Diving Beyond Boosters into Organized Retail Crime Rings
When someone steals the entire skincare section at CVS, what do they do with all the product?
That question was on my mind after watching a video message from a friend, who had just witnessed a man walk into the CVS in our Washington, D.C., neighborhood, sweep an entire shelf of skincare products into a large sack, and walk out the door. Maybe he had a serious skincare routine. Or those products were a gift for someone he knew. But more likely, he was a booster stealing specific merchandise for a fence to move through the murky organized retail supply chain.
Boosters’ thefts are often the most visible aspect of this illicit economy, even going viral in the past few years as they become more blatant in their attempts to steal everything from moisturizer to power tools to laundry detergent to beef.
In Washington, D.C., retailers lose an estimated $108 million each year from theft, according to analysis from Capital One. That number includes both shoplifting and organized retail crime (ORC) thefts, and it is just a small part of a larger issue. The U.S. Chamber of Commerce estimates that ORC contributes to $125.7 billion in annual losses in the United States—including more than $68 billion from stolen goods.
And while these stolen goods might resurface for sale in the very community they were snatched from, there’s also a chance they’ll be shipped across the country or over an international border to eventually make their way into the legitimate economy.
How it Works
Just like a legitimate business, an organized theft group (OTG) has a structural hierarchy and is selling goods for economic gain. Unlike a legitimate business, however, OTGs steal the goods they sell. How they steal the goods falls into three general categories: ORC, cargo theft, and other activities.
To clarify, ORC is not shoplifting. It’s when two or more people are “engaged in illegally obtaining items of value from retail establishments, through theft and/or fraud as part of a criminal enterprise,” according to the U.S. Department of Homeland Security’s Homeland Security Investigations (HSI) unit. The unit is responsible for investigating transnational crime and threats, focused specifically on criminal organizations that exploit the global infrastructure through which international trade, travel, and finance move.
HSI recently published a whitepaper with ACAMS, an association for anti-financial crime professionals, on how to identify ORC and OTG activity.
The whitepaper outlines the hierarchy of roles in ORC, including:
- Boosters
- Crew Bosses
- Fencers
- Diverters
- Cleaners
- Professional Money Launderers
- ORChestrators
At the bottom of this enterprise are the boosters—who recent HSI cases found that in the United States are sometimes undocumented immigrants that have been labor trafficked into the country and are working as boosters to pay off debts.
There are three levels of boosters:
- Level One: Local theft boosters
- Level Two: Same state or neighboring state boosters
- Level Three: National theft boosters who travel often and sell only to wholesalers
Crew bosses send boosters lists of merchandise to steal from retailers and pay the boosters in cash or through anonymous payment apps. Who do they get their lists from? The fencers.
Fencers may have warehouses or a wholesale front company that they sell the stolen merchandise through, as well as listings on e-commerce and peer-to-peer sites (Craigslist, Facebook Marketplace, and more). Some sophisticated fencers may sell their products to a diverter, a higher-level wholesaler or coordinator for secondary sales. Diverters often look like legitimate businesses because they operate openly, providing supplies for mid-size retail chains who need to stock their shelves.
Working hand-in-hand with diverters and fencers are the cleaners, individuals who make sure stolen goods don’t have indications that they were acquired through theft—such as removing anti-theft stickers and devices. Cleaners work at repackaging facilities where they create counterfeit lot numbers, packaging, and even shipping labels to make products look legitimate. Once a product is cleaned, the cleaner will ship it to a diverter for sale.
A lot of money is changing hands through this whole process, which is where a professional money launderer comes in to disguise the illicit activity that’s going on. They might set up shell companies—maybe some car washes—to move the money through and have relationships with the person likely at the helm of the enterprise: the ORChestrator.
ORChestrators might be supervising multiple OTGs or even own stores that sell stolen merchandise. They can also be part of larger syndicates involved in other criminal activity and use the proceeds from ORC to fund drug and weapons trafficking, and even terrorism, according to HSI’s research with ACAMS.
ORC in Action
Now that we’ve established the roles, here’s how this works in practice based on an Oklahoma ORC that was dismantled last year.
Linda Ann Been of Tulsa, Oklahoma, met someone in 2016 who introduced her to the practice of purchasing and reselling stolen merchandise acquired from boosters. Been, according to an unsealed indictment (United States v. Abel, No. 4:21-cr-00493-GKF), then started a similar practice, working with boosters to steal products from local retailers—including Costco, CVS, GNC, Sam’s Club, Walgreens, and Walmart.
To steal the products, boosters were instructed to use box stuffing methods—where higher value items like allergy medicine are hidden within a larger, lower value item box, and the booster only pays for the lower cost product. Been helped cover boosters’ travel, and she even fronted their bond when they were arrested so they could keep boosting for her.
ORC contributes to $125.7 billion in annual losses in the United States.
Once the stolen goods were acquired, boosters delivered them to Cleveland, Sand Springs, and Tulsa, Oklahoma. They were then bulk shipped to other regional fencing operations in the eastern United States or sold online using eBay or Amazon to domestic and international customers. Payments were made through CashApp, PayPal, Venmo, and even drug transfers.
This scheme netted more than $4.5 million in sales of stolen retail goods before a pharmacy retailer in Tulsa shared information with law enforcement in 2019 about bulk thefts at their locations. HSI began investigating, and in January 2022 Been was arrested and 29 other individuals were charged for their alleged involvement in the scheme.
Been pled guilty in July 2022 to conspiracy, wire fraud, conspiracy to commit wire fraud, conspiracy to commit money laundering, and charges relating to engaging in monetary transactions in property derived from specified unlawful activity, according to a U.S. Department of Justice press release.
Changing Tactics
While Been’s case is a recent example, ORC is not a new trend. Keith Aubele, CPP, CSO of Salient Systems, says his first encounter with ORC was in the 1980s when he was working as a district loss prevention supervisor to track groups that were stealing beauty, electronic, and health products using a much more limited toolset than we have available today.
One of the initial tactics they used to track thefts was marking items with store numbers, so if an item was taken from one Walmart and returned at another it would initiate a conversation or potential investigation. Aubele and his team also began to see instances of ORC groups stealing product, repackaging it, and selling it to smaller stores for a profit.
“We had to develop those processes ourselves. We started a recovery team—that was the first ORC recovery team that anyone was aware of,” Aubele recalls. “We had about 25 people on the ROC recovery team, and our mission was to delve in and try to figure out the connectivity, the vulnerabilities, and work with our government relations team to put a stop to the ORC trend.”
After building out an ORC team and investigation lab at The Home Depot in the early 2000s, Aubele says he brought in then CEO of eBay, Meg Whitman, to take a tour and learn about the threat of ORC—including how products stolen from retailers were being sold on eBay. Aubele says it was an “eye-opening experience,” and it ultimately led eBay to be the first peer-to-peer retailer to require verification checks for sellers to limit ORC groups’ activity on the site.
Today, boosters steal a median of $5,000 in merchandise before they’re arrested, according to the Organized Retail Crime Report from the National Retail Federation (NRF) and K2 Integrity published in April 2023. Boosters learn how to steal goods based on firsthand experience, as well as information available online—including on social media.
“The popular surface Web discussion site Reddit hosts several user-run communities dedicated to discussions of retail crime tactics and best practices,” according to the report. “As of November 2022, a subcommunity on Reddit contained discussions about retail theft best practices, retail loss prevention strategies, and tips on the circumvention of anti-theft technologies.”
Reddit did not immediately respond to Security Technology’s request for comment for this story. As of press time, however, the subcommunity mentioned in the NRF report was still active.
On average, the fencers that boosters work for handle about $250,000 in stolen merchandise before law enforcement catches them, and they also rely on online marketplaces as a resale channel for their goods. Approximately 45 percent of ORC groups that the NRF studied used online marketplaces for resale.
“The large number of legitimate sellers on popular online marketplaces provides greater anonymity and better cover for action to resell ORC goods compared with physical retail venues, which involve face-to-face interactions with customers who may recognize the illicit origin of goods,” according to the NRF report.
This differs from how ORC groups used to move products, says Khris Hamlin, vice president of loss prevention at the Retail Industry Leaders Association (RILA).
His first encounter with ORC was while working as an asset protection manager for a store in Baltimore, Maryland. A local woman ran an ORC group that would enter stores, grab designer clothes, rip off their security tags, and flee the store with the merchandise. The group targeted stores in the Baltimore area before progressing south into Washington, D.C. Hamlin says he worked with law enforcement to track down the leader of the group, who was running a fence out of her home to sell the stolen goods to the community.
Boosters steal a median of $5,000 in merchandise before they’re arrested.
“Fast-forward to today, and nobody is setting up those home shopping areas anymore,” Hamlin says. “We have third-party marketplaces where individuals remain anonymous, pick those stolen goods up, and sell them anonymously to anywhere.”
And groups are also no longer just targeting designer and luxury items. They are stealing household staples like laundry detergent, allergy medicine, skincare items, and beauty products, which they can move quickly to turn a profit since people buy them regularly.
“There are ORC incidents happening in luxury goods and high-value merchandise from department stores, but we’re also seeing much wider groups of products targeted—where even going to your local pharmacy and grocer, the toothpaste and low-priced health and beauty care are under lock and key,” says David Johnston, vice president of asset protection and retail operations for NRF.
Retailers Push Back
In its 2023 security survey published September 2023, the NRF found that 78.1 percent of retailers are making responding to ORC more of a priority than they were one year ago—especially as theft accounts for 65 percent of their shrink, representing $112.1 billion in losses in 2022 (a jump from $93.9 billion in 2021).
“Repeat offenders are an ongoing concern: 70 percent of respondents reported an increase in theft from repeat offenders, with 61 percent seeing an increase in financial loss and 53 percent seeing an increase in violence from this group of thieves,” the survey assessed.
To address ORC in stores, 48 percent of retailers are increasing their funding for loss prevention and security equipment, including for video surveillance systems, locking cases and boxes, exception-based reporting systems, loss prevention staffing, off-duty police officers, and training for employees.
Retailers are also considering when—and how—they remain open in some locations. For instance, Hamlin says there’s a new trend of retailers closing earlier to limit evening hours, reducing the number of entrances and exits into stores to limit escape points for boosters, and placing armed guards at entries to deter ORC activity.
And NRF members are assessing how they can provide support to employees who are working when ORC thefts occur in their store—especially as some of these incidents become more violent—Johnston adds.
“Retailers are looking holistically at what they need to do to train employees, keep them safe across these events, and how to monitor and check-in on the wellbeing of their employees,” he says. “There have been conversations with retailers that this is a traumatic event—like an active shooter—but we also have to look at how the repeated event of how shoplifting wears down employees’ positivity, and retailers’ opportunities to hire and retain staff.”
Retailers are also exploring other technology solutions to address ORC concerns. Tools on the table for retail research teams’ consideration include artificial intelligence-based ecommerce fraud detection analysis (37 percent), body-worn cameras for employees or loss prevention personnel (35 percent), radio-frequency identification (RFID, 33 percent) for inventory tracking, and facial recognition or feature-matching technology (40 percent). Of those assessing RFID technologies, 39 percent are testing RFID identification tagging and 31 percent are researching RFID for benefit denial capabilities.
In the Washington, D.C. area, for instance, my local Target store has moved several aisles of hygiene and home cleaning supplies (like laundry detergent) into locked cases that a sales associate must unlock to let a customer purchase a product. At my CVS, a sensor now triggers an announcement when I walk into the beauty section to alert me that employees are aware I’m in the section and to request if I need assistance. And in the shared parking lot for grocer Giant and Home Depot, a mobile surveillance unit has been set up to monitor the area while classical music is being played over a sound system to deter loitering.
New Tactics Emerge
While these measures might prevent ORC groups from stealing merchandise within the store, it could further push these groups to engage in bulk thefts of products before they make it to the marketplace.
One recent example of this trend was a theft ring that was targeting meatpacking plants in six U.S. states. The group, based out of Miami, was potentially connected to 45 thefts of semitrailers full of frozen beef worth approximately $9 million. What they planned to do with all that beef remains unknown, but the joint investigation between the Lancaster County Sheriff’s Office in Nebraska and HSI was successful in ending the operation and arresting three suspects involved in the scheme.
This heist stood out to Raul Aguilar, deputy assistant director for the Countering Transnational Organized Crime, Financial, and Fraud Division for HSI, not just because of the product that was targeted but because it reinforced how important understanding opportunity and partnership intervention is.
“That one really surprised me in the sense that if there’s an opportunity to steal, or to fraudulently obtain, or to work through a criminal network to defraud, the criminals are going to do it,” Aguilar says. “When we were made aware of that case, it just really reminded me that we in law enforcement have to be active in working together because without the interagency cooperation, and without sharing information, some of those cases can go on for years, and the losses can get into the hundreds of millions of dollars.”
48 percent of retailers are increasing their funding for loss prevention and security equipment.
One example of this is Operation King of Thieves, which was operational from before 2015 through 2021 and ultimately resulted in revenue losses of approximately $30 million for retailers and $134 million for insurance and government programs.
The operation, as detailed in the HSI and ACAMS report, was comprised of individuals with family and business ties to Palestine and Egypt. They operated wholesale, trading, and distribution companies, and hired boosters to steal merchandise from U.S. retailers as part of their business.
The boosters would steal health and beauty supplies—especially diabetic strips since the ORChestrator owned and operated several pharmacies. The boosters would sell their stolen merchandise to fencers, who might clean the items and then send them to a diverter, who might use a shell or front company to ship the item to retailers, wholesalers, or e-commerce platforms.
“The fencers would provide the ORChestrator with the stolen diabetic strips instead of cash, and the ORChestator and fencer would split the profits 50/50,” according to the report. “The ORChestrator would send the test strips to his pharmacies to be dispensed to unsuspecting customers. The ORChestrator would bill the healthcare companies for the test strips that were dispensed. This ‘cleaned’ the money.”
In a major investigation, HSI worked with the U.S. Food and Drug Administration Office of Criminal Investigations, the U.S. Department of Health and Human Services Office of Inspector General, the FBI, and state and local law enforcement agencies to bring down the operation. They made 24 criminal arrests and seized approximately $8 million.
Cracking Down
As losses from ORC rise and the groups continue to operate, it’s becoming increasingly apparent to retail stakeholders that more needs to be done beyond installing security technology in stores.
One of the first steps involves addressing the online marketplaces where ORC merchandise is being sold. As previously mentioned, roughly 45 percent of ORC groups in the NRF’s database used online marketplaces for their resale operations. There also appears to be a shift away from third-party online sellers to peer-to-peer sites, with Craigslist and Facebook Marketplace being the most popular, according to the NRF report.
Craigslist did not return Security Technology’s request for comment for this article. But Meta—which owns Facebook—did respond when asked how the company was working to address ORC groups' use of its platform.
A Meta spokesperson shared via email that Facebook Marketplace’s commerce policy prohibits using the platform to sell stolen items. The company also has a commerce review system, which uses an automated system designed by human teams to proactively detect stolen goods listings or reactively review reports from Facebook users about stolen merchandise.
“Additionally, as part of our efforts to continue to invest in promoting authentic connections by reducing fraudulent activity and making it easier for people to identify trustworthy activities across our technologies, we rolled out business verification for shops and sellers that meet a certain threshold on Marketplace,” the spokesperson says.
The verifications include providing business names, tax ID numbers, customer support emails and phone numbers, and in some cases, business documents to confirm that data, based on information in Meta’s Business Help Center.
These new measures are now required for online marketplaces since the United States enacted the INFORM Consumers Act on 27 June 2023. The new requirements include mandates for online marketplaces where “high-volume third-party sellers” provide new or unused consumer products to collect, verify, and disclose information about those sellers. These high-volume sellers are generally defined as sellers with 200 or more individual sales or sales that gross $5,000 or more in revenue in a continuous 12-month period.
The law also requires online marketplaces to provide users with the ability to report suspicious conduct about high-volume third-party sellers. Violations could result in penalties of $50,120 per violation, according to the U.S. Federal Trade Commission (FTC).
Since the law is new, it’s difficult to say what impact it has had so far, but Hamlin says that RILA is closely watching enforcement—especially to understand what happens when a third-party seller is shut down. Johnston at the NRF, however, adds that the INFORM Act will help create stronger partnerships with law enforcement investigating ORC.
Some U.S. states are also reassessing how they address property crime and felony thresholds for theft, Johnston says. Analysis from the NRF’s Security Survey, for instance, found that 72 percent of retailers noticed the average value per incident of ORC increased in areas where felony thresholds for theft were raised; 67 percent of retailers also reported an increase in repeat ORC offenders in places that had reduced or eliminated cash bail.
Consequently, 93 percent of surveyed retailers said they were in support of U.S. federal ORC legislation to increase penalties for the criminal activity, to address the interstate nature of the crime, and to deter or prevent future ORC.
And it’s not just an American problem. Johnston says retail advocacy counterparts in Australia, Canada, and the United Kingdom have noted they are also seeing an uptick in retail theft involving ORC.
“There is a global component to the merchandise that is being stolen—or funds being converted from merchandise—that’s being diverted across borders,” Johnston adds. “HSI has worked several cases where ORC groups are taking those goods and money into other countries—or even bringing in immigrants as boosters to shoplift.”
This is why Johnston says the NRF has been advocating for passage of the Combating Organized Retail Crime bill, which has bipartisan support in both the U.S. House of Representatives and the U.S. Senate. The bill would create a joint federal organization with state and local law enforcement to engage with retailers to share information, coordinate investigations, and make sure agencies have resources to support those investigations. It would also designate HSI as the lead agency for ORC.
While the Judiciary Committees in the U.S. Congress consider the bill, HSI is continuing its work on OTGs and ORC through its “Operation Boiling Point,” which was stood up in October 2022 and has worked on more than 250 cases. HSI has 30 Special Agent in Charge Offices across the United States, as well as task force officers and investigators stationed overseas in 80 countries.
One foreign office is located in Hong Kong, which allows HSI to bring different resources to bear to address the international nature of ORC, such as when goods stolen from U.S. retailers are then shipped overseas for resale.
For example, a recent HSI investigation was focused on a group operating in Dallas, Texas, that stole 100,000 cell phones. That group could potentially ship those phones using a real freight forwarder to Asia, such as through a port in Hong Kong, for resale.
67 percent of retailers also reported an increase in repeat ORC offenders in places that had reduced or eliminated cash bail.
Another crime trend involved OTGs stealing cars and placing the vehicles in shipping containers to be sent out of the United States through East Coast seaports. In early September, for instance, Customs and Border Patrol officers seized $428,000 worth of stolen vehicles at the Port of Baltimore.
“These are high-value stolen vehicles that are either stolen from actual auto centers or lots, or individuals getting their car stolen,” Aguilar adds. “The whole point about it is to make money. Selling the vehicles, putting that money back into the financial flows.”
Then it’s up to teams of investigators to find out exactly what those financial flows are being used for—whether its to continue ORC operations or fund other criminal enterprises.
“We’ll find the breadcrumb that they leave, and we’ll continue to piece those pieces together, utilizing our engagement with the banks, our engagement with our innovation center…and bring all our resources to bear to try to connect those dots and really hold people accountable,” Aguilar says.
In the ramp-up with Operation Boiling Point, Aguilar explains that the operation has used a multi-pillar approach to increase partnerships with retail stakeholders, share actionable leads from its National Lead Development Center with stakeholders, dismantling and disrupting OTGs, and sharing information with the public about the threat of OTGs and ORC.
The success of the operation so far is evident in the cases that HSI has partnered with other investigators and retailers on. For instance, Aguilar mentions an operation out of Houston, Texas, where an OTG was using boosters trafficked from Central America to steal pharmaceutical products from multiple retailers. The stolen merchandise was then sold on a website for a fake business that was established to launder the profits. The scheme caused an estimated $134 million in losses for the companies involved.
Cases like the one described above demonstrate how important it is for investigators to be able to share information with each other. Aguilar points in particular to the National Targeting Center in Washington, D.C., where HSI agents and analysts work with other factions of DHS to analyze data on container shipments traveling around the world.
“Having done this for 25 years, I think the hardest part about law enforcement is understanding that the case that you may have, or a piece of evidence that you’re following, or a subpoena that you’ve submitted is probably already connected to something else,” Aguilar adds.
Making these connection points takes time, especially when looking beyond the booster who is the most visible component of the process, Johnston says.
“The shoplifting is the visible offender we see. But when we talk about ORC, it takes time to determine, to investigate, the person who is doing the shoplifting for an organized network and is not operating on their own,” he explains. “But getting from there, to identifying where and how the merchandise is being fenced and resold can be a lengthy process.”
“Retailers are taking action—they always have,” he continues. “But we are far beyond a retail only solution. It’s going to take partnership with law enforcement, and the need of prosecutors and legislators to treat these criminals as criminals. It’s not the opportunistic shoplifter that retailers are concerned about. It’s about the shoplifters repeatedly going into stores, and gangs and groups that have taken to retail theft because its safer and has less consequences.”
Megan Gates is editor-in-chief of Security Technology and senior editor of Security Management. Connect with her at [email protected] or on LinkedIn. Follow her on X or Threads: @mgngates.
