{"id":77597,"date":"2026-01-26T05:04:19","date_gmt":"2026-01-26T05:04:19","guid":{"rendered":"https:\/\/dralysstore.com\/blog\/?p=77597"},"modified":"2026-01-26T05:04:19","modified_gmt":"2026-01-26T05:04:19","slug":"the-fraud-hiding-in-email-signups","status":"publish","type":"post","link":"https:\/\/dralysstore.com\/blog\/the-fraud-hiding-in-email-signups\/","title":{"rendered":"The Fraud Hiding in Email Signups"},"content":{"rendered":"<div>\n<p>Ecommerce merchants know the costs in time, revenue, and inventory of illicit chargebacks.<\/p>\n<p>For many sellers, however, the damage starts with new accounts. Organized fraudsters may sign up hundreds of times, employing valid but fake email addresses.<\/p>\n<p>\u201cThose fake accounts are being created for purposes like card testing with small-value transactions to see if the number is valid before attempting a bigger transaction,\u201d said Diarmuid Thoma, the head of fraud and data strategy at AtData, an email verification and validation service.<\/p>\n<h3>Chargebacks<\/h3>\n<p>The primary risk to ecommerce shops comes from <a href=\"https:\/\/www.practicalecommerce.com\/disputifier-founder-on-winning-chargebacks\" data-wpel-link=\"internal\" target=\"_blank\" rel=\"noopener\">chargebacks<\/a>.<\/p>\n<p>When a cardholder disputes a fraudulent transaction, the store loses the sale, the product, shipping costs, and often incurs additional fees from processors.<\/p>\n<p>Repeated disputes may even jeopardize the business\u2019s relationship with its payment processor.<\/p>\n<p>A seller can feel helpless, since the <a href=\"https:\/\/www.practicalecommerce.com\/visas-vamp-could-cost-banks-and-merchants\" data-wpel-link=\"internal\" target=\"_blank\" rel=\"noopener\">processor authorized<\/a> the transaction in the first place, but holds shops responsible for accepting stolen card numbers.<\/p>\n<p>Thoma and other email fraud experts believe fake email addresses are often where the problem begins.<\/p>\n<h3>Coupon Abuse<\/h3>\n<p>A second form of email-based fraud often shows up in ecommerce marketing data.<\/p>\n<p>Fraudsters use fake but valid email addresses to create accounts at scale to extract promotional value.<\/p>\n<p>Automated scripts submit thousands of signups, collect welcome discounts, and then abandon the accounts once the incentive is redeemed.<\/p>\n<p>\u201cA coupon has a monetary value, and when you do it at scale, it becomes a highly profitable business to use and resell,\u201d said Thoma.<\/p>\n<p>The losses from coupon abuse are massive, as much as $89 billion per year, depending on the source, and likely impacting most ecommerce businesses that offer promotional discounts.<\/p>\n<h3>Fake Accounts<\/h3>\n<p>Thus fake email addresses facilitate stolen payment card testing and promotion harvesting.<\/p>\n<p>This sort of behavior can be relatively difficult to detect, because \u201cabout 98% [of the email addresses used], even the fraudulent ones, will be valid,\u201d Thoma said, \u201cbecause the fraudster needs them to be valid\u201d to receive a coupon and complete a purchase.<\/p>\n<p>In other words, the earliest phase of this kind of ecommerce fraud often looks identical to that of well-meaning shoppers. By the time the first chargeback appears, the damage has existed for weeks.<\/p>\n<p>Conversely, it gives businesses a relatively simple defense: email validation.<\/p>\n<h3>Account Patterns<\/h3>\n<p>Creating fake accounts at scale starts with email addresses that follow recognizable patterns, allowing fraudsters to generate thousands of variations while bypassing basic validation checks.<\/p>\n<p>For example, here are three common patterns.<\/p>\n<p><strong>Tumbling,<\/strong> where a fraudster rewrites a single underlying address many times.<\/p>\n<ul>\n<li>example@example.com<\/li>\n<li>ex.ample@example.com<\/li>\n<li>e.x.ample@example.com<\/li>\n<li>ex.ample+new@example.com<\/li>\n<\/ul>\n<p>Small changes, such as added characters or formatting differences, allow each signup to appear unique while still routing messages to the same inbox.<\/p>\n<p>Tumbling is particularly effective at evading duplicate-account controls because every address passes standard validation.<\/p>\n<p><strong>Gibberish<\/strong>\u00a0emails are machine-generated addresses that appear random but follow consistent, automated structures.<\/p>\n<p>Bad actors create these accounts in large batches within seconds or minutes of each other. Thoma described seeing many gibberish emails arriving simultaneously, on the same day and time.<\/p>\n<p><strong>Enumeration<\/strong>\u00a0relies on generating large numbers of similar addresses, often based on a shared root. \u201cThey\u2019re like user1, user2, user3, not necessarily always in sequence,\u201d Thoma said. \u201cIt could skip to 10, 15, whatever.\u201d<\/p>\n<p>Such addresses are easy to create automatically and difficult to flag individually, especially when spread across time, domains, or merchants.<\/p>\n<h3>Identification<\/h3>\n<p>Each of these techniques produces valid, <a href=\"https:\/\/www.practicalecommerce.com\/how-spf-dkim-dmarc-drive-email-delivery-security\" data-wpel-link=\"internal\" target=\"_blank\" rel=\"noopener\">deliverable<\/a> email addresses, which is why basic validation often fails to stop them.<\/p>\n<p>Even monitoring for these patterns can produce false positives. The behavior of legitimate consumers may appear automated during sales events, product launches, or bulk onboarding.<\/p>\n<p>Hence pattern detection works best when combined with additional signals, such as account age, name consistency, geographic alignment, device behavior, and transaction history.<\/p>\n<p>The goal is not to block accounts based on a single indicator, but to isolate organized fraud before losses escalate into chargebacks.<\/p>\n<h3>Prevention<\/h3>\n<p>Fraud is often a matter of scale, which is good for very small ecommerce operations. Criminals aren\u2019t aware or see little potential in the theft.<\/p>\n<p>Large online retailers, however, may want to invest in advanced email validation at the time of submission. Validation at this phase typically costs pennies, and when combined with reasonable business rules, should reduce fraud.<\/p>\n<\/p><\/div>\n<p><\/p>\n<hr>\n<p><strong>Published by Dralys Blog \u2013 Stories | Insights | Innovation<\/strong><\/p>\n<p>Discover more on <a href=\"https:\/\/www.dralysstore.com\" target=\"_blank\">DralysStore.com<\/a><\/p>\n<div class=\"pld-like-dislike-wrap pld-template-2\">\r\n    <div class=\"pld-like-wrap  pld-common-wrap\">\r\n    <a href=\"javascript:void(0)\" class=\"pld-like-trigger pld-like-dislike-trigger  \" title=\"\" data-post-id=\"77597\" data-trigger-type=\"like\" data-restriction=\"no\" data-already-liked=\"0\">\r\n                        <i class=\"fas fa-heart\"><\/i>\r\n                <\/a>\r\n    <span class=\"pld-like-count-wrap pld-count-wrap\">    <\/span>\r\n<\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>Ecommerce merchants know the costs in time, revenue, and inventory of illicit chargebacks. For many&hellip;<\/p>\n","protected":false},"author":10,"featured_media":77598,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_lmt_disableupdate":"","_lmt_disable":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[38],"tags":[74,34,65,176,45,177,10],"class_list":["post-77597","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-e-commerce-shopping","tag-dralys","tag-e-commerce","tag-entrepreneurship","tag-ecosystem","tag-innovation","tag-smart-shopping","tag-technology"],"acf":[],"jetpack_featured_media_url":"https:\/\/dralysstore.com\/blog\/wp-content\/uploads\/2026\/01\/The-Fraud-Hiding-in-Email-Signups.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/posts\/77597","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/comments?post=77597"}],"version-history":[{"count":1,"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/posts\/77597\/revisions"}],"predecessor-version":[{"id":77599,"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/posts\/77597\/revisions\/77599"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/media\/77598"}],"wp:attachment":[{"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/media?parent=77597"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/categories?post=77597"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dralysstore.com\/blog\/wp-json\/wp\/v2\/tags?post=77597"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}