Full Report
Scammers are using tools like MaisonReceipts to create fake receipts and exploit brands. Uncover how this growing fraud ecosystem works behind the scenes.
Analysis Summary
# Tool/Technique: MaisonReceipts
## Overview
MaisonReceipts is a Fraud-as-a-Service (FaaS) platform and automated tool designed to generate high-quality, fraudulent retail receipts. Its primary purpose is to facilitate various forms of retail fraud, including returning counterfeit items for full refunds, deceiving buyers in the secondary resale market, and bypassing brand protection measures. The tool lowered the barrier to entry for cybercrime by providing professional-grade templates for luxury brands and global retailers.
## Technical Details
- **Type:** Fraud-as-a-Service (FaaS) / Attack Tool
- **Platform:** Web-based (SaaS), Telegram, and Discord
- **Capabilities:** Template automation, customizable metadata (date, store location, payment method), barcode generation, and PDF output.
- **First Seen:** Active evidence noted in late 2023/early 2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566 - Phishing]**: Using fraudulent documents to deceive victims (retailers/buyers).
- **[TA0007 - Discovery]**
- **[T1589 - Gather Victim Identity Information]**: Researching legitimate store IDs and employee names to add realism to receipts.
- **[TA0042 - Resource Development]**
- **[T1588.002 - Obtain Capabilities: Tool]**: Acquiring access to specialized fraud tools like MaisonReceipts.
## Functionality
### Core Capabilities
- **Automated Generation:** Users input transaction data into a web interface or bot to receive a formatted receipt.
- **Multi-Brand Support:** Offers templates for a wide range of luxury fashion brands and consumer electronics retailers.
- **Customizable Fields:** Allows fraudsters to input specific store addresses, tax rates, transaction IDs, and currency types.
- **Graphic Fidelity:** Replicates specific fonts, logos, and layout structures used by legitimate point-of-sale (POS) systems.
### Advanced Features
- **Barcode/QR Code Generation:** Produces scannable codes that may point to simulated or copied transaction data to fool basic scanning checks.
- **Reseller Guides:** Distribution of manuals (e.g., via Scribd) that teach users how to effectively use the receipts for social engineering and physical fraud.
- **Omnichannel Support:** Integration with Discord and Telegram for customer support and community sharing of "successful" fraud techniques.
## Indicators of Compromise
### Network Indicators (Defanged)
- hxxps[://]maisonreceipts[.]cc/
- hxxps[://]maison[.]sellsn[.]io/
- hxxps[://]discord[.]com/invite/Maison
- hxxps[://]t[.]me/maisonreceipts
- hxxps[://]x[.]com/maisonreceipts
- hxxps[://]www[.]instagram[.]com/maisonreceipts
- hxxps[://]www[.]youtube[.]com/@maison.receipts
- hxxps[://]discord[.]com/invite/zwiftreceipts
- hxxps[://]discord[.]com/invite/hitreceipts
### Behavioral Indicators
- High volume of return requests for high-value items with receipts lacking valid internal database matches.
- Repeated use of identical transaction IDs or store employee names across different geographical locations.
- Presentation of digital receipts with anomalies in font spacing or metadata (e.g., incorrect tax calculations for a specific ZIP code).
## Associated Threat Actors
- **Maison Group / MaisonReceipts Operators:** The primary developers and service providers.
- **Secondary Market Scammers:** Lower-level actors who utilize these tools to sell counterfeit goods as authentic on platforms like eBay, Depop, or Vinted.
## Detection Methods
- **Metadata Analysis:** Checking PDF properties for creation tools (e.g., "Canvas," "ReportLab") that differ from official POS software.
- **Visual Discrepancy Analysis:** Identifying inconsistencies in branding, logo resolution, or grammatical errors.
- **Database Cross-Referencing:** Verifying the Transaction ID (TID) against the merchant's official Enterprise Resource Planning (ERP) or POS system.
## Mitigation Strategies
- **Verification at Point of Sale:** Implement real-time verification where employees must confirm the transaction in the system before processing returns.
- **Non-Paper Verification:** Encourage the use of digital loyalty programs or e-receipts tied to verified accounts.
- **Consumer Education:** Warning buyers on resale platforms to verify authenticity through third-party authentication services rather than relying on paper receipts.
## Related Tools/Techniques
- **ZwiftReceipts:** A similar fraud tool specializing in receipt generation.
- **HitReceipts:** A competing service within the same fraud ecosystem.
- **Refund-as-a-Service (RaaS):** A broader technique where professional "refunders" handle the entire social engineering process for a percentage of the fraud proceeds.