Fraud as a Service Storefront: Treyshop

ATO fraud involves an adversary stealing a victim’s credentials in order to take control of that user’s account. Granted this is a rather broad category and nearly every other type of fraud listed here involves some form of ATO fraud. In this context the compromised accounts might be for a delivery app, buy now pay later (BNPL) service, rewards account, etc.

• In terms of the services Treyshop offers, cash-out products seem to assist in transferring a fraudster’s ill-gotten gains into currency they control—preferably laundering the money along the way. Cash-out might include printing stolen credit card numbers on cards and allowing ATM withdrawal.
• The purpose of one Treyshop product for a mobile sports betting app is solely for money laundering. An account for the app with a balance between $0.10 and $10 sells for $1.50.

The directions then instruct you to log in:

Change the account’s email address

1. Enable two-factor authentication (2FA) and set it up on a burner phone  
2. Add a debit card and deposit $10 – we speculate the deposit can be whatever amount the buyer wants laundered, though amounts above certain thresholds may draw the attention of anti-fraud systems 
3. Wait the 90 minutes or so it takes to withdraw via debit card. Cash-out details are somewhat sparse, and this may be because the company does not want brands to catch wind of its methods. For example, one cash-out product description states, “Not giving full method so it doesn’t get burnt, but it’s fairly self-explanatory.”

• Gift card fraud can refer to multiple schemes. One of the more well-known types these days is a scammer asking a victim to purchase gift cards for payment, but then the scammer runs away with the funds providing nothing in return. In another form, fraudsters may record the numbers from gift cards on display in a brick-and-mortar store. Once a consumer purchases and funds the gift card, the scammer will drain the balance.
• From what we can tell, the gift card fraud products on Treyshop involve compromised gift cards or gift card accounts for particular brands that the scammer can use themselves to purchase goods.

• Loyalty fraud, also known as rewards or points fraud, consists of the abuse of a brand’s loyalty programs to make use of any associated rewards themselves. Sometimes such fraud takes an internal form where a brand’s employees abuse the program because they have insider knowledge or make unauthorized use of a customer’s rewards. In some cases, a rewards member will discover a loophole in the system that they abuse.
• Treyshop products related to loyalty fraud, however, mostly involve the fraudster compromising a loyalty member’s account and using those rewards for themselves. As the Loyalty Security Association explains, “Stolen points are as good as cash if those rewards can be redeemed for hotel stays, airline tickets, or other high value items.” The LSA goes on to explain that because rewards points aren’t literally monetary, less scrutiny is applied to loyalty programs making them fertile ground for fraud.

• Mobile app fraud is essentially fraud involving the use of a mobile app on a mobile device.  For example, The Financial Brand reports that more than half of fraudulent banking transactions originated via a mobile device in 2023.
• Many Treyshop product descriptions instruct potential buyers that they need to log-in to the targeted brand’s mobile app to successfully execute their crime. This is another broad category that overlaps with others discussed in this article. For more details on specific types, see our article on mobile app fraud.

• This type of fraud involves the use of stolen payment account information or compromised payment accounts to steal money or make purchases. Almost every single product sold by Treyshop combines payments fraud with account takeover fraud. Various products include compromised credit cards, debit cards, and online payments accounts.
• One product includes stolen EBT cards, which strikes us as especially despicable. EBT stands for Electronic Benefits Transfer, which allows Supplemental Nutrition Assistance Program (SNAP) participants to pay for food using their EBT card. Treyshop is enabling the victimization of low-income families that depend on their SNAP benefits in order to eat.