Fake accounts and review abuse in Retail & e-commerce

How the attack works

1. The operator uses automated registration to build a pool of customer accounts on your website. Disposable email addresses make the records look separate, while the accounts are prepared for later reviews, refund requests or repeated return activity.
2. Accounts are used to establish whatever purchase or engagement history the business requires. The operator spreads this activity over different identities so a later review or service request arrives with an individual account record rather than an obvious bulk submission.
3. The accounts post coordinated reviews or make claims through the customer service journey. Each request draws attention to its own order and explanation, keeping the relationship to other accounts out of the immediate review.
4. When an account is restricted, the operator moves to another prepared identity or registers again. Moderation and support revisit similar activity under different names, while the business continues to count those identities as separate customers.

Why it gets through

Registration checks can confirm that an email address receives messages without establishing whether the person behind it already controls other accounts. A verified address therefore does not settle whether a registration is part of a coordinated account pool.

Account-level restrictions work on the history available within that account. They lose reach when the operator returns with another identity. An IP ban can also miss the connection after a proxy change, while broad network restrictions risk affecting genuine customers alongside the unwanted activity.

A review or refund claim can appear plausible on its own. Teams handling content, orders and customer service often investigate different records. Without a relationship between registrations and later activity, repeated abuse can remain hidden while several teams spend time on individual cases.

Review moderation workload rises when coordinated submissions require individual investigation. Removing a misleading review does not address the account pool behind it. The team needs context that can explain repeated participation without assuming every negative review is abusive.

Refund and return rate captures a different consequence of the same account problem. Claims spread across identities make repeated behaviour harder to see in a single customer history. Handling, fulfilment and support work can accumulate even when each claim appears small in isolation.

Customer trust and support resolution time are affected together. Genuine buyers rely on reviews and fair service decisions. Overly broad restrictions can damage those experiences, but reviewing every account from scratch leaves the team repeating work and makes consistent decisions more difficult.