11/18/19

LP, AP & IT Security's #1 News Source

eBay's PROACT Program Continues to Support Retailers'
ORC Investigations

Did you know that eBay has a team that is not only dedicated to assisting law enforcement with criminal investigations, but also retail partners as well? This is known as eBay's PROACT program (Partnering with Retailers Offensively Against Crime and Theft), and it started in 2008 to assist retailers who are investigating Organized Retail Crime cases.

To date, eBay has enrolled hundreds of retail partners globally into the PROACT program, and we have investigators in the US and UK that are able to assist retailers on their investigations. We are able to provide information on individual accounts as well as volumes associated to those accounts. We also maintain a rolodex of thousands of law enforcement contacts around the globe, so we can assist our partners in getting in touch with the correct law enforcement agency for their investigation.

To obtain additional information on the PROACT program, please contact proact@ebay.com. We look forward to working with you!

Checkpoint Systems Increases Their Commitment to
the Loss Prevention Foundation

Checkpoint supports LPF by becoming Bachelor level partner

Matthews, NC - The Loss Prevention Foundation (LPF) announced that Checkpoint Systems has advanced its support of the LPF by becoming the most recent Bachelor level partner. The Bachelor level partnership secures certification course scholarships and complimentary LPF memberships for Checkpoint to distribute to those in the loss prevention industry.

Headquartered in Thorofare, NJ, Checkpoint Systems, a division of CCL Industries, is a vertically integrated RF/RFID solution provider for retail. Their intelligent retail solutions are built upon 50 years of radio frequency technology expertise, innovative high-theft and loss prevention solutions, market-leading software, RFID hardware and comprehensive labeling capabilities to brand, secure and track merchandise from source to shelf.

"We are delighted to announce that Checkpoint has chosen to increase their partnership level with the LPF," said Terry Sullivan, LPC, president of The Loss Prevention Foundation. "By continuing and advancing their partnership with us, they are demonstrating their on-going commitment to continued education for loss prevention professionals. LPF partners, like Checkpoint, are what make it possible for us to fulfill our mission and advance our LPQualified (LPQ) and LPCertified (LPC) certification initiatives and we are glad to have Checkpoint's continued and advanced partnership."

"We are honored to continue our support of LPF and the work they do with the LP community," said Stuart Rosenthal, Vice President of Sales for Checkpoint's Alpha High-Theft Solutions. "By providing ongoing education for our retail partners, LPF energizes and advances LP/AP professionals throughout their careers."

When conducting an investigation, interviewers are focused on obtaining reliable information and additional evidence in effort to find resolution to a case. In the loss prevention industry, the "victims" of a "crime" may be a company and their profits, a customer, or a fellow employee. Often during the subsequent interviews, investigators become biased as they intend to represent the victim and rely on the information gathered from their investigation. Unfortunately, the "evidence" that is obtained can sometimes be wrong, eyewitnesses may be mistaken in their recall of an event and an interviewer may be headed in the wrong direction. Regardless, if the subject of an interview confesses to these accusations - innocent or guilty - the confession is likely seen as the strongest piece of evidence by the decision makers. Truth be told, when interviews are done improperly they have devastating consequences.

Read more here

How Retailers Can Defend Against Cyber Skimmers
There's a new form of cyberattack hitting online businesses that has security experts in retail and other industries working overtime to protect their companies.

Variously called "formjacking," "web skimming" or "Magecart," the bad news is that there are an average 4,800 websites compromised by such attacks each month, according to cybersecurity firm Symantec. But the good news is that 3.7 million attacks were blocked last year.

It was October 2018 when RiskIQ first identified Magecart, which attacks ecommerce sites running outdated and unpatched versions of shopping cart software. Rather than attacking consumers directly, Magecart, allegedly the work of a group of Eastern European criminals, gets malicious code into sites run by businesses and uses it to steal card information.

The code can be difficult to detect, and once a website is infected, payment card information is "skimmed" during a transaction without the merchant or consumers being aware that the information has been compromised, according to the Payment Card Industry Security Standards Council.

TRACKING THREATS

The National Retail Federation is playing a major role to help retailers battle against Magecart.

The topic has been "on our radar screen" for over a year, says NRF Senior Director for Retail Technology and Cybersecurity Christian Beckner, "Every time there is a public report about [a Magecart attack], we share this with our members."

NRF circulated an in-depth report on the subject to retailers earlier this fall. More informational outreach is being developed, including sessions on cyberattacks and a cybersecurity workshop at NRF 2020 Vision: Retail's Big Show, the association's upcoming annual conference in New York City in January.

In tracking cyber threats, NRF separates them into two groups, according to Beckner. First are those directed at any IT system in the private or public sector, such as ransomware or email phishing. Then there are the threats directed toward customer-facing businesses such as retail, hospitals, transportation and hospitality.

When asked how retailers can protect themselves against Magecart threats, Beckner echoes many other cybersecurity experts: "Monitor third parties on your website. It's almost a governance issue - keep track of them."

"It is definitely in the top five," Beckner says in ranking Magecart among cyber threats. "Among consumer-facing businesses, it is in the top three," falling behind only attacks on point-of-sale systems and account takeovers. stores.org

Trusted certificates make phishing websites appear valid
There has been a rampant growth of look-alike domains, which are often used to steal sensitive data from online shoppers. Venafi analyzed suspicious domains targeting 20 major retailers in the U.S., U.K., France, Germany and Australia and found over 100,000 look-alike domains that use valid TLS certificates to appear safe and trusted. According to the research, growth in the number of look-alike domains has more than doubled since 2018, outpacing legitimate domains by nearly four times. helpnetsecurity.com

Attackers' Costs Increasing as Businesses Focus on Security
Companies that focus on continuously testing their security through automated means and regular penetration testing roughly double the cost to attackers of finding exploitable vulnerabilities in their systems, according to data from security assessments and red-team engagements collected by crowdsourced security firm Synack.

The findings suggest that companies that incorporate security into their development and operations are succeeding in hardening their systems, says Anne-Marie Chun Witt, a director of product marketing at Synack. "You are seeing fewer vulnerabilities and/or taking longer to find them. It is taking more effort to find them and they are having to find more complex stuff. So they [companies focused on security] can say they are increasing the costs for attackers."

The data underscores that security efforts do result in measurable improvement in the security posture of companies that undertake them. Overall, companies that automated security testing - conducting it on essentially a continuous basis - had a 43% higher measure of security using Synack's proprietary metric.

Most companies - 63% - remediated vulnerabilities in less than three months. Among the laggards were e-commerce companies, retailers, and state and local government and education. darkreading.com

Target Sues Insurer For Coverage Of 2013 Data Breach Claims
Target Corp. sued units of Chubb Ltd. in federal court Friday for allegedly denying coverage for claims brought by banks whose customers were affected by the massive 2013 data breach against the store, saying the replacement of compromised credit cards triggers policy coverage for tangible property.

Target says that after millions of customers' credit card data and personal contact information was stolen in the breach, the store reached settlements with banks and major credit card issuers totaling $138 million, at least $74 million of which was for the costs associated with the banks replacing compromised credit cards.

Target alleges that its liability for the costs of reissuing the banks' credit cards is covered by general liability and excess policies with Ace American Insurance Co. and Ace Property & Casualty Insurance Co. for the period of February 2013 to February 2014, adding that the insurance policies underlying the excess policy have been exhausted. law360.com

Illinois man who operated DDoS criminal service sentenced to 13 months prison
Sergiy P. Usatyuk, a 21-year-old resident of Orland Park, Ill., has been sentenced to 13 months in prison, followed by three years of supervised release, for his role in running illegal booter services responsible for millions of DDoS attacks. Usatyuk was also ordered to forfeit $542,925 and dozens of servers as part of the sentence. darkreading.com

Senior Job: Sr. Director Security Compliance Data Privacy for Brooks Brothers in Enfield, CT

5 Cybersecurity CISO Priorities for the Future

Sam's Club adds alcohol to Scan & Go

Apple bans vaping apps from the iOS App Store

How Amazon's quest for cheaper products has resulted in a flea market of fakes

Former executives say e-commerce giant, which last year spent $400 million fighting fraud and abuse, has prioritized its broad selection over anti-counterfeiting

Amazon executives have publicly lamented the scourge of counterfeits, saying they have spent hundreds of millions of dollars and hired thousands of workers to police its massive market of third-party firms that use the e-commerce site to sell their goods. But as the availability of the fake Hermès bracelet shows, Amazon's system is failing to stanch the flow of dubious goods even with obvious examples of knockoffs.

The continued abundance of counterfeit goods on the site is the result of Amazon's decisions to prioritize a broad selection of products and cheaper prices over the deployment of aggressive technologies and policies that could further stem the problem, according to former executives and outside consultants.

Amazon relies on brands to let the company know about frauds, but even when the company has custody of counterfeit items, it doesn't always take action. Scads of counterfeit products, including the Hermès bracelet, land in Amazon warehouses before they're shipped to consumers. But Amazon very rarely inspects them for authenticity.

The Seattle-based e-commerce giant keeps a roughly 15 percent cut of the sales of third-party sellers regardless of whether the product is counterfeit. But losing out are not just luxury brands - many of the counterfeit products include safety items, baby food and cosmetics, according to recent testimony to the Commerce Department, which is probing counterfeit sales online. washingtonpost.com

Nike just 'tip of the iceberg' of companies ditching Amazon and selling directly to consumers
Nike's decision to stop selling merchandise to Amazon is just the "tip of the iceberg" of brands opting to go directly to consumers, internet entrepreneur Tim Armstrong told CNBC on Friday. "The direct-to-consumer movement will be the replacement for the retail issues and commerce issues that are going on because of the platforms," said Armstrong, founder of the dtx company, which aims to disrupt online shopping.

"If they have the option to go direct, they are going to go direct," said Armstrong, former CEO of AOL and ex-Google ad chief. Brands are often fearful that by partnering with Amazon they will lose control over how they're represented on the site.

On Wednesday, Nike confirmed to CNBC that a pilot program, launched in 2017, to sell a limited product assortment to Amazon, in exchange for stricter policing of the Nike brand on the platform, will end. Nike said it's shifting focus to its direct-to-consumer business, which brings in about 30% of annual sales. In its last fiscal year, Nike's direct-to-consumer sales totaled $11.8 billion.

When announcing the dtx company earlier this year, Armstrong said he sees the economy transforming away from a "one-way, wholesale distributor relationship," thanks to technology around social media and payments, in particular. cnbc.com

Aldi launches same-day alcohol delivery nationwide via Instacart

"Pipka" JavaScript Skimmer Discovered by Visa Targets Ecommerce Websites

Lubbock, TX: 5 arrested, 2 officers injured during incident at Kohl's late Saturday; engaging in organized crime and robbery
The incident occurred Saturday evening around 11:00 p.m. at Kohl's, located on 98th Street. A store employee told LPD that a group of individuals were in the store who were previously observed stealing merchandise. The employee said they fled the store via the fire exit during the previous theft and into a get-away vehicle. Officers surrounded the store and waited for the suspects to exit. The police report said the suspects were observed stacking merchandise by a fire exit. One of suspects, identified as a the get-away driver, exited the store and was detained by officers. Police said a short time later, the four other suspects were observed attempting to leave a fire exit with merchandise. LPD said all four suspects were eventually apprehended but resisted arrest, which lead to the officers being injured. The officers were taken to University Medical Center where they were treated and released. everythinglubbock.com

Saratoga Springs, UT: 3 men, 2 juveniles arrested after allegedly stealing $11K in electronics from Utah Walmarts
Three men and two juveniles have been arrested after allegedly stealing more than $11,000 in electronics from Walmarts in Saratoga Springs and South Jordan. Desmion Hodo, 18, Myriel Edgar, 20, and Jaquan McElroy, 20, who are listed in Utah County court documents as being from Flint, Michigan, are facing charges of retail theft, a second-degree felony, retail theft, a third-degree felony and contributing to the delinquency of a minor, a class B misdemeanor.

"A vehicle search yielded a large amount of various high-priced merchandise and electronics, including Hero GoPro video recorders, PS4 Pro PlayStation game consoles, Xbox One X game consoles, and several HP PC laptops," the statement said. Officers also located all the items that were allegedly acquired at the Saratoga Springs Walmart, including Apple watches, PS4 Pro PlayStations, and Apple iPad Airs. The total value of the thefts in that case was $2,700. South Jordan police subsequently said the same males were at the Walmart in their area and used similar tactics to fraudulently purchase approximately $8,900 of items including multiple laptops, gaming consoles, GoPros and other items. gephardtdaily.com

Phoenix, AZ: Pair stole over $10,000 from Sprouts Farmers Market locations in Phoenix-area
Court documents indicate 24-year-old Timothy Becker and 50-year old Jolanta Krashowska shoplifted from Sprouts locations in Avondale, Glendale, Mesa, Peoria and Scottsdale between Nov. 8 and Nov. 10. Becker and Krashowska allegedly took over $3,300 from those Peoria stores alone. The other locations and amounts were not disclosed. When taken into the custody, the pair admitted to shoplifting vitamins and other merchandise at five stores in a single day. Officers found stolen items in a rental car they were using and the suspects admitted to selling merchandise on the internet for profit. Becker and Krashowska were taken into custody for organized retail theft and shoplifting charges. azfamily.com

Red Wing, MN: Four arrested in $1,700 Red Wing Walmart theft
Four St. Paul residents were arrested early Thursday morning after allegedly stealing $1,700 worth of merchandise from Walmart. our St. Paul residents were arrested early Thursday morning after allegedly stealing $1,700 worth of merchandise from Walmart. rivertowns.net

Thousand Oaks, CA: Deputies say 2 tried to steal $2,500 in items from beauty store
 

Click to enlarge map

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights

 

	Regional Loss Prevention Manager Greater Toronto Area, Canada Become the Newest Member of the VF Family. As the Regional Loss Prevention Manager, you will have the critical function to support an entire region of stores and serve as the subject matter expert in loss mitigation. You will have the great responsibility to own and oversee all matters and investigations of internal and external theft...
	Senior ORC Investigator Boca Raton, FL The Senior Investigator is part of a fast-growing, ever changing environment that partners with Store Operations to ensure we provide the best experience to our customers. The Senior Investigator is responsible for assisting with implementing a strategy to combat organized retail crime and external theft across the TJMaxx and Marshalls brands...
	Loss Prevention Investigator Seattle, WA The Loss Prevention Investigator is part of a fast-growing, ever changing environment that partners with Store Operations to ensure we provide the best experience to our internal and external customers. With a focus on internal cases, the Investigator takes complex investigations head-on through establishing solid partnerships with store and LP leadership...
	Loss Prevention Investigator San Jose, CA The Loss Prevention Investigator is part of a fast-growing, ever changing environment that partners with Store Operations to ensure we provide the best experience to our internal and external customers. With a focus on internal cases, the Investigator takes complex investigations head-on through establishing solid partnerships with store and LP leadership...
	Area LP Manager San Jose or Fresno, CA The Area Loss Prevention Manager (ALPM) drives shrink improvement and asset protection programs for two (2) to four (4) Districts which contain approximately 25-65 Ulta Beauty Stores. The Area Loss Prevention Manager is responsible to assess store procedures, promote awareness and methods to prevent, protect and control losses...
	Area LP Manager Sacramento, CA The Area Loss Prevention Manager (ALPM) drives shrink improvement and asset protection programs for two (2) to four (4) Districts which contain approximately 25-65 Ulta Beauty Stores. The Area Loss Prevention Manager is responsible to assess store procedures, promote awareness and methods to prevent, protect and control losses...
	Regional Asset Protection Manager (North East) Boston, MA The successful candidate will be responsible for the management of the Asset Protection function in their assigned area. Guide the implementation and training of Asset Protection programs, enforcement of policies and procedures, auditing, investigations and directing of shrink reduction efforts...
	Loss Prevention Operations Specialist Tucscon, AZ The Loss Prevention Specialist will oversee the Burglar/Fire Alarm and overall Physical Security function for stores including CCTV for all new stores, renovations, acquisitions, closing, existing stores and warehouses. In addition, this position supports the security/property control component for the Corporate Headquarters main campus...

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

View Featured Jobs   |   Post Your Job
 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here