+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Social Engineering (https://sinister.li/Forum-Social-Engineering)
+--- Thread: Idea: sealed box victim method (/Thread-Idea-sealed-box-victim-method)
Idea: sealed box victim method - GimmeBack - 01-26-2023
Not sure if this is already known in the SEing community but I just had an idea.
My understanding of the sealed box method is that you receive your product, take only the product out, then reseal and return the box with something of similar weight inside.
If this is successful, the product, at least in theory, goes back into their stock system and you're refunded, then someone who orders the same product could receive your product that you returned, with the actual product removed from his box.
My idea is this: pretend this is you: pretend you ordered something and in the box was a rock used to spoof the weight by a no-good social engineer that tricked the company you ordered from in the past. Their returned product ended up in your hands.
It would be impossible for the company to prove you're lying given the one viable means they have of doing this, the weight, has been accounted for by the imaginary social engineer. They could ask you to return it for them to see, but in this case you could either lost-in-transit box them, or just genuinely go find a rock and put it in the box, though I'd imagine most companies would just refund after hearing this story (perhaps after a brief "investigation")
The only downsides I can think of are that this would only work on products where the packaging doesn't show what's inside (for example, intel has some CPUs where the box shows the actual CPU) however if the company doesn't have CCTV or has negligent return-processing practices, these kinds of products could still be on the table.
I also suppose that the company, if their products are serialized, could check in their system to see if there has ever been a return on that product, but I doubt most companies are so meticulous with their tracking of products that they display the serial number on the outside of the box and note that serial number upon every order and return. And even if this is assumed to be a limitation, there are plenty of valuable products without serial numbers on their boxes.
What do you guys think, would this work? If so, any recommendations on companies/products to try this on?
RE: Idea: sealed box victim method - papken - 01-27-2023
been thinking about that, but what happens in situation when your item has no records of being returned by anyone in the past?
RE: Idea: sealed box victim method - mothered - 01-27-2023
You're overthinking the simplicity of the sealed box method.
Quote:the product, at least in theory, goes back into their stock system and you're refunded, then someone who orders the same product could receive your product that you returned, with the actual product removed from his box.Who's to say the buyer Isn't a social engineer claiming to have received a different product to the one purchased?
RE: Idea: sealed box victim method - EquitableEngineer - 01-27-2023
Thats a cool idea but I think you are correct about them keeping track of whether or not an item has been returned, i think if you tried this with a non returned item your chances would drop significantly but not to zero. Pure speculation of course. That said the sky is the limit when you have a well crafted plan and a lot of determination. Like you say, this is definitely something that they would have had to deal with in the past so your claim will not be an impossible one just improbable.
RE: Idea: sealed box victim method - mothered - 02-18-2023
@GimmeBack, did you end up pursuing an SE?
RE: Idea: sealed box victim method - Mertuminiv - 04-01-2023
I actually did this around last summer for some trading cards from Amazon, and I said that the boxes appeared to be tampered with and the cards were all open. All I had to do was return the box and add some random cards I had lying around in the box to make it believable. I got my refund when it was processed.
I would assume mileage may vary depending on the item.