Internet Auction Fraud Investigations

Michael Y.K. Kwan2, Richard E. Overill1, K.P. Chow2,Jantje A. M. Silomon1, Hayson Tse2, Frank Y.W. Law2, and Pierre K.Y. Lai2

1Department of Computer Science, King’s College London, Strand, LondonWC2R 2LS, U.K.

2Department of Computer Science, The University of Hong Kong, Hong Kong.

{richard.overill,jantje.a.silomon}@kcl.ac.uk,{ykkwan,chow,hkstse,ywlaw,kylai}@cs.hku.hk

Abstract

The Internet has brought new business opportunities, including online auctions. These opportunities have also been seized by criminals. Internet auction fraud has become prevalent and studies have been carried out to discover the characteristics of transactions by perpetrated fraudsters. From those characteristics, methodologies for detecting fraudulent online transactions were designed. The methodologies made use of historical information on Internet auction users to decide whether or not a user is a potential fraudster. Such information includes reputation scores, values of items, time frame and other transaction records. In this paper, a total of 278 allegations relating to selling of counterfeit goods on Internet auction sites were studied. A distinctive set of characteristics for fraudsters selling counterfeit goods was identified. Additionally, evidential traces of digital evidence were revealed from 20 prosecuted cases involving Internet auctions of counterfeit goods in Hong Kong. Through the construction of Bayesian network models representing the scenarios of the prosecution and the defense, this paper proposes an approach using the likelihood ratio as a criterion for determining the relevance of the associated digital evidence for prosecuting Internet auction frauds.

1. Introduction

According to the DataCenter of the China Internet [1], in the first six months of 2008, China Internet users spent 2.56 trillion Renminbi (USD 698 billion)via the Internet. It was an increase of 58.2% as comparing to the same period in 2007. 35% of the 2.56 trillion Renminbi (USD 698 billion) was spent on purchases made via the Internet, with 65% spent mainly on on-line games and network communities [1]. According to the ChinaInternetNetworkInformationCenter [2], there are more Internet users in China than anywhere else in the world. China has 253 million Internet users in 2008 [2]. This is predicted to increase to 480 million in 2010 [2]. By then, the volume of online transactions in China is expected to overtake Japan and South Korea [2].

The advancement of technology has brought new opportunities for shoppers and business entities. Shoppers have been able to search, compare, decide, bargain and buy commodities. They have done so while sitting at home via the Internet. Business entities have also seized the opportunities to sell their goods through the Internet. They have offered customers low prices, convenience, and a wide selection of merchandise. The advancement in technology has also attracted those who used to sell their second hand goods at flea markets. One of the new opportunities is Internet auction sites.

Internet auctions have provided opportunities to honest and dishonestusers, buyers and sellers. Internet auctions have provided buyersunparalleled wide selections and potential values. They have also providedsellers with a way to reach millions of buyers. Criminals have been attractedby the great profit and low entry costs of Internet auctions. Lessscrupulous sellers take advantage of buyers. Some misstate the quality or condition of their commodities. Some have no intention of delivering the goods they offer to sell. As a result, Internet auctionfraud has been ranked the highest amongst the reported fraud cases inelectronic commerce [4].

The purpose of this paper is to examine the characteristics of Internet auction fraud regarding the selling of faked goods in Hong Kong. These are goods bearing false trade descriptions or forged trademarks. This paper also applies a Bayesian approach to the analysis of the evidence in an Internet auction fraud case involving the selling of counterfeit or faked goods.

2. Background and Previous Work

In this section, the characteristics of Internet auction fraud are reviewed. Related approaches to fraud detection in online auction sites arealso surveyed.

2.1 The Success of Internet Auctions and How It Works

Internet auctions are successful for many reasons. Morzy et al. [3] have listed some of them. Bidders are not constrained by time. They can bid 24 hours a day, 7 days a week. Potential users have sufficient time to search for interesting items. The Internet does not impose geographical constraints on users. Users are not required to attend physically at an auction. The large number of sellers and buyers can reduce overall selling costs. It also decreases prices of goods because of large number of suppliers. Finally, many users describe their bidding experiences as comparable to gambling. The offering of the highest bid is considered by bidders as winning a game. This makes bidding exciting.

Ochaeta [4] listed 6 basic activities of safe Internet auction. They are:

(a)Initial buyers and sellers registration: This step is the authentication of the trading parties. It involves the exchange of cryptography keys and the creation of a profile for each trader. The profile reflects the trader’s interest in products of different kinds and possibly his authorized spending limits.

(b)Setting up a particular auction event: This step is the setting up of the protocol and rules of the auction. Such rules include the descriptions of the items being sold or acquired, the type of auction being conducted (e.g. open cry, sealed bid, or Dutch), parameters negotiated (e.g. price, delivery dates, terms of payment), starting date and time of the auction, and the auction closing rules, etc.

(c)Scheduling and advertising: In order to draw the attention of potential buyers, items of the same category (e.g. art, jewelry) are generally auctioned together on a regular schedule. Popular auctions are sometimes mixed with less popular auctions. Items to be auctioned in upcoming auctions are also advertised. Potential buyers are notified of these upcoming events.

(d)Bidding: The bidding step handles the collection of bids from buyers. It implements the bid control rules of the auction (i.e. minimum bid, bid increment, deposits required with bids). It also notifies the participants when new higher bids are submitted.

(e)Evaluation of bids and closing the auction: This step implements the auction closing rules and notifies the winners and losers of the auction.

(f)Trade settlement: This final step handles the payment to the seller, and the transfer of goods to the buyer. If the seller is not the auctioneer, this final step handles payment of fees to the auctioneer and other agents.

2.2 Reasons for Internet Auction Fraud

The advance of Internet and the continuous growth of electroniccommerce have offered new opportunities to criminals. Gajek et al. [5] observed that criminals have discovered the Internet as a profitable groundfor illicit business. According to the research of Choo [6], organized crime groups (including organized cybercrime groups) are known tohave been involved in technology-enabled crimes, including onlineauction frauds.

Sakurai et al. [7] concluded that remaining anonymous was a factor inInternet fraud and that the existence of indivisible bids caused difficulty in matching supply and demand. This wasbecause a seller or a buyer might submit a false-name-bid by pretending to be a potential buyer or seller. In this way they maybe able to manipulate the supply-and-demand chain. Chae et al. [8] confirmed the findings of Sakurai et al. and concluded that online auction fraud was successful through the information asymmetry and anonymity problems.

There are many reasons for the proliferation of Internet auction fraud. Chua et al. [9] have listed some of them. They concluded that a high degreeof anonymity was at the top of the list. In Internet auctions, noauthentication barrier exists. Therefore, it is easy for dishonest users toavoid investigation and prosecution. Second on their list are thelow costs for entry and exit. These are precisely the reasons for thesuccess of Internet auctions.

2.3 The Nature of Internet Auction Fraud

Internet auction fraud has become a major threat. According to the“2008 Internet Crime Report” [10], the median dollar loss per complaintof Internet fraud was USD931 in 2008 in the USA. The total dollar loss was USD264.60 million [10]. During 2008, there were275,284 received complaints in the USA [10]. This figureincludes auction fraud, non-delivery, and credit/debit card fraud, computerintrusions, spam, and child pornography [10]. Internet auction fraudwas the most reported offense. It comprised 25.5% of all complaints. Auction fraud comprised 16.3% of the reported total dollar loss [10]. The averagemedian dollar loss per auction fraud complaint is USD610 [10].

Gregg et al. [11] found that Internet auction fraud took various forms, such as delivering goodsnot as requested, of low quality, without ancillary item or parts, beingdefective, being damaged, or being black market items. Morzy et al.[3] identified other practices, such as bid shielding andbid shilling.

Bid shielding is the offering of an artificially high bid for an itemin order to discouraging other bidders from competing for an item. The one who makes such an offer is known as a shielder. At the lastmoment, the shielder withdraws the bid. Accordingly, the winner is the second highest bidder. The winner in fact cooperates with theshielder to win the bid.

Bid shilling is the use of a false bidder identity to drive up the price ofan item on behalf of the seller.

Gregg et al. [11] observed that there were an increasing number ofcomplaints regarding another form ofInternet auction fraud, namely “accumulation” fraud. This is a seller attempting to build up his reputation by selling much low-value merchandise over a longperiod of time. After this initial investment, the seller presents an offerof expensive goods. The buyer never gets the expensive goods after making their payment.

Chua et al. [9] accepted that Internet auction fraud itself might take multiple forms. They also created the taxonomy presented below:

Seller as Fraudster
Bid shilling / Seller bids on own auctions to drive up the price
Misrepresentation / Seller intentionally misdescribes the item
Fee stacking / Seller adds hidden costs such as handling charges to the item after the auction ends
Failure to ship / Seller never sends the goods
Reproductions & counterfeits / Seller advertises counterfeit goods as the real thing
Triangulation fencing / Stolen goods are sold
Shell auction / Seller sets up an auction solely to obtain names and credit cards
Buyer as Fraudster
Bid shielding / Two buyers collude on an auction. One bidder makes a low bid, while the second makes an inflated bid. Before the auction ends, the higher bidder withdraws
Failure to pay / Buyer never sends the money
Buy & switch / Buyer receives merchandise and refuses it. However, buyer switches original merchandise with inferior merchandise
Loss or damage claims / Buyer claims item was damaged and buyer disposed of it. Buyer wants money back

From an economic point of view, Chua et al. [9] concluded thatall of the above mentioned types of fraud are very dangerous. This isbecause they undermine the trust that users develop towards the onlineauction site. They also decrease the reputation of the service, which can be disastrous for the online auction site.

According to the study of Ku et al. [12], frauds may happen to eitherthe buyer or the seller. A buyer is more easily targeted as a victim thana seller [12]. Due to the nature of the Internet auction, it was found that 89.0%of all seller-buyer pairs conducted just one transaction during the time period of the study [12]. At most, there were four transactions between a seller-buyer pair. This meansthat the repeated transaction rate of the same seller-buyer pair is lower than 2% [12]. This transaction rate is an indication of whether or not thetransactions between a sell-buyer pair are normal. If the transactionrate is significantly higher than 2%, it indicates that the transactions between aseller-buy pair might be suspicious,for example they may be shillingor shielding [12].

As observed by Kobayashi et al. [13], a common trick in Internet auction fraud was for the fraudsters to pretend to carry out honestdealings in the early period of using the auction, but once they became trusted they committed fraud.

Ochaeta [4] also studied the behavior of fraudsters in Internet fraud. She concluded that these criminals had tried to establish a good enough reputation prior to their imminent fraudulent acts [4]. Therefore their reputation building process was different from that of legitimateusers [4]. These fraudsters attempted to gain as much one-time profit as possible as quickly as practicable [4]. If their reputation fabrication process can bediscovered, the fraudsters can be identified [4].

The patterns used by these fraudsters to build their reputations are:

(a)selling or buying numerous cheap items from users with a good reputation;

(b)selling or buying moderate value or expensive items from accomplices; and

(c)the process usually takes place over a short period of time.

In order to build up a reputation over a short period of time, most Internet auction fraudsters tend to sell a lot of low priced or cheapproducts. These acts take place at the beginning of their fraudulentauction lives. Simultaneously, fraudsters also try to bid inexpensiveitems from users with good reputation scores. This is done for thepurpose of establishing a favorable reputation score through numerous legitimatetransactions.

3. Characteristics of Internet auction fraud regarding fake goods in Hong Kong

3.1 Internet Auctions Sites for Faked Goods

We have statistically examined 278 cases in Hong Kong in order to reveal the characteristics of Internet auction fraud regarding fake goods. Thecases were complaints lodged to the Hong Kong Customs & Excise Department on selling of fake goods on Internet auction sites. The Customs & Excise Department is the prime law enforcement agency in Hong Kongresponsible for the protection of intellectual property rights. In these 278 cases, wenoted the following characteristics for fraudsters selling counterfeit or faked goods on Internet auction sites:

(a)The fake goods were sold at unreasonably low costs atabout only 10% of legitimate products;

(b)About two-thirds of them (180 out of 278) offered to sell those goods within 7 days of setting up their accounts;

(c)They have multiple auction accounts that do not carry high trust values or reputation scores of 8 or more out of 10;

(d)They are short lived(less than 10 days) and tend to switch to other auction accounts before expiry of the auction period;

(e)Many varieties of items (more than 5) belonging to different categories are sold, e.g. a mixture of watches, mobile phone, footwear, sportswear, etc.

4. Investigation Model for Online Auction Site Selling Counterfeit Goods

4.1 Digital Forensic Hypotheses and Evidential Traces

In this section, an investigation model for online auction fraud in selling of counterfeit goods using a Bayesian network approach is proposed. Based on 20 prosecuted cases from the 278 complaints of selling counterfeit items by online auctions, the digital evidence collected led to the following three hypotheses regarding actions taken by the fraudsters in those cases. Because there were no detailed judgments on these 20 prosecuted cases, interviews were carried out with the responsible digital forensic examiners to elicit the following three hypotheses.

  1. Uploading of auction related material (e.g. images or descriptions of the items) has been performed;
  2. Manipulation of the corresponding auction item (e.g. price adjustment) has taken place;
  3. Communication between the seller and the buyer related to the auctioned fake item (e.g. email, instant messaging) has occurred.

These three sub-hypotheses, which substantiate the overall prosecution hypothesis that an online auction fraud crime has been committed in the 20 prosecuted cases, are supported by 13 distinct evidential traces, again obtained from the responsible digital forensic examiners, as shown in the simple Bayesian network model given in Figure 1.

This investigation model does not of itself substantiate the whole prosecution case. The auctioned item also has to be procured physically by the investigator and to be examined by the trademark owner in order to ascertain whether or not the item is counterfeit in nature.

Figure 1 Bayesian network model for prosecution hypotheses and related evidential traces

In order to evaluate the relevance of the digital evidential traces, another simple Bayesian network model representing the defense scenario has also been established. Although the root hypotheses of the two models appear to be the same, they are in fact different due to the two different sets of supporting sub-hypotheses representing the prosecution and defense scenarios respectively. In both models, the same set of evidential traces is used. Figure 2 presents the defense’s hypotheses and their associated evidential traces.

Figure 2 Bayesian network model for defense hypotheses and related evidential traces

4.2 Evidence Evaluation

We propose to use theLikelihood Ratio (LR) to evaluate the evidence of the case. LR is a general technique that can be applied to any scenario with decision uncertainty. According to Lucy [14], LR has been an effective tool to quantify the value or relevance of evidence. Broadly speaking, the closer a LR is to 1 the less relevantor valuable is the evidence. Evett [15] generalized the LR approach of relevance by using a form of LR to represent the situation where it is uncertain whether or not the evidence is a result of the suspect’s activity. The general form proposed by Evett is :