What is Social Engineering? 

Social Engineering can be defined as manipulating the social aspect of situations. Social Engineers often like to call themselves human hackers. When breaking down the term ‘human hacking’ it is important to start with the latter. ‘Hacking’ is typically achieved through the manipulation of technology and machinery, whereas Human hackers complete the same process, except the human input is manipulated rather than the machine. 

Social Engineering can be split into four main sectors:

• Baiting
• Scareware
• Phishing
• Spare Phishing

However, there is another much less common type of Social Engineering attack: Social Engineering in Organized Retail Crime. 

All of the information in this report has been gathered from different secret online communities. When dealing with the latest criminal activities and scams it is important to study and assess them as quickly as possible. 

As this phenomenon progresses more information will be released. Right now, this report details social engineering code word terminology and the methods of retail social engineering.

Retail Social Engineering Terminology

"SEing"

• Definition: Social Engineering 
• Context: How long have you been SEing for? 

"SE'd" 

• Definition: Social Engineered 
• Context: I SE'd the same shop over 30 times on the same account. 

"SE'er" 

• Definition: Social Engineerer 
• Context: The SE'er tried scamming me. 

"SE’s" 

• Definition: Social Engineers 
• Context: You need to plan the SE before going ahead. 

"Se'able" 

• Definition: Social Engineerable 
• Context: The guy at the shop was se'able so I grabbed his password. 

"DNA" 

• Definition: Did Not Arrive 
• Context: I'm going to DNA that dress tomorrow. 

"DNA'd" 

• Definition: Did Not Arrived 
• Context: The refunder DNA'd the shoes for me. 

"Double Dip" 

• Definition: Double Dip can be defined as when Social Engineering the same company twice in row - with the Intention of getting two items free of charge. The term is used as "double dipping" and sometimes "double dip". 
• Context: You should not double dip that item the company is too advanced for that.

"Triple Dip"

• Definition: Triple Dip is much like double dip, except the SE’r receives 3 items absolutely free. This method is also written as "triple dipping" or "triple dip". 
• Context: Only extremely experienced SE'ers should be triple dipping. 

"Drop House" 

• Definition: A drop house is basically a house that does not belong to the social engineer and is used as a delivery point for the SE’r to then pick up the package. This is also known as a "Drop Address" or simply "Drop". 
• Context: How do I find a safe drop house? 

"POP" 

• Definition: POP is short for "Proof Of Purchase". 
• Context: Can someone help me Photoshop a fake POP? 

"AR" 

• Definition: AR is an abbreviation of "Advanced Replacement". This means that a company will send the Item BEFORE the defective product is returned to them. 
• Context: The company confirmed that they will send an AR. 

"POD" 

• Definition: POD is short for "Proof Of Destruction". This essentially means proof that the product is broken. 
• Context: I found a great image for the proof of destruction. 

"RMA" 

• Definition: RMA is short for "Return Merchandise Authorization". An "RMA" is issued by a company to approve a refund or replacement of an item. 
• Context: I got a letter with the RMA number. 

"C&D" 

• Definition: "C&D" stands for "Cease and Desist". This is typically a letter issued by a company to the SE'er asking them to stop Social Engineering. This means the company is aware of the SE'ers actions and if the behavior continues, they will start legal proceedings. 
• Context: I don’t know why I received a C&D letter?

"SN" 

• Definition: SN is short for Serial Number. Sometimes it is also just referred to as "Serial". 
• Context: A great technique is to get the SN from someone online selling that product. 

"Tracking Number" 

• Definition: A tracking number is defined as a number given when a product is shipped. The term "Tracking Number" is never abbreviated. 
• Context: You might need to show the tracking number to PayPal. 

"Reship" 

• Definition: "Reship" or "Reshipping" is when a company is used as the sending address rather than their personal address. The company will then reship the item to the SE’rs personal address. 
• Context: I need a reshipping company in the UK. 

"Receipt Generator" 

• Definition: A receipt Generator is used to falsify paperwork. 
• Context: Anyone have a receipt generator for this company? 

"Investigation" 

• Definition: Investigations are often opened to check whether there are any inconsistencies with what the social engineer has provided to the company. 
• Context: An Investigation is a very normal part of shop protocol. 

"Police Report" 

• Definition: It is uncommon but a company could also ask the SE'er to fill out a "Police Report" to help with their inquiry. 
• Context: You can fill a police report out online. 

"Cross Shipping" 

• Definition: Cross shipping is when a company ships a package containing the replacement item at the same time the customer (SE'er) sends their package containing the defective item. 
• Context: I'm going to box Amazon with the cross shipping. 

"VCC" 

• Definition: A "VCC" is an abbreviation of "Virtual Credit Card". This is essentially a disposable card. 
• Context: It is important to use a VCC.

"Human Hacking" 

• Definition: Human hacking is when you exploit the human and not the device. The terms "Human Hacking" and "Social Engineering" are interchangeable. 
• Context: That book on human hacking is brilliant! 

"Human Firewall" 

• Definition: A Human firewall is a protective system humans have. It is essentially the decision someone makes to not share their details. 
• Context: I can exploit anyone's human firewall. 

"Image Metadata" 

• Definition: Image Metadata is the data behind images. It is important for SE’rs to delete metadata before sending any forged documents to the company. 
• Context: Always remove metadata before sending any images. 

"MM" Service 

• Definition:" MM" service is an abbreviation of "Middle Man" service and is often used in forums/message boards for purchases made within the confines of the same community. The "MM" is a trusted user who acts for the buyer and the seller, by holding the funds, ensuring the buyer gets the product, and the seller gets their money. 
• Context: My friend can be your MM. 

"FTID" 

• Definition: Is short for "Fake Tracking ID", but is almost always used as "FTID". 
• Context: Won't they check the weight with the FTID? 

"EB" 

• Definition: "EB" is an abbreviation of "Empty Box", which is not different from the "missing item method" 
• Context: 50 grams Is fine for the EB method. 

"Sealed Box" 

• Definition: The objective is to replace the SE'd item (with an old item you have lying around the house), In the box without showing any signs of tampering whatsoever. As a result, the company will think that you've sent the original one back and issue a refund. 
• Context: Any item can be used with the sealed box method.

"Statutory Declaration" 

• Definition: Is a written statement that declares that everything stated is true and correct. It is signed in the presence of an authorized witness such as a police officer or medical practitioner.
• Context: Don't fake a statutory declaration! 

"Affidavit" 

• Definition: Once an affidavit is signed, it becomes a legally binding document and can be used as evidence in court. 
• Context: I recommend not signing the affidavit. 

"PayPal Dispute" 

• Definition: Not everything goes according to plan with every SE and when a company refuses to refund an item, the SE'er will open a "PayPal Dispute", where the buyer & seller will try and come to an agreement. 
• Context: Contact PayPal's Resolution Center for the dispute.

"PayPal Claim" 

• Definition: After the social engineer has opened a PayPal Dispute and failed to reach an agreement with the seller, it then gets escalated to a "PayPal Claim". This is when PayPal steps in by reviewing the case and ultimately decide the outcome in an impartial and unbiased manner. PayPal Claims have a 20-day time frame from when the Dispute was deemed inconclusive. 
• Context: Why Is PayPal taking so long with the Claim? 

"Chargeback" 

• Definition: If a PayPal Claim is unsuccessful, the SE'er is still able to get a refund from their credit card provider. This is done by performing a ‘chargeback’. 
• Context: A Chargeback should only be used as a backup plan.

"SNAD" 

• Definition: "SNAD" is an abbreviation of (Significantly Not as Described). This basically means that the item received from the company was not as shown or described online. 
• Context: Use SNAD for almost any item you plan to SE. 

"PayPal 'INR'" 

• Definition: "INR" is an abbreviation of (Item Not Received). This can be defined as advising PayPal that an item was not received in order to get a refund. 
• Context: The PayPal INR method can be used on any company. 

"CSR" 

• Definition: CSR" is an abbreviation for "Customer Service Representative". 
• Context: The CSR said he'll get back to me soon. 

"PEB" 

• Definition: PEB is an abbreviation of "Partial Empty Box". Another similar term is "EB" which is an abbreviation of "Empty Box". 
• Context: How many Items are you planning to PEB? 

"Service Tag" 

• Definition: A Service Tag is also referred to as a "serial number". However it is more common with laptops and electronics. 
• Context: I got the service tag from another SE'er. 

"TID"  

• Definition: TID is an abbreviation of "Tracking ID" 
• Context: It is normal for packages to have a TID. 

"LIT"

• Definition: LIT is defined as "Lost in Transit". 
• Context: Can you use the LIT method with any order?

Social Engineering Techniques

Reship Method 

The Reship Method also known as the ‘Reshipping Method’ is used by Social Engineers to disguise their personal address. Once the SE’r purchases a product, then they will provide the details of a shipping warehouse rather than their own personal address. This is done to stop the company from having their personal address. The SE’r will organise with a shipping company to accept the item and then reship the item to their personal address. This essentially creates an added layer of identity protection. 

1. Order product
2. Provide the address of a shipping warehouse 
3. Provide shipping warehouse with personal address 
4. Receive product

The Partial Method 

The Partial Method is a technique used when purchasing multiple items in one transaction. The SE’r will claim that one of the items is missing from the shipment. It is extremely important that the item missing is light enough to go unnoticed by the shipping company.

1. Order products 
2. Call/Email company claiming not all of the product was received 
3. If the company requires proof, call the company and ask if they noticed a difference between received product and product in shipment 
4. Receive product

The Serial Number Method 

The Serial number method is a technique in which the SE’r will purchase a product, write down the serial number and then return it. The SE’r will then contact another company that stocks the same product and state that their product is faulty using the Serial Number as proof of purchase.

1. Order product from a company that sells the desired product 
2. Once the product is received, write down the serial number and return the product 
3. Call the targeted company and explain that the product they received is broken. Provide the serial number as proof of purchase 
4. Receive a refund from the targeted company

The Wrong Item Received Method 

The wrong Item Received Method is when a SEr claims that a company sent them an item different to the one they ordered. The company will then process a refund/replacement. The SE’r will then send back a random item to the company of similar weight 

1. Order a product from targeted company 
2. Once the product is received, state that the company sent them the wrong product 
3. Receive either a refund or another product from the targeted company

The Disposed of the Faulty Item Method 

The Disposed of the Faulty Item Method is when you state that you ‘disposed of the item’ when the company asks for you to send it back. This method is used to keep an item as well as receiving another by stating they had to throw the product out due to health & safety concerns. 

1. Order a product from targeted company 
2. Once the product is received, state that the product was damaged when it arrived and is unable to be returned due to health and safety reasons eg: State the product has exploded etc.
3. If photo evidence is needed this can be done in photoshop. 
4. Receive a refund or another product

The Corrupted Video Method 

The Corrupted Video Method occurs when a company asks for proof that a product is broken. The SE’r will then provide a video that has been corrupted. To achieve this, they will use a random short video and then use a program to corrupt the video. This is done to appear like they are complying with the company’s requests and that the corruption is purely an issue on the company's side. 

1. Order a product from targeted company 
2. Once the product is received, contact company stating the product is faulty and provide a corrupted video as proof 
3. Receive either a refund or another product from the targeted company

The Gift Method 

This method is used when a company asks for POP (Proof of Purchase). The SE will then say that the item was a gift from a friend. This method is used when the SE’r does not have any proof of purchase. 

1. Order a product from targeted company 
2. Once the product is received, contact company stating they received a gift from 
3. Receive either a refund or another product from the targeted company 

The Broken Glass Method 

The Broken Glass Method is most commonly used when a product is made out of glass such as perfume. The SE’r simply states that the product was broken on arrival. This means that the product must have broken while in transit.

1. Order a product from targeted company 
2. Once the product is received call the company and state that the product received was broken 
3. If evidence is needed 
4. Receive either a refund or another product from the targeted company

The Missing Item Method 

The Missing Item Method is when a SE claims that the Item they've ordered is missing on delivery and only the empty packaging was delivered. 

1. Order a product from targeted company 
2. Once item is received state that the packaging arrived but there was no product inside
3. Photograph the received package but remove the item if the company requires proof 
4. Receive either a refund or another product from the targeted company

The DNA Method 

The DNA is when a SE claims that the item they've ordered ‘Did not arrive’. 

1. Order a product from targeted company 
2. Wait a few weeks after purchase and state that a product was ordered but has not been received 
3. It is hard to prove if this occurred or not so often companies will provide a refund after a short investigation

The Boxing Method 

The box Method involves ordering a product from a company, requesting a refund and then sending an empty box back when returning the item. The SE’rs will also damage the box to look as though the product had been stolen from mid-transit. 

1. Order a product from targeted company 
2. Once the product is received call the company and state that they box received was open and the product is missing 
3. If evidence is needed photograph the box empty with a tear
4. Receive either a refund or another product from the targeted company 

The Fake Receipt Method 

Rather than purchasing a product, the SE’r will email the targeted company stating they purchased a product from that particular company and use the serial number as proof. Once the company approves of the serial number, they will ask for a receipt as proof of purchase. The SE’r will then create a fake receipt using photoshop.

1. Contact targeted company staging that the product they received is faulty
2. Provide the serial number 
3. Create a fake receipt 
4. Receive either a refund or another product from the targeted company

The Double Dip Method 

The double dip method involves SE’ring a company by using the ‘DNA’ method. Once the product is received the SE’rs will then claim that the product they received as a refund from the ‘DNA’ method is faulty. 

1. Complete a successful ‘DNA’ Method 
2. Once the replacement product is received state that the product is faulty 
3. If evidence is needed create a photo using photoshop 
4. Receive either a refund or another product from the targeted company 

The Leaking Battery Method 

The leaky battery method involves claiming the product received from the company is faulty due to the batteries leaking over the product. If evidence is needed SE’rs will often photoshop an image. Companies will typically not ask for the product to be returned due to health and safety reasons. 

1. Order a product from targeted company 
2. Once the product is received call the company and state that the batteries inside the product have leaked over product 
3. If evidence is needed create a photo using photoshop 
4. Receive either a refund or another product from the targeted company

The Blood Method 

The Blood Method is essentially stating that there is blood inside or on the purchased product which makes returning it a health and safety risk. The SE’rs rely on companies taking health and safety precautions seriously in order for this method to work. 

1. Order a product from targeted company 
2. Once the product is received state that the product has blood on it and request a refund 
3. If evidence is needed it can be created in photoshop 
4. Receive either a refund or another product from the targeted company

The Similar Item Method 

The Similar Item Method is a technique commonly used by social Engineers. The technique entails buying a product then stating the product they received is different from the one bought. They then return that ‘similar’ item and keep the one they actually received. 

1. Order a product from targeted company 
2. Once the product is received state that the product is different from what was ordered and request a refund 
3. Return an item that is similar to the one ordered 
4. Receive either a refund or another product from the targeted company