It all starts with fake advertisements on a reputable marketplace, offering an educational game (story box) called MERLIN at a slightly discounted price compared to the competition. The buyer, enticed, places an order. But behind this transaction lies a well-oiled mechanism: the fraudster uses the customer’s details and a stolen bank card to purchase the product from a legitimate retailer – one of our partners specialising in childcare products.

The result: the customer receives their product, convinced they have got a good deal. But the retailer faces a bank dispute and will never be paid.

Rapid detection, immediate response

Thanks to a sudden spike in sales of this product, our models detected an anomaly: our analysts were immediately alerted. Expert rules were put in place for our teams in less than four hours! Less than 12 hours after detection, the network was neutralised. This efficiency is based on the synergy between our Data department and our Investigations unit.

• Investigators analysed weak signals to reconstruct the modus operandi.
• Data analysts transformed these insights into enhanced security rules capable of blocking future attempts and monitoring network developments.

In-depth investigation: knowing your enemy

The story does not end there. Our experts continued their investigation to gain an in-depth understanding of how the network operated:

• Four ‘professional’ shops were identified on the marketplace, all registered under different company names – identity theft.
• Active since March 2024, they generated hundreds of orders, exclusively for educational games.
• The fraud network manipulated the platform’s algorithms to push his products to the top of search results, notably by offering lower prices than others.

The result: a few hundred pounds in damages, but thousands of pounds in fraud prevented. Enhanced security rules, seasoned investigators, and fraudulent shops closed. A healthier marketplace.

The return of the Merlin network

In February 2025, the network returned, more cunning than ever. This time, it targeted two other partners via a new marketplace, with different products: small electrical appliances. The cat-and-mouse game lasted until May 2025, with the opening of fake shops, changes in products and targeted retailers.

This new round required:

• Constant monitoring,
• Regular updates to security rules,
• Ongoing training for our investigators,
• And above all, close collaboration with our merchant partners, who are fully committed to this fight.

How can you protect yourself against triangular fraud?

Here are the key levers for anticipating and blocking this type of fraud:

1. User awareness: Inform buyers and sellers about warning signs: prices that are too low, suspicious contacts, unusual payment requests.
2. Identity verification: Strengthen controls on platforms: supporting documents, cross-checks, etc.
3. Transaction monitoring: Implement analysis tools to detect abnormal behaviour and weak signals.

Triangular fraud is a growing threat. But with the right tools, constant vigilance and active collaboration between all e-commerce players, it can be effectively contained.

The post MERLIN Network: the comeback! appeared first on Oneytrust.