Inside the Chinese fraud rings stealing billions from banks and retailers

When a man in a black Air Jordan T-shirt walked up to a self-checkout kiosk at a Louisiana Lowe's last spring, he looked like any other customer.

Over the course of about seven minutes, he methodically rang up different gift cards for $95 each, using his phone to tap-to-pay for each card as a red-vested associate circled nearby, surveillance video showed.

Unknown to the employee, the man was part of a sprawling Chinese crime ring, using stolen credit cards to buy the gift cards while a Southeast Asian scam compound coached him through each transaction through the wireless headphones in his ears, police say.

"We know that there are hundreds of individuals at any one time doing this across the country," said Adam Parks, an assistant special agent in charge with U.S. Homeland Security Investigations, who investigated the case. "Even though you think that's $95 every transaction, that adds up to a lot of money."

After the man left the hardware store, he purchased more gift cards with stolen credit card information at other retailers only to return to the original Lowe's the same day to repeat the act, Parks said. He was not arrested and is still a suspect, he added. Lowe's didn't respond to repeated requests for comment from CNBC.

While credit card theft and fraud isn't new, with the proliferation of tap-to-pay and growing use of retail apps, these digital thefts are shaping the next wave of organized retail crime and earning Chinese gangs as much as $1 billion annually, police said. Unlike typical retail theft operations — where criminals clear out shelves in big box stores and resell merchandise piece by piece on online marketplaces — the crimes can be carried out right under a store employee's nose or from a computer anywhere in the world.

"It's very low risk for the bad actors," said Scott Glenn, vice president of asset protection at The Home Depot . "It's not the same thing as walking into a Home Depot, filling up a cart full of power tools, and then walking out. It's just not as visible, it's not as obvious to what's happening out there and so it's become a more preferred method over the last several years."

Fraudsters have selected retailers as their targets because their platforms carry sensitive information such as stored credit cards and personal data but they do not have the same level of security as banks, according to industry experts and law enforcement.

There's no firm data on how much retailers are losing from digital forms of retail crime, but CNBC found around a dozen criminal cases across the country affecting a wide variety of retailers that police said involve a combination of organized groups and low-level fraudsters.

The cases are complex and often hard for local authorities to handle, said Capt. Matt Lawson of the Knox County Sheriff's Office in Tennessee, who said he's been investigating a fraud ring with ties to Chinese organized crime.

Unless the theft hits a certain dollar threshold or rises to the level of a federal crime, "it's kind of like they get away with it almost," he said.

Tap-to-pay fraud, which involves a fraudster adding a stolen credit card to their digital wallet and using it to buy gift cards or merchandise, often starts with a familiar text message and can end with an unwitting consumer's identity up for sale on platforms such as Telegram.

Fraudsters send out mass text messages warning about unpaid tolls, expiring car registrations or pending arrests that are designed to scare consumers into providing their credit card information, email credentials or other sensitive data. AI has only made the schemes easier, as crime groups can scale the scams more quickly and make the messages appear more legitimate, experts said.

"Once a fraudster has a person's email password and credit card, they can load that credit card into a device that they control," said Jeff Otto, the chief marketing officer of Riskified , a tech company that works with retailers including Macy's, Peloton and Prada to fight fraud.

"When the bank reaches out to say, 'Hey, is that you loading the card?' They've already got access to the victim's email" and can often check it for a one-time passcode before the consumer notices, he said.

Low-level opportunists engaging in tap-to-pay schemes can operate independently, using the practice to either buy merchandise or purchase gift cards and resell them at a discount for cash.

But on the Chinese organized crime level, the practice involves an entire criminal network, Parks said. In order to get profits back to China, crime groups use tap-to-pay fraud to buy gift cards and then use those gift cards to purchase high-value goods that can be resold at a premium in China, such as iPhones with American settings, Parks said. The practice allows gangs to skirt strict banking laws both in the U.S. and China and convert higher amounts of cash into the legitimate economy.