watch now

When a man in a black Air Jordan T-shirt walked up to a self-checkout kiosk at a Louisiana Lowe's last spring, he looked like any other customer. Over the course of about seven minutes, he methodically rang up different gift cards for $95 each, using his phone to tap-to-pay for each card as a red-vested associate circled nearby, surveillance video showed. Unknown to the employee, the man was part of a sprawling Chinese crime ring, using stolen credit cards to buy the gift cards while a Southeast Asian scam compound coached him through each transaction through the wireless headphones in his ears, police say. "We know that there are hundreds of individuals at any one time doing this across the country," said Adam Parks, an assistant special agent in charge with U.S. Homeland Security Investigations, who investigated the case. "Even though you think that's $95 every transaction, that adds up to a lot of money."

A suspect that police said is connected to a Chinese organized crime ring using stolen credit cards to purchae gift cards at a Lowe's in Hammond, Louisiana. HSI

After the man left the hardware store, he purchased more gift cards with stolen credit card information at other retailers only to return to the original Lowe's the same day to repeat the act, Parks said. He was not arrested and is still a suspect, he added. Lowe's didn't respond to repeated requests for comment from CNBC. While credit card theft and fraud isn't new, with the proliferation of tap-to-pay and growing use of retail apps, these digital thefts are shaping the next wave of organized retail crime and earning Chinese gangs as much as $1 billion annually, police said. Unlike typical retail theft operations — where criminals clear out shelves in big box stores and resell merchandise piece by piece on online marketplaces — the crimes can be carried out right under a store employee's nose or from a computer anywhere in the world. "It's very low risk for the bad actors," said Scott Glenn, vice president of asset protection at The Home Depot . "It's not the same thing as walking into a Home Depot, filling up a cart full of power tools, and then walking out. It's just not as visible, it's not as obvious to what's happening out there and so it's become a more preferred method over the last several years." Fraudsters have selected retailers as their targets because their platforms carry sensitive information such as stored credit cards and personal data but they do not have the same level of security as banks, according to industry experts and law enforcement.

A man police say participated in a tap-to-pay fraud scheme at a Target store self- checkout in Tennessee Source: Knox County Sheriff’s Office

There's no firm data on how much retailers are losing from digital forms of retail crime, but CNBC found around a dozen criminal cases across the country affecting a wide variety of retailers that police said involve a combination of organized groups and low-level fraudsters. The cases are complex and often hard for local authorities to handle, said Capt. Matt Lawson of the Knox County Sheriff's Office in Tennessee, who said he's been investigating a fraud ring with ties to Chinese organized crime. Unless the theft hits a certain dollar threshold or rises to the level of a federal crime, "it's kind of like they get away with it almost," he said.

Unpaid toll bills and pending criminal judgments

Tap-to-pay fraud, which involves a fraudster adding a stolen credit card to their digital wallet and using it to buy gift cards or merchandise, often starts with a familiar text message and can end with an unwitting consumer's identity up for sale on platforms such as Telegram. Fraudsters send out mass text messages warning about unpaid tolls, expiring car registrations or pending arrests that are designed to scare consumers into providing their credit card information, email credentials or other sensitive data. AI has only made the schemes easier, as crime groups can scale the scams more quickly and make the messages appear more legitimate, experts said. "Once a fraudster has a person's email password and credit card, they can load that credit card into a device that they control," said Jeff Otto, the chief marketing officer of Riskified , a tech company that works with retailers including Foot Locker, Peloton and BJ's Wholesale Club to fight fraud.

Jeff Otto, the chief marketing officer of Riskified. CNBC

"When the bank reaches out to say, 'Hey, is that you loading the card?' They've already got access to the victim's email" and can often check it for a one-time passcode before the consumer notices, he said. Low-level opportunists engaging in tap-to-pay schemes can operate independently, using the practice to either buy merchandise or purchase gift cards and resell them at a discount for cash. But on the Chinese organized crime level, the practice involves an entire criminal network, Parks said. In order to get profits back to China, crime groups use tap-to-pay fraud to buy gift cards and then use those gift cards to purchase high-value goods that can be resold at a premium in China, such as iPhones with American settings, Parks said. The practice allows gangs to skirt strict banking laws both in the U.S. and China and convert higher amounts of cash into the legitimate economy. At the heart of the strategy are foot soldiers such as the customer at Lowe's who police say helped carry out the fraud, which in the years since the Covid-19 pandemic has ramped up along with a surge of Chinese nationals at U.S. land crossings, Parks said.

People looking to enter the country illegally often rely on smugglers and organized crime networks, and they then owe a debt that crime groups require them to pay off once they're in the U.S. "So [they're] going to instruct you on how to go into a store, convert the stolen credit card information into acquiring goods and then now you're going to ship those goods back to China," Parks said. "That's where a lot of times we get our arrests, but that is the lowest level of the organization."

Adam Parks, an assistant special agent in charge with U.S. Homeland Security Investigations. CNBC

Tap-to-pay schemes also can include retail app fraud, which involves stealing someone's credentials, logging into their account and using stored credit card information to purchase merchandise or gift cards. Riskified's Otto showed CNBC how data breaches, phishing and social engineering, which involves piecing together publicly available information about someone to steal their identity, can give fraudsters access to a consumer's retail account. CNBC saw that login credentials for Walmart 's app and website were being sold on various Telegram channels for between $1.50 and $2.50 with information about how long the accounts had been active. "They have Yahoo addresses that are 10 years old, Gmails that are 10 years old," Otto said. "These are older accounts that often get past some of the more rudimentary fraud checks [because] we tend to trust accounts that have been with us for a long time. And in this case, these can be sold." Telegram didn't return a request for comment. Compounding the issue is the fact that many retail apps and websites don't always have the same level of security as platforms like banking apps, Otto said. On their face, retail apps are for shopping, places for consumers to buy clothes, household necessities or makeup. But they also contain stored credit cards, sensitive personal information and sometimes, access to a consumer's store-branded credit card. For example, Macy's customers can shop on its app and use the same platform to pay their Macy's credit card bill. "It has a lot to do with the fact that they are focused on convenience and they're focused on conversion, generating the maximum amount of online revenue, and because of that, they do not use bank-grade security," Otto said of the retail industry. "They don't want to add additional friction." In a statement to CNBC, Walmart said "customer privacy and safety is a top priority." "While we won't disclose specific security measures, Walmart has systems in place to help detect bad actors, prevent, and respond to unauthorized account access and is continuously enhancing these protections," the company said. "In addition, full payment card information is not stored in an unprotected form."

Using anime to disguise fraud