Idea: sealed box victim method 01-26-2023, 09:13 PM
#1
Not sure if this is already known in the SEing community but I just had an idea.
My understanding of the sealed box method is that you receive your product, take only the product out, then reseal and return the box with something of similar weight inside.
If this is successful, the product, at least in theory, goes back into their stock system and you're refunded, then someone who orders the same product could receive your product that you returned, with the actual product removed from his box.
My idea is this: pretend this is you: pretend you ordered something and in the box was a rock used to spoof the weight by a no-good social engineer that tricked the company you ordered from in the past. Their returned product ended up in your hands.
It would be impossible for the company to prove you're lying given the one viable means they have of doing this, the weight, has been accounted for by the imaginary social engineer. They could ask you to return it for them to see, but in this case you could either lost-in-transit box them, or just genuinely go find a rock and put it in the box, though I'd imagine most companies would just refund after hearing this story (perhaps after a brief "investigation")
The only downsides I can think of are that this would only work on products where the packaging doesn't show what's inside (for example, intel has some CPUs where the box shows the actual CPU) however if the company doesn't have CCTV or has negligent return-processing practices, these kinds of products could still be on the table.
I also suppose that the company, if their products are serialized, could check in their system to see if there has ever been a return on that product, but I doubt most companies are so meticulous with their tracking of products that they display the serial number on the outside of the box and note that serial number upon every order and return. And even if this is assumed to be a limitation, there are plenty of valuable products without serial numbers on their boxes.
What do you guys think, would this work? If so, any recommendations on companies/products to try this on?
My understanding of the sealed box method is that you receive your product, take only the product out, then reseal and return the box with something of similar weight inside.
If this is successful, the product, at least in theory, goes back into their stock system and you're refunded, then someone who orders the same product could receive your product that you returned, with the actual product removed from his box.
My idea is this: pretend this is you: pretend you ordered something and in the box was a rock used to spoof the weight by a no-good social engineer that tricked the company you ordered from in the past. Their returned product ended up in your hands.
It would be impossible for the company to prove you're lying given the one viable means they have of doing this, the weight, has been accounted for by the imaginary social engineer. They could ask you to return it for them to see, but in this case you could either lost-in-transit box them, or just genuinely go find a rock and put it in the box, though I'd imagine most companies would just refund after hearing this story (perhaps after a brief "investigation")
The only downsides I can think of are that this would only work on products where the packaging doesn't show what's inside (for example, intel has some CPUs where the box shows the actual CPU) however if the company doesn't have CCTV or has negligent return-processing practices, these kinds of products could still be on the table.
I also suppose that the company, if their products are serialized, could check in their system to see if there has ever been a return on that product, but I doubt most companies are so meticulous with their tracking of products that they display the serial number on the outside of the box and note that serial number upon every order and return. And even if this is assumed to be a limitation, there are plenty of valuable products without serial numbers on their boxes.
What do you guys think, would this work? If so, any recommendations on companies/products to try this on?
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
