, 2024 " The Canadian authorities should either let Mr. Barker have his day in court, or drop the charges altogether." The crown can either drop or stay a charge and most choose to stay if they feel that more evidence later can meet the bar of a successful conviction. The crown has one year to bring the case to court again and over 90% of cases don't. He's got the best outcome here and the record is removed after 1 year. Reply - 5. teksquisite January 19, 2024 Good catch, John.- Now I'm curious about the order details too! From Amazon:!Orders > view order details > payment information. Brian, thanks for another great read! Reply - 6. John Wills January 19, 2024 As a Canadian I'm shocked that the RCMP would behave in this way and that the justice system would allow/support it! As a consumer and home cybersecurity enthusiast I wonder about a solution to this type of fraud. Should consumers only buy goods on Amazon's site that are both sold by AND shipped by Amazon? With ever increasing supply-chain complexity and fraud innovation I'm thinking the fewer 3rd-parties involved, the safer you are. This post (and previous ones on credit card theft) makes me think global supply-chain fraud in all its flavours and processes would make a fascinating book, with topics (and examples like this) on Triangulation fraud, Spear-phishing BEC , Software Library compromise, etc..... Thanks for another illuminating post, and all the work you do ! Reply - 7. Micheal January 19, 2024 I'm not surprised that the RCMP is treating someone from/working for a First Nation like this. Guilty until proven innocent is still far too common. Reply - 8. Billy Bob January 19, 2024 I agree with John Neithercutt. If you're signed into Amazon, you can see details regarding every order, whether your order has Amazon as the seller or a third party selling on Amazon. You can print out an invoice of every order. Something is off with this story... Reply - 9. David Stroy January 19, 2024 What's also been going on is Amazon gets "bin stuffed" by people shipping empty product boxes or boxes with crap in them like headphones, etc, and they mix them in the fulfillment centers with other sellers stuff, so people receive empty boxes at their house and now Amazon forces people to file a police report and then denies the validity of the police report and they come after the buyers for the payment. They are doing the same to packages that get stolen off porches by their drivers or other thieves. What's not funny about it is that the people filing police reports often have no evidence that it was a crime, so therefore are opening themselves up to filing false police reports to deal with undelivered packages. Reply - Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment * [ ] Name * [ ] Email * [ ] Website [ ] [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] Advertisement [5] Advertisement Mailing List Subscribe here Search KrebsOnSecurity Search for: [ ] [Search] Recent Posts * Canadian Man Stuck in Triangle of E-Commerce Fraud * E-Crime Rapper 'Punchmade Dev' Debuts Card Shop * Here's Some Bitcoin: Oh, and You've Been Served! * Meet Ika & Sal: The Bulletproof Hosting Duo from Hell * Happy 14th Birthday, KrebsOnSecurity! Story Categories * A Little Sunshine * All About Skimmers * Ashley Madison breach * Breadcrumbs * Data Breaches * DDoS-for-Hire * Employment Fraud * How to Break Into Security * Internet of Things (IoT) * Latest Warnings * Ne'er-Do-Well News * Other * Pharma Wars * Ransomware * Russia's War on Ukraine * Security Tools * SIM Swapping * Spam Nation * Target: Small Businesses * Tax Refund Fraud * The Coming Storm * Time to Patch * Web Fraud 2.0 Why So Many Top Hackers Hail from Russia [computered-580x389] (c) Krebs on Security - Mastodon