Burden of woof

At first glance, the Get Wuffy site looked polished and credible. But in today’s increasingly advanced scam landscape, that’s table stakes. Because many shoppers pick up on clues like sketchy checkouts or multiple one-star ratings, scammers try to earn their trust by investing considerable time in building a convincing website and seeding it with fake reviews. Get Wuffy was also backed by what appeared to be generous amounts of AI-generated advertising across various platforms.

The faux retailer compounded that deception with sophisticated commerce tactics. Even if the claims sounded too good to be true, the low price made it seem worth the gamble (and not worth disputing once the jig was up). Upsell offers on the checkout page incentivized buying more than one pup. 

Shortly after Kanwal ran a test transaction on the site using a gift card with insufficient funds, he received a follow-up email prompting him to try again —  the response you’d expect from a legitimate online retailer.

“It feels bad to say this about a scammer, but the customer experience was awesome,” Kanwal says. “It showed us how much of the scam journey may happen before you click 'pay.'” 

The product did arrive, which can make the transaction harder to challenge, But Wuffy bore little resemblance to the AI-powered puppy advertised online. It was a run-of-the-mill, battery-operated mechanical toy. The dog exhibited no AI-driven behavior, no touch responsiveness, no voice interaction, no changes in facial expression. Wuffy was about as technologically advanced — and only marginally cuddlier — than an electric can opener.

That was the first hard evidence that something was amiss. But there was much more to come.

“Behind the scenes, what the consumer couldn’t see was how weird the data looked,” says Mark Soares, a senior investigator in Mastercard’s Franchise Global Rules Investigation Program, or GRIP, who was part of the Get Wuffy squad.

Because scammers must fool multiple targets over months or even years, they leave more traces for investigators to follow. With its breadth of expertise, the working group at Mastercard made sense of the scattered clues.

For example, in the payment record, the merchant appeared under the name of a company headquartered in Lithuania, whereas the website listed a U.S. address. When Mastercard data scientists examined Get Wuffy’s cyber footprint, they uncovered 250 other online storefronts with the same owner, selling hearing aids, portable heaters, anti-snoring devices and even, ironically, credit card security products. The websites were carbon copies of each other: nearly identical code, look and feel, and with every product rated 4.7 stars and discounted 70% for a supposedly “limited time” that never seemed to end.

A Mastercard analysis of its own network activity showed $50 million in transactions associated with merchant IDs identified through the investigation, so the full scale of the operation was likely larger.

“If disputes and chargebacks are getting too high on one website, the scammers shut it down and focus on driving sales through another.," Soares explains. "Their goal is to continue the deception for as long as they can. At times it can resemble a game of Whack -A-Mole,” Soares explains.

That highlights yet another layer of the scam. Before any shopper visits the site, the fraudster must build trust with the user's bank in order to accept online payments as a seemingly legitimate merchant. To pass identity verifications and risk assessments required by the merchant banks, called acquirers, many scammers come armed with top-notch cybersecurity and legitimate business registration documents. But they also have to stand up to ongoing scrutiny, as banks can pull the plug on these merchant accounts at any time if suspicious activity comes to light.

When a merchant’s behavior starts to raise concerns, the Franchise GRIP team investigates, gathers evidence and shares it with the acquirers, which then decide what action to take, including severing their relationship with the merchant. After the GRIP team did a deep dive into Get Wuffy’s enablers, Soares and his colleagues presented the evidence of the scam merchant to the acquirer, which terminated the relationship and added the scam merchant to  MATCH Pro, Mastercard’s database of merchants terminated for specific causes, including fraudulent activity.

“Every fraud environment is an adversarial one, and with each rule introduced by payment networks, adversaries learn to adapt to skate just outside the line,” says Cathal Smyth, Mastercard’s director of cyber analytics. “But eventually, the signals start to add up. If we look hard enough, we can find the threads that tie it all together.”

In the wake of this success, Kanwal and his colleagues are accelerating the company’s coordinated global approach to disrupting scams. Their goal is to capitalize on the working group’s holistic view to disrupt every stage of the criminal enterprise: improving the detection of scam payments; helping acquirers identify and reject more fraudsters before money changes hands;  and encouraging victims to report deceitful merchants after the fact.

The same principle extends across the broader fight against scams. When intelligence is shared across the ecosystem, financial institutions can gain more context to identify suspicious activity earlier, whether that risk emerges through a merchant, a payment or the account receiving the funds.

"For too long, the onus on scam prevention has been placed largely on consumers,” says Ann Johnson, who leads Mastercard’s Security Solutions business. “The bigger opportunity is for the ecosystem to work together to protect consumers from scams, through better intelligence, stronger safeguards or earlier intervention.”

And what became of Wuffy, the little robotic dog who started it all?

“It’s still at my house,” Kanwal says. “My wife is not happy about it.”