Police say click-to-pay fraud fuels organized retail crime

when a man wearing a black Air Jordan T-shirt walked up to a self-checkout kiosk in Louisiana Louie Last spring, he looked like any other agent.

Over the course of about seven minutes, he methodically delivered various gift cards worth $95 each, using his phone to pay for each card while a red-jacketed assistant hovered nearby, surveillance video showed.

Police say the man, unbeknownst to the employee, was part of a sprawling Chinese crime ring, using stolen credit cards to buy gift cards, while a Southeast Asian fraud complex coached him through each transaction through wireless headphones in his ears.

“We know there are hundreds of individuals doing this at any one time across the country,” said Adam Parks, assistant special agent in charge of Homeland Security Investigations, who investigated the case. “Even though you think each transaction is $95, that adds up to a lot of money.”

After the man left the hardware store, he purchased more gift cards containing the stolen credit card information from other retailers only to return to the original Lowe’s store the same day to repeat the act, Parks said. He added that he has not been arrested and remains a suspect. Lowe did not respond to repeated requests for comment from CNBC.

Although credit card theft and fraud are nothing new, with the spread of tap-to-pay and the growing use of retail apps, these digital thefts constitute the next wave of organized retail crime and earn Chinese gangs up to $1 billion a year, police said. Unlike typical retail thefts – where criminals clear shelves in supermarkets and resell merchandise piece by piece on online marketplaces – crimes can be carried out directly under the watchful eye of store staff or from a computer anywhere in the world.

“It’s a very low risk for bad actors,” said Scott Glenn, vice president of asset protection at the company. home depot. “It’s not the same thing as walking into a Home Depot, filling a cart full of electrical items, and then walking out. It’s not as visual, it’s not as obvious as what’s going on there, so it’s become more of a preferred method over the last several years.”

Fraudsters chose retailers as their targets because their platforms hold sensitive information like stored credit cards and personal data, but they don’t have the same level of security as banks, according to industry experts and law enforcement.

There is no hard data on how much retailers lose from digital forms of retail crime, but CNBC found about a dozen criminal cases across the country affecting a wide range of retailers that police said include a range of organized groups and low-level fraudsters.

Captain Matt Lawson of the Knox County Sheriff’s Office in Tennessee said the cases are complex and often difficult for local authorities to handle. He said he was investigating a fraud ring with ties to Chinese organized crime.

Unless the theft reaches a certain dollar threshold or rises to the level of a federal crime, “it’s kind of like they’re almost getting away with it,” he said.

Click-to-pay fraud, which involves a fraudster adding a stolen credit card to their digital wallet and using it to purchase gift cards or merchandise, It often starts with a familiar text message and can end with an unwitting consumer’s identity for sale on platforms like Telegram.

Scammers send mass text messages warning of unpaid fees, expired car registrations, or pending arrests designed to scare consumers into giving up their credit card information, email credentials, or other sensitive data. Experts said artificial intelligence has made schemes easier, as crime groups can scale scams more quickly and make messages appear more legitimate.

“Once a fraudster has a person’s email and credit card password, they can load that credit card into a device they control.” said Jeff Otto, Chief Marketing Officer riskya technology company that works with retailers including Foot Locker, Peloton, and BJ’s Wholesale Club to fight fraud.

“when The bank reaches out to say, “Hey, are you loading the card?” “They have already gained access to the victim’s email” and can often verify the one-time passcode before the consumer notices, he said.

Low-level opportunists involved in click-to-pay schemes can operate independently, using the practice to either purchase merchandise or purchase gift cards and resell them at a discount for cash.

But at the level of organized crime in China, this practice involves an entire criminal network, Parks said. In order to repatriate profits to China, criminal groups use click-to-pay fraud to purchase gift cards and then use those gift cards to purchase high-value items that can be resold at a higher price in China, such as iPhones with U.S. settings, Parks said. This practice allows gangs to circumvent strict banking laws in both the United States and China and funnel larger amounts of cash into the legitimate economy.

At the heart of the strategy are foot soldiers like the customer at Lowe’s who police say helped carry out the scam, which has escalated in the years since the Covid-19 pandemic along with a surge in Chinese nationals at U.S. land crossings, Parks said.

People looking to enter the country illegally often rely on smugglers and organized crime networks, and then incur a debt that crime groups demand they repay once they arrive in the United States.

“So [they’re] “I’m going to instruct you on how to walk into a store, turn in your stolen credit card information to get merchandise, and then you’re now going to ship those merchandise back to China,” Parks said. “This is where we get arrested most often, but this is the lowest level in the organization.”

Click-to-pay schemes can also include retail app fraud, which involves stealing someone’s credentials, logging into their account and using stored credit card information to purchase merchandise or gift cards.

Riskified’s Otto showed CNBC how data breaches, phishing and social engineering, which involves collecting publicly available information about someone to steal their identity, can give fraudsters access to a consumer’s retail account.

CNBC saw that the login credentials for WalmartThe Telegram app and website were sold on various Telegram channels for between $1.50 and $2.50 with information about how long the accounts have been active.

“They have 10-year-old Yahoo addresses and 10-year-old Gmail messages,” Otto said. “These are old accounts that often pass some of the more rudimentary fraud checks [because] We tend to trust accounts that have been with us for a long time. In this case, it can be sold.”

Telegram did not return a request for comment.

Further complicating the issue is the fact that many retail apps and websites don’t always have the same level of security as platforms like banking apps, Otto said. On the face of it, retail apps seem to be about shopping, places for consumers to buy clothes, household essentials, or makeup.

But they also contain stored credit cards, sensitive personal information, and, sometimes, access to the consumer’s store-branded credit card. For example, Messi Customers can shop via its app and use the same platform to pay their Macy’s credit card bill.

“It has a lot to do with the fact that they’re focused on convenience and they’re focused on conversion, generating as much revenue online as possible, and because of that, they’re not using bank-level security,” Otto said of the retail sector. “They don’t want to add additional friction.”

In a statement to CNBC, Walmart said “customer privacy and safety is a top priority.”

“While we will not disclose specific security measures, Walmart has systems in place to help detect bad actors and prevent and respond to unauthorized account access, and is constantly working to strengthen these protections,” the company said. “In addition, complete payment card information is not stored in an unprotected form.”

In a review of click-to-pay cases across the country, CNBC found a mix of low-level opportunists and organized crime gangs.

In January, Duncliffe Labadie was arrested in Miami and accused of stealing approximately $95,000 primarily using TJX store-brand credit cards for TJ Maxx, Marshall’s and Home Goods, according to a police report. Police allege he gained access to about 15 different customer accounts through the call Synchronization bankThe card issuer and adding a phone number controlled by him to the accounts. It is not clear what customer information Labady must provide to Synchrony to make account changes.

Once his number was added to the accounts, he was able to add the cards to his digital wallet and make dozens of transactions at TJX stores across the Miami area during the holiday shopping season without having a physical card, police said. He was arrested after TJX’s asset protection team reported the suspicious activity to Synchrony Bank.

Labdi has pleaded not guilty, and his lawyer declined to comment. A Synchrony spokesperson said it does not comment on ongoing investigations and is “fully cooperating with law enforcement.”

In a statement, a TJX spokesperson said: “Protecting our customers’ personal information and our technology systems is very important to us.”

“We have procedures in place across our systems and stores designed to identify and address potentially fraudulent account activity,” the spokesperson said. “We would also encourage our customers to maintain strong online account security practices, including not reusing passwords across websites or apps, and reporting any suspected fraudulent activity to their bank or credit card company immediately.”

There have been broader efforts to crack down on fraud schemes as well.

Since the spring of 2025, the Knox County Sheriff’s Office has arrested more than a dozen suspects with alleged ties to Chinese organized crime, who officials said were traveling the country and using stolen credit card information to purchase gift cards and launder money.

In a review of cellphones seized in connection with the cases, investigators found that the suspects were using private apps that contained stolen credit card information but disguised it as games to avoid detection.

Lawson, who was investigating the fraud ring, said: “They look like anime games. They’re a bit like Pokemon characters.” “We would just start clicking on them…and we would find apps that were actual tap-to-pay apps.”

Nationally, Homeland Security Investigations’ Project Red Hook targets gift card fraud and other forms of digital retail crime. This has so far led to at least 239 arrests since January 2024, and targets some of the largest Chinese organized crime groups operating in the United States, HSI said.

For several years, the retail industry and law enforcement organizations have lobbied Congress to pass the Organized Retail Crime Control Act, which they say will increase information sharing and make these types of complex cases easier to address. It passed the House of Representatives in May, and was recently included as part of an amendment to the National Defense Authorization Act in the Senate. It is expected to be voted on before the end of the year.

Lawson said he would like to see better information sharing.

“Law enforcement sometimes likes to keep information and not share everything and kind of compartmentalize it…even retailers are guilty of that.”

“The more information we get when we notice these people violating these laws, the easier it will be to catch them,” he added.

-Additional reporting by Paige Tortorelli