Key Points
- Bureau mapped 256 fraud clusters across 45,000 accounts analysed
- Around 9,000 devices linked to coordinated suspicious marketplace activity
- Only 0.95% users drove disproportionate share of anomalous behaviour
The organised fraud networks are increasingly targeting e-commerce marketplaces, with misuse of cashback offers, referral incentives, return policies and cash-on-delivery models becoming more structured and automated, according to a latest study.
The findings are based on an analysis of 70 million e-commerce users over a 10-day period conducted by online risk management firm Bureau.
According to the study, one in six risky devices was linked to more than 10 accounts, a pattern the company said could indicate device farms used to run multiple fake or coordinated accounts.
Bureau said it mapped 256 clusters comprising around 45,000 accounts operating across about 9,000 devices during the review period.
The company described device farms as an operational backbone for fraud networks, allowing multiple phones or devices to be controlled together to switch rapidly between accounts.
This infrastructure is used for promo and referral abuse through repeated creation of accounts to claim incentives, and also to identify accounts with stored payment instruments or linked wallets for potential financial fraud, it said.
The study also flagged behavioural anomalies. In one instance, an account logged in from Gujarat and Bengaluru within 30 minutes, while another was active across 70 locations, patterns the company said were consistent with automated activity.
“Promo abuse isn’t petty theft. It’s industrialised,” Bureau founder and CEO Ranjan Reddy said, adding that fraud operations were increasingly cross-platform in nature.
The report said such activity was concentrated in Delhi, Bengaluru and Noida, where some platforms recorded up to 15 times the typical share of users operating multiple accounts.
It also pointed to return abuse, where fraudsters allegedly order high-value goods and return counterfeit items, empty packages or reject deliveries.
According to Bureau, only 0.95 per cent of users showed anomalous behaviour, but this segment accounted for a disproportionate share of suspicious activity.
The company said its intelligence network covers more than 100 enterprises across banking, fintech, e-commerce, insurance and gaming, monitoring nearly 300 million devices daily.
