Social Engineering Fraud in Ecommerce: Examples, Red Flags and Controls

Social engineering fraud is when someone tricks your staff into handing over money, goods, or access. In ecommerce, that usually means a support agent, a finance lead, or a store admin. This guide covers each tactic, the tell, the control that stops it, and how it turns into a refund loss or a chargeback.

What is social engineering fraud?

Social engineering fraud is a scam that targets people, not systems. The attacker poses as someone your team trusts, such as a customer, a carrier, a supplier, a bank, or a coworker. Then they ask for something that looks routine.

For an online store, the request is rarely dramatic. It is a refund, a reship, an address change, a new bank account for a supplier, or a login code. Each one feels small. The loss comes from the fact that nobody checked.

The reported numbers show how often these requests work.

Sources: the FBI's 2025 Internet Crime Report (complaints filed with IC3) and the FTC imposter scam data for 2025 (consumer reports to the FTC). Both count only reported cases, so the real totals are higher.

How does social engineering hit online stores?

Social engineering hits online stores through seven common routes: refunds, delivery claims, address changes, impersonation, payout changes, fake dispute calls and staff phishing. Each one has a tell your team can learn, a control that blocks it, and a predictable way the money leaves.

Customer service social engineering for refunds and reships

Support agents want to help, and attackers use that. A common script mixes urgency with a sad story: a gift that did not arrive, a sick relative, a threat to leave a bad review. The goal is to get a refund or reship without the usual checks. In short, it is a refund scam aimed at your store.

Some of these requests come from organized professional refunding services that sell scripted claims to buyers. Others are individual refund abuse. On marketplaces the same playbook shows up as Amazon refund scams, and on wallets as PayPal refund scams. Sellers on TikTok Shop UK meet it in auto-approved returns.

The control: write refund and reship limits by order value and claim history. An agent should never need to bend a rule to resolve a ticket. If the story requires an exception, it goes to a lead.

Fake item-not-received and delivery claims

The buyer says the box never came, even though the carrier shows it delivered. Some use "porch theft" stories. Others claim the box arrived empty. Our guide on scammers claiming an order was not delivered covers the full response.

The tell: the claim lands within hours of a delivery scan, the details stay vague, or the same account has filed before. The loss path: if you refuse, the buyer may file a chargeback for merchandise not received. If you reship without checking, you pay twice.

Address changes and account access requests

A request to change the shipping address or the account email after checkout is a classic social engineering move. It often follows an account takeover, where the attacker already holds the password and needs support to finish the job.

This is also how shipping address fraud slips past checkout checks. Your fraud screen approved the original address. The new one was never scored.

The control: confirm any address or email change through the contact details already on file. If the order is still unfulfilled, rescore it before it ships. The loss path: the real cardholder files an unauthorized-transaction chargeback, and your delivery proof points to an address they never gave.

{{cta}}

Impersonating a customer or a carrier

Attackers call carriers pretending to be the buyer and reroute the package. They also call stores pretending to be the carrier, asking to "confirm" a delivery address. Fake carrier sites and texts are covered in our guide to shipping scams.

The control: never confirm order details to an inbound caller. Call back using the number in your own records or the carrier's published line.

Vendor payout changes and business email compromise

Business email compromise (BEC) targets your back office. The attacker sends an email that looks like it comes from a supplier, a 3PL, or your own CEO. It asks finance to send a payment to a new bank account, often with a deadline.

The FBI describes BEC as a scam aimed at businesses and people who work with suppliers. It uses hacked or spoofed email accounts to push unauthorized transfers. In 2025, IC3 logged 24,768 BEC complaints and $3.05 billion in losses. Businesses also reported more than $30 million in losses to BEC scams that involved AI.

The control: the FBI's BEC guidance says to verify any change in account information through a second channel. In practice, call the vendor on a number you already hold, and require a second approver for any change to payout details.

Fake bank, processor, or chargeback calls

A caller says they are from your bank or processor. They say a chargeback is coming and offer to cancel it if you refund now, pay a fee, or read back a login code.

This pattern is common. The FTC says bank impersonators drove the highest reported losses among business impersonators in 2025, and many costly schemes start with a fake security alert.

Real disputes do not work this way. They arrive in your processor dashboard with a reason code and a deadline. If you need a refresher, start with what a chargeback is and how the process runs.

The loss path: money sent to a fake caller is simply gone. If a real dispute is already filed, a refund does not cancel it. You can end up receiving a chargeback after a refund and losing twice. Legitimate pre-dispute tools, such as chargeback alerts, come through Verifi and Ethoca integrations, not cold calls.

Staff phishing for admin access

Phishing emails and texts target anyone with store admin, payment, or email access. A fake app notice or a "suspicious login" alert leads to a lookalike login page. Once inside, an attacker can change payout accounts, export customer data, or issue refunds.

The control: CISA calls phishing-resistant MFA, such as security keys and passkeys, the gold standard. It warns that SMS codes can be phished and that push prompts without number matching are open to push bombing.

On Shopify, each staff member sets up two-step authentication on their own account, and Plus stores can require a secure sign-in method for all users.

Shopify also no longer lets anyone set up SMS codes as a new two-step method.

Give staff only the permissions their role needs. Remove access the day someone leaves.

AI voice cloning and deepfake requests

Attackers now use generative AI to make these requests more convincing. The FBI's December 2024 alert on generative AI fraud says criminals clone voices from short audio clips. They also use AI to write messages without the errors that used to give scams away.

For a store, that can be a voice note from your "CEO" asking for a payout change. It can be a "customer" call that passes a voice check. Bad grammar is no longer the tell. The request is: urgent, unusual, and outside your normal channel.

The control: the FBI advises hanging up and calling back on a number you find yourself. Apply the same rule to voice and video. Never approve a payout, refund or access change on a call alone.

Which support requests need which verification check?

Match the check to the risk of the request. Most tickets need no friction. A few need a callback and a second person. This playbook is a starting point; set the order-value lines to fit your average order value.

What scripts should your team refuse?

Your team should refuse any script that pushes them to skip verification. Late address changes, new bank details and offers to cancel a chargeback top the list. The examples below are illustrative, built from common patterns, not quotes from real tickets.

What should staff do when a request feels wrong?

Staff should stop and follow one escalation path. A simple, known flow beats judgment calls made under pressure.

What should you do if a scammer already got paid?

Act the same day. Call your bank to recall any wire or ACH payment and report it to the FBI's IC3. Then lock the account or order the scammer used.

Do not count on consumer banking rules to get the money back. Regulation E error rights cover consumer accounts, not business accounts. A recall depends on speed.

Speed pays off. In 2025, IC3's Recovery Asset Team used its Financial Fraud Kill Chain on 3,900 incidents. It froze $679 million of the $1.16 billion reported, a 58% success rate. Funds move fast through other accounts, so every hour counts.

Save the ticket, emails and call notes with your IC3 report. The same records support any dispute that follows.

How do you keep evidence that helps in chargeback disputes?

Keep every record that shows who asked for what, and when. Social engineering cases often end in a dispute weeks later, and support logs are the only proof of what happened.

• The full ticket thread, with timestamps, channel, and agent name.
• Original and changed details, such as the checkout address next to the new one.
• Device and IP data from checkout, logins, and any change request.
• Verification steps: who was contacted, how, and what they confirmed.
• Carrier records: scans, GPS delivery data, photos, and package weight.
• Prior order history for the same customer, including earlier undisputed orders.

These records matter by dispute type. For Visa fraud disputes, earlier undisputed orders can support a Visa Compelling Evidence 3.0 response. You need two from 120 to 365 days ago that share two data points with the disputed order, one being IP address or device ID.

For item-not-received disputes, carrier proof plus the ticket thread shows what the buyer claimed and when.

Some cases are first-party fraud, where the real customer ordered and later lies. Others are false chargeback claims filed after a refund was denied, a common form of friendly fraud. Either way, your logs are the strongest answer.

Social engineering also overlaps with triangulation fraud, where a fake seller uses stolen cards to buy from you. For the wider set of controls, see our ecommerce fraud prevention guide.

{{cta}}

How often should you train staff on social engineering?

Train at onboarding, refresh often, and drill after every incident. The cadence below is a practical baseline, not a regulatory rule. Adjust it to staff turnover and attack volume.

When is a lighter process enough?

A lighter process is enough when the stakes are low. Use these conditions to decide how much friction to add.

• Low order values and goods that are hard to resell: simple order-number checks and refund limits may cover most risk.
• High-value, resellable goods (electronics, sneakers, luxury): use the full playbook, with address-change holds and lead approval.
• Any store that pays suppliers by wire or ACH: always use callback verification and two approvers for bank detail changes, regardless of size.
• Rising item-not-received claims or disputes: tighten refund and reship rules first, then review address changes.

Veelgestelde vragen

What is an example of social engineering fraud in ecommerce?

A common example is a caller who says they are the buyer and asks support to change the shipping address on an unfulfilled order. The agent updates it, the goods ship to the attacker, and the real cardholder later files a fraud chargeback.

What are the most common types of social engineering attacks?

The most common are phishing (email), smishing (text), vishing (phone), pretexting (a made-up story), and impersonation of a trusted person or company. Business email compromise combines several of these to redirect payments.

What is the difference between BEC and phishing?

Phishing is a broad tactic: a fake message that gets someone to click, log in, or share data. BEC is a specific scam that uses a hacked or spoofed business email to get a payment sent to the attacker. Many BEC attacks start with phishing to take over the mailbox.

What is another name for business email compromise?

Business email compromise is also called CEO fraud, invoice fraud, or vendor impersonation fraud, depending on who is being impersonated. When it reroutes a payment to a new account, it is often called payment diversion fraud.

What is the difference between funds transfer fraud and social engineering fraud?

In many crime insurance policies, funds transfer fraud covers instructions sent to your bank without your knowledge. Social engineering fraud covers an employee who is tricked into sending the money. Coverage, sublimits, and endorsements vary, so check your own policy wording.

What is social engineering fraud coverage?

It is insurance for money an employee sends after a scammer tricks them with a fake request. It is offered within crime or cyber policies, and terms, limits, and conditions vary. Keep records of your callback and approval steps, since they can matter in a claim.

Can you win a chargeback caused by social engineering?

Sometimes. You have the best chance when your logs show the real customer placed the order, received it, or confirmed the change. If your team changed the address without verification, a fraud dispute is hard to win.

How do you detect fraud calls in customer service?

Watch for urgency and refusal to verify through details on file. Requests to change contact or delivery data are a warning sign, as are callers who know some order details but not others. Call back on a known number before acting.

How do you prevent business email compromise?

Verify every bank detail change by calling the vendor on a number you already hold. Require two approvers for payout changes. Turn on phishing-resistant MFA for email and finance tools, and train finance staff to slow down on urgent payment requests.

How is AI used in social engineering fraud?

Fraudsters use generative AI to clone voices, fake videos and write error-free messages. The FBI warned about these tactics in December 2024. Verify any unusual request by calling back on a number you already hold.

Last reviewed: November 10, 2026.