Amazon paid $4 million to a Telegram storefront that sold refunds like a subscription

The claim arrived the way they all arrive. A customer wrote in to say the package had come empty. Just the box. The graphics card, a PowerColor AMD Radeon RX 7900 XT, worth just over two thousand dollars, was not inside. There was a police report attached. The report looked correct. The customer service representative had seen hundreds of these. She processed the refund.

Somewhere else, the card sat on a shelf.

That transaction, or one exactly like it, happened enough times between February 2023 and the date Amazon filed its lawsuit that the documented total crossed four million dollars. Not four million in merchandise at retail markup. Four million dollars in cash refunds, paid out by Amazon, for products that were never returned. Products that, according to the lawsuit Amazon filed in Washington state District Court, were never missing in the first place.

The group allegedly running this was called RBK.

---

I. THE SERVICE WINDOW

RBK was not subtle about what it was selling.

The operation ran through Telegram, the encrypted messaging app that has become, over the past several years, the preferred infrastructure for organized fraud of this kind. Telegram channels require no identity verification to join. Messages can be set to auto-delete. The audience can be anyone who finds the link. For RBK, according to Amazon's complaint, the audience grew to more than a thousand subscribers.

What those subscribers were buying was access to a storefront. Not a storefront selling goods. A storefront selling a service: the ability to file a fraudulent refund claim against Amazon and collect the money while keeping the product.

The pricing was straightforward. Amazon's complaint alleges RBK charged between 15 and 30 percent of the item's purchase price for a successful claim. You bought a laptop. You filed an empty-box complaint. RBK handled the paperwork. You kept the laptop. You paid RBK a cut. The remainder was yours.

The service had reviews. That is the detail worth sitting with. According to the complaint, the RBK Telegram channel accumulated more than 2,100 "vouches," which is the term used in these circles for posted testimonials of successful frauds. Each vouch was a customer confirming the transaction worked. Proof of concept, publicly displayed, on a platform with a thousand subscribers watching.

Think about what that required. Not just the fraudulent claims themselves. But a customer base comfortable enough with what they were doing to post about it afterward. A market that had normalized the transaction. A storefront with a better review system than some legitimate businesses.

---

II. THE GOODS

The items RBK allegedly targeted were not random.

PowerColor AMD Radeon RX 7900 XT graphics cards. Cards used to build or upgrade high-performance computers, and valued at more than two thousand dollars each. Dell gaming laptops. Apple MacBook Pro laptops. Drones.

These items share a profile. High unit value. Easy to resell secondhand. Common enough that a customer service representative reviewing a claim has no particular reason to flag the product category. A two-thousand-dollar graphics card is a legitimate purchase on Amazon. The claim that it arrived in an empty box is, on its face, a legitimate complaint.

That is the exploit. Not a technical hack. Not a breach of a database. The exploit was the intersection of high value, plausible deniability, and a customer service system designed to resolve complaints quickly and without friction.

The complaint alleges RBK used fake police reports to support the claims. A customer service representative receives a refund request. It includes documentation. The documentation looks official. The representative has no practical way to verify the report's authenticity in the moment. She processes the refund.

Amazon's Scott Knapp, vice president of worldwide buyer risk prevention, has described refund fraud operations like this one as functioning like criminal enterprises. That framing is accurate in a specific sense: these operations have infrastructure, pricing models, quality control in the form of public reviews, and customer retention. The word "enterprise" is not hyperbole. It is a description of the org chart.

---

III. THE INVESTIGATION

At some point, Amazon's Customer Protection and Enforcement Team put an investigator into the channel.

The investigator posed as a buyer. Purchased a fraudulent refund service from RBK. Documented the transaction. According to Amazon's complaint, the service worked as advertised. The storefront sold its product to an undercover customer without detecting anything unusual.

That detail matters not because it is surprising but because of what it confirms. RBK's operation had processed enough transactions that one more customer, one more vouch, one more percentage cut, did not register as unusual. The volume was the camouflage.

Amazon states it spent more than $75,000 conducting this investigation. The lawsuit names three defendants: Dias Temirbekul Zhumaniyaz, identified in the complaint as the alleged primary administrator and described as based in Kazakhstan; Michael Bauschelt; and Adnan Islam. The complaint also names up to 20 unidentified co-conspirators. Among them, Amazon alleges, are some of the company's own employees.

That last part is the hinge. The fake police reports and empty-box claims explain a portion of the losses. But any operation that repeatedly clears a customer service filter at scale, over more than two years, benefits from knowing exactly how that filter works. Amazon's complaint does not specify what role the alleged internal co-conspirators played. That question remains open. The lawsuit is active and the allegations are not adjudicated.

---

IV. THE PARALLEL MACHINE

RBK is not the first group Amazon has sued for this structure.

In 2023, Amazon filed a lawsuit against a group called REKK, which the company alleged ran a similar operation, securing fraudulent refunds through a combination of social engineering and, in some cases, bribing Amazon employees directly. The REKK lawsuit established a public template for what Amazon was willing to pursue and what the operation looked like structurally.

This week, the Department of Justice announced the sentencing of eleven co-conspirators involved in a separate operation called the Artemis Refund Group, or ARG, which allegedly targeted Amazon and other online retailers and generated millions in losses. Eleven people sentenced. One name. One week.

The industry numbers behind these individual cases are large enough to be almost meaningless as individual figures. In 2023, 13.7 percent of all retail returns were fraudulent, representing approximately $101 billion in losses across merchants. By 2024, that figure had risen to roughly $103 billion. Amazon is the largest single target because Amazon has the largest return volume. But Walmart, Target, and Dell have all been hit by variants of the same structure.

The structure is not complicated. A high-value item. A no-questions return policy designed to protect legitimate customers. A documentation process that cannot verify every claim. A Telegram channel to coordinate the buyers. A fee schedule. A review system.

The storefront is the machine. The machine does not require a technical genius to operate. It requires someone willing to run a fee-for-service fraud business in public, behind a screen, with reviews.

---

V. THE COST AND WHERE IT GOES

There is no single person whose savings account emptied the morning after RBK processed a claim.

That is the reason this kind of fraud persists at scale. The cost is real. Amazon documented more than four million dollars in fraudulent refunds from this one operation alone. But four million dollars spread across a company that processes billions of transactions is not a number anyone feels in a specific way on a specific morning. It becomes a line in a loss-prevention report. It becomes a reason to tighten the refund workflow, which makes things harder for the customer who genuinely received an empty box.

The person who pays is not obvious. But she is there.

She is the seller on Amazon's third-party marketplace whose algorithm ranking drops because her product has an elevated return rate. She is the customer who filed a legitimate damage claim and now waits longer because the verification process takes an extra step. She is paying for Prime, which funds the customer service operation that RBK treated as a revenue source.

The diffusion of cost is not accidental. It is a feature of the exploit, not a side effect. A fraud that concentrates damage creates a victim who calls a lawyer. A fraud that distributes damage creates a line item that gets absorbed.

---

VI. WHAT THE STOREFRONT LOOKED LIKE FROM THE OUTSIDE

Amazon's complaint is not the story of a secret operation.

RBK operated openly enough to accumulate a thousand subscribers and post more than two thousand testimonials on a public-facing Telegram channel. The pricing was listed. The service was described. The results were documented by the customers themselves.

This is the thing about the storefront as a model. It does not hide. It advertises. The concealment is not in the channel itself but in the assumption that no one is reading it who matters. That the gap between "this exists" and "this will be acted upon" is wide enough to run a business inside.

Amazon closed the gap by sending an investigator in as a customer. By the time that happened, the operation had allegedly been running for over two years.

Amazon is now seeking restitution, attorney fees, and a court order barring the defendants from using Telegram or Amazon's trademarks for similar purposes in the future.

The injunctive relief, the legal term for the court order that says "stop doing this," is the part of the filing that reads most honestly. Not because the other remedies are wrong, but because the injunction acknowledges the simplest truth about the machine.

You do not dismantle a storefront by suing one operator.

You close the window. You watch for the next one.

The window is already somewhere else.