Reshipping scams: How they work and how to stop them in 2026

What are reshipping scams?

The pitch to the mule is a work-from-home job: receive deliveries, repackage them, forward them to another address, get paid per parcel.

The parcels were bought with stolen credit cards.

The fraudster never touches the order. The mule's real name and home address go on the shipment, the goods leave the country through the mule, and the person who used the stolen card stays invisible.

Reshipping scams are estimated to cost around $1.8 billion a year.

How reshipping scams work

• Step 1: get a stolen card. Card details come from breaches, phishing or dark web shops.
• Step 2: post the job ad. A work-from-home listing for a "package handler" or "shipping coordinator" recruits the mule, who has no idea what the job is.
• Step 3: place a high-value order. The fraudster buys from an online store with the stolen card and ships to the mule's real home address, so the order looks ordinary.
• Step 4: the parcel arrives. The address is residential, belongs to a real person, and passes most fraud checks.
• Step 5: the mule forwards it. On instruction, the mule reships the parcel, usually overseas, to the fraudster or their network.
• Step 6: the goods are resold on eBay, Facebook or local marketplaces, turning stolen goods into cash.
• Step 7: the cardholder disputes the charge with their bank, triggering a chargeback against the merchant.

By the time the chargeback lands, the product is gone. The merchant loses the goods and the payment, pays the chargeback fee, and takes a hit to its dispute ratio with the processor. The fraudster is nowhere in the records.

Red flags for businesses and job seekers

A reshipping scam has two victims: the merchant whose goods were bought with the stolen card, and the mule hired to forward them. Each sees different warning signs.

On the merchant side:

Order and customer behavior

One phone bought now and again is normal. A new account ordering five is not. Watch for:

• A first-time customer placing a high-value order: phones, electronics, bulk quantities.
• Several orders in a short window from the same account or IP.
• Baskets made up only of expensive, easy-to-resell items.

Address and shipping signals

A billing address that does not match the shipping address is one of the oldest signals in ecommerce fraud prevention, and reshipping is the reason it still matters. Look for:

• Billing and shipping addresses that do not match.
• A shipping address that is new or rarely used.
• The same shipping address across many customer accounts.
• Delivery to freight forwarders, warehouses or short-term addresses.

Payment red flags

Stolen cards get declined, so the fraudster tries several before one works. Watch for:

• An international card with a local shipping address.
• Several failed payment attempts before a success.

Behavioural and technical signals

Behavioral fraud detection looks at how the buyer acts rather than what they type:

• Location mismatch. The session comes from one country and the delivery address is in another.
• Hidden identity. VPNs or similar tools that mask the real location or device.
• Repeated small changes. A run of orders that differ only in the card number, which is card testing.

On the job seeker side:

• Personal information is requested over the phone before any offer.
• The "employer" wants to run a credit check before hiring.
• The job or the company is hard to find online.
• A search turns up scam reports or negative reviews.
• The same ad appears under different company names or locations.
• The company has no proper website or contact details.

Prevention checklist for merchants

The red flags above are only useful if someone checks for them on every order. Turn them into rules that run before fulfilment, so a suspicious order is held before the parcel leaves the building.

The checklist below is the starting point for that rule set:

Top tools to block reshipping fraud

The checklist tells you what to look for by hand. The tools below run the same checks on every order, which no review team can do at volume.

Each was picked because it works on the signals above, not just the card.

1. Sensfrx

Best for: ecommerce, healthcare, travel and crypto businesses

Scores every signup, login and payment in real time from device, network and behaviour signals, and your rules turn the score into allow, review or block.

• Real-time risk scoring for bots, fake accounts and payment fraud
• Device fingerprinting, IP and email checks, and geo-location change detection
• Up to 150 custom risk rules with blocklist and allowlist management
• Covers signup through checkout
• Review queue for the orders your rules flag
• Free plan and a 14-day trial

2. SEON

Best for: mid-market merchants that want modular, API-first detection

Enriches email, phone, IP and device data with dozens of external signals to catch fraud before checkout.

• Digital footprint analysis across social, device and IP
• Configurable rules engine with transparent risk scoring
• Tunable to keep false positives low

3. NoFraud

Best for: Shopify merchants that want fraud management fully automated

Blocks mule-linked orders before authorization even when the address and billing details look clean.

• Real-time pass/fail decisions with no merchant input
• Live cardholder verification on high-risk orders
• 100% chargeback guarantee on covered orders

4. FraudLabs pro

Best for: small merchants that need low-cost, customizable screening

Validates orders against a fraud database, checks for proxy and VPN use, and returns an approve, review or reject recommendation.

• 20+ ready-made plugins for the major ecommerce platforms
• Custom rules alongside automated risk scoring
• SMS/OTP verification add-on for high-risk transactions

5. Signifyd

Best for: growing merchants that want a financial chargeback guarantee

Applies machine learning to order data in real time to approve more orders without raising fraud losses.

• 100% financial liability shift on approved orders
• Identity network of 1.2B+ buyer profiles
• Models that retrain on every order

Protecting customers and employees (checklist)

The checklist below cuts the chance that your brand or your staff end up inside a reshipping operation. Pair it with real-time scoring on orders; awareness alone does not stop a mule-addressed order.

What if you're a victim? Reporting and recovery

For merchants

• Secure your accounts first. Reset admin, payment gateway and platform credentials, revoke unknown API keys and third-party access, and enable MFA everywhere.
• Document everything. Keep order records, shipping confirmations, IP logs and every message from the buyer. Delete nothing; this is your evidence.
• Dispute the chargebacks. Contact your processor or acquiring bank at once and submit order details, IP data and delivery confirmation inside the dispute window, usually 7 to 30 days.
• File with IC3. Submit a complaint to the FBI's Internet Crime Complaint Center at ic3.gov with order IDs, amounts, shipping addresses and any account or email data tied to the fraud.
• Report to the FTC at ReportFraud.ftc.gov, including any fake job ads that used your brand name. The FTC uses merchant reports to map wider patterns.
• Contact your cybercrime unit. File with local police and ask for escalation to the cyber or economic crime unit. For cross-border fraud, also notify your national authority (CISA in the US, Action Fraud in the UK, CERT-In in India).
• Notify the carrier. Tell UPS, FedEx, USPS or whoever you ship with about the fraudulent shipments and ask for interception or return; most carriers have fraud teams.
• Warn your customers. If your brand was used in fake recruitment or customer data was exposed, say so by email. It protects your reputation and helps victims recognize the scam.
• Review and harden. Find the gap the fraudster used, then update risk scores, blocklists and velocity rules. If losses were large, get an outside fraud audit.

What this means for your checkout

Reshipping fraud can hit any merchant without warning. Six points to hold onto:

• It is a direct revenue risk: chargebacks, lost stock and fees, order after order.
• A legitimate-looking order is not a safe order. A real address and valid card details prove nothing when a mule is in the middle.
• The shipping address is not the customer's identity once reshippers are involved.
• IP rules, basic velocity checks or OTP on their own miss fraud that is built to look normal.
• Late detection is a guaranteed loss. Once the goods ship, recovery is rare, so prevention has to run before fulfilment.
• No single layer is enough. Device fingerprinting, address intelligence, behavioral analysis and real-time risk scoring together close the gaps each leaves on its own.

No single check, rule or tool stops reshipping fraud alone. The merchants who avoid the loss layer the signals, so that when one looks clean the others still tell the truth. The red flags and checklist above are the starting point; at any real order volume, the checks have to be automated.

Sensfrx runs those checks on every order before it is fulfilled: device, behaviour, location and transaction signals scored together in real time, with your rules deciding what is allowed, reviewed or blocked. Try the free plan and see what your current orders score.

Frequently asked questions