Security

New ‘Jamtaras’ shift focus to ecommerce, Bureau analysis of 70 million users reveals fraud networks

Bureau has released findings from an analysis of 70 million eCommerce users done over a period of 10 days. The study shows that organised fraud networks are now systematically targeting online marketplaces. What Jamtara exposed in banking, coordinated groups exploiting systems at scale, is now playing out across eCommerce.

Features designed to drive growth such as return policies, cashback offers, referral incentives, and Cash-on-Delivery (CoD) are increasingly being misused. The analysis shows that marketplace fraud today is structured, coordinated, and operating at scale.

Bureau saw an average of 1 in 6 risky devices having more than 10+ accounts associated with the same device, which is typically a sign of a “farm.” This was also consistent with signs of large-scale automation, where for instance, in some cases, a single account recorded 50+ instances of activity within just one hour. In total, 256 clusters were mapped, comprising ~45,000 accounts across just 9,000 devices.

At the core of these patterns is device farming. A device farm where multiple phones are operated together acts as the operational backbone of these fraud networks. It allows fraudsters to run and control dozens, sometimes hundreds, of accounts simultaneously, switching between them at speeds no individual user can match.

This infrastructure enables different levels of abuse. At the most visible layer, it is used to commit promo and referral abuse by creating multiple accounts to repeatedly claim incentives. But this is only the entry point. The more critical function of device farms is to systematically move across large volumes of accounts to identify which ones can be exploited further.

In effect, these systems “scan” or parse through accounts hopping rapidly from one to another to detect those with saved cards or linked wallets. These become the high-value targets for direct financial fraud. What appears to be simple incentive abuse is often a filtering mechanism to identify accounts that can be monetised.

The scale and automation behind this activity are evident in the behavioural patterns observed. The study surfaced strong location anomalies: in one case, an account logged in from Gujarat and Bengaluru within 30 minutes; in another, a single account was active across 70 locations, patterns consistent with automated account cycling, not human behaviour.

Commenting on the findings, Ranjan Reddy, Founder & CEO, Bureau, said, "Promo abuse isn't petty theft. It's industrialized. Fraud has evolved beyond stolen cards into coordinated, cross-platform operations. We have found device farms running thousands of fake accounts simultaneously across multiple platforms. Bureau's network intelligence sees these operations cross-platform because a fraud ring doesn't attack one app at a time.”

Promo and referral abuse remains widespread, with device farm activity particularly concentrated in Delhi, Bengaluru, and Noida. Some platforms recorded up to 15 times the typical share of users operating multiple accounts, indicating that incentive structures can directly influence fraud volume.

Return abuse is also systematic. Fraudsters order high-value goods and return counterfeits, empty packages, or reject deliveries altogether. Bureau’s models detect these patterns early using device, address, and behavioural signals often before a return is initiated.

Just 0.95% of users show anomalous behaviour, but this small group drives a disproportionate share of abuse. These actors operate in clusters, using multiple accounts, shared devices, and automation to exploit platform systems. “With 99% of users being genuine, blunt controls hurt growth. Platforms need continuous, device- and network-level intelligence to act on the risky 1% without disrupting the rest,” says Ranjan.

Bureau’s key strength lies in its network-level intelligence. Its device graph, a shared intelligence layer that maps device activity across its client base, spans 100+ enterprises across banking, fintech, eCommerce, insurance, and gaming, protecting nearly 300 million devices on a daily basis.

This enables early detection: when a fraud ring targets one platform, that intelligence can immediately be applied across the network.