Detecting Fraud Rings

A fraud ring is a small group of accounts — usually 3–10 — operated by the same person or team using slight email variations to multiply discounts, distribute refund risk, or coordinate chargebacks. They’re harder to spot than individual abusers because each account looks moderately suspicious in isolation but the network reveals coordinated activity. This walkthrough shows how to use TrustLens’s Linked Accounts module to surface rings, investigate them, and block them as units.

---

How Rings Operate #

Common patterns:

• Welcome-discount harvesting: Each account places one order using a first-order coupon, then disappears
• Refund distribution: Each account refunds at a moderate rate, but together the ring refunds a lot of inventory
• Chargeback coordination: Accounts share methods of payment and produce coordinated dispute filings
• Block evasion: When one account is blocked, the operator falls back to another already in the ring

The connecting tissue is what TrustLens detects: a shared shipping or billing address, payment method, or phone number. A shared IP address or browser is recorded too, but only as corroboration — on its own it never links two accounts.

---

Step 1: Surface Existing Rings #

The Linked Accounts module has been running since activation. To find established rings:

1. Open TrustLens → Customers
2. Sort by Score ascending (or open the Risk and Critical segments)
3. Open the lowest-scoring profiles and check the Linked accounts panel and the linked-accounts signal (“Linked to N other account(s) …”)

The Customers list has no linked-account filter, so start from low scores: multiple linked accounts plus low trust score is the signature. On Pro, an automation rule with the condition Linked Accounts ≥ 3 can tag these customers for you (see Step 5).

---

Step 2: Investigate a Suspected Ring #

1. Click one suspected customer’s profile
2. Open the Linked Accounts panel
3. For each linked account, click through to their profile
4. Note shared characteristics:
   • Similar email patterns (john+1@, john+2@, johnny@, j.smith@)
   • Same shipping address
   • Same phone number
   • Same payment method fingerprint
   • Coordinated order timing
   • Coordinated coupon usage

A confirmed ring usually shows links via multiple identifier types — address AND phone AND payment. TrustLens never links accounts on a shared IP or browser alone.

---

Step 3: Confirm It’s a Ring (Not a Household) #

Households produce similar signal patterns but are legitimate. Distinguishing:

Signal	Ring	Household
Email patterns	Slight variations (typos, +numbers)	Distinct names
Coupon usage	Each used new-customer coupon	Maybe one used welcome code; others didn’t
Order timing	Often coordinated bursts	Independent timing
Order content	Similar items repeated	Different items per person
Refund behavior	Each refunds at moderate rate	Mixed — some refund, some don’t
Phone numbers	Same number across all	Usually distinct numbers

When in doubt, ring vs household is usually obvious from email patterns alone. If you see [email protected] and [email protected] sharing an address, that’s almost certainly a household. If you see [email protected] and [email protected], it’s almost certainly a ring.

---

Step 4: Take Action on the Ring #

For a confirmed ring:

1. Open the Customers list
2. Use the bulk-select feature to select every confirmed ring member
3. Bulk Action: Block (blocked customers are stopped at checkout while Enable Blocking is on in Settings → General)
4. Add admin notes to each documenting the ring members
5. If on Pro, generate Dispute Evidence Reports for any existing or future disputes

Blocking the entire ring as a unit prevents the operator from falling back to another known account.

---

Step 5: Automate Ring Detection (Pro) #

Build an automation rule that fires when a new linked-account detection meets ring criteria:

• Trigger: Linked Accounts Detected
• Conditions: Linked Accounts >= 3 (add Trust Score < 50 to focus on rings that include high-risk or blocked accounts, which lower the score)
• Action: Add Tag “fraud_ring_candidate”

Each rule has one action, so add a second rule with the same trigger and conditions for the alert — Send Email Notification, or Send Webhook to a relay that posts to Slack. The tag lets you batch-review ring candidates without immediately blocking — sometimes manual confirmation is the right next step.

---

Step 6: Handle Block Evasion #

After blocking a ring, the operator may create new accounts. TrustLens catches this when:

• The new account shares an address, phone number, or payment method with the blocked accounts (auto-detected by the Linked Accounts module)
• The new account checks out from a device that was caught card testing (the Card-Testing signal, while those events are retained)
• The new account tries a new-customer coupon while linked to existing ring members — with the Pro linked-account coupon block on, the coupon is refused

The linked-accounts signal applies from the first order, before the minimum-orders threshold. With the default Link penalty of 5, it subtracts 5, 10, or 15 points for 1, 3, or 5+ linked accounts, plus 5 per linked account in Risk or Critical and 10 per blocked linked account — so a new account tied to several blocked ring members starts with a low score. On Pro, a rule on the Segment Changed trigger with a Trust Score condition and the Block Customer action can block such accounts automatically.

---

Step 7: Build a Ring Audit Routine #

Monthly:

1. Open the Customers list and review new Risk and Critical customers (on Pro, also the customers your ring rule tagged)
2. Check each one’s Linked accounts panel — TrustLens doesn’t count rings on the Dashboard
3. Drill into new rings since last review
4. Confirm or dismiss each
5. Block confirmed rings; allowlist households

---

Step 8: Use the Dispute Evidence Report #

If a blocked ring member files a chargeback later, the Dispute Evidence Report (Pro) is decisive:

• Trust score and signals show the behavioral pattern
• Linked Accounts section shows the ring
• Event timeline shows the coordinated activity

Submit this with your dispute response. Adjudicators are increasingly receptive to behavioral-pattern evidence, especially for friendly-fraud claims.

---

What to Expect #

• First-month surfacing: 1–5 confirmed rings on a typical store, more on stores with heavy coupon promotion
• Ongoing detection of 1–3 new rings per month
• Some false positives initially (households mistaken for rings) — allowlist as discovered
• Block-evasion attempts in the first few weeks after blocking

---

Metrics to Track #

• Confirmed fraud rings per month
• Ring member count distribution
• Time between ring detection and first block
• Block-evasion attempts caught (Card-Testing or Linked Accounts re-detection)

---

Common Pitfalls #

• Confusing households with rings: Use the table above to distinguish before blocking
• Single-link false positives: A customer linked to only one other isn’t necessarily a ring — usually a household sharing an address or phone
• IP overlap: Mobile carrier NAT and office networks make shared IPs common between unrelated shoppers. TrustLens never links accounts on a shared IP or browser alone; when the Linked accounts panel shows IP or device alongside an address or phone match, treat it as corroboration, not proof.
• Acting too fast: Investigate before bulk-blocking. A wrongly-blocked household is more expensive than a one-week-delayed ring block.