If you've been reading this blog on a regular basis, you'd be well and truly Informed about the different types of methods used when social engineering online stores such as Currys, ASOS, SteelSeries, John Lewis, Zalando and so forth. This of course, relates to obtaining refunds or replacements for Items that you've either already purchased, or only have a serial number (that you grabbed from a seller online) that's still under warranty, thereby you'd SE the representative accordingly. Not all readers have had the pleasure of checking out my articles and moreover, there are many SE'ers who're looking to start their career In the art of exploiting the human firewall so before I begin with the objective of this tutorial, I'd like to explain what a "method" Is, and the purpose It serves with every social engineering attack vector.
Regardless of who you wish to social engineer, be It tricking an employee to hold the entry door open for you and gain access to a restricted building, or perhaps assuming the role of a customer service rep of a phone company to SE your victim for confidential Information, It's of paramount Importance to have a strategic plan prior to performing such actions. The same applies when SEing the aforementioned companies- you cannot do what I call a "blind SE", whereby you haven't researched your target, nor have any "preparation" whatsoever In place and expect It to work thereafter. The "preparation" Is In fact the "method" and without this, your SE has failed before It had the chance to begin!
Methods are the backbone of every SE, and play an Integral role In determining where It's heading and of greater Importance, they decide If the outcome will result In your favor. There are many to choose from, such as boxing, wrong Item received, partial method and a few more. Almost every one Is based against the nature of the Item, that Is, you cannot just use any method on any Item. For Instance, let's say you're planning to social engineer a pair of New Balance trainers that "weigh 860 grams", by using the "missing Item method". The trainers are too heavy, so If the company Investigates your claim, then your SE will fail.
So how do you effectively apply the "missing Item method" to maximize Its success? I'm glad you've asked because that's precisely the aim of this guide- to provide you with everything there Is to know about It, thus leave nothing to chance and no room for error. In addition to serving your needs, what's prompted me to write this article, Is that many users are finding the method rather difficult to grasp, namely how to calculate and Incorporate the Item/box weight Into the SE. Rest assured, I've got you covered but prior to delving Into the Ins and outs of what It entails, I'd like you to have a clear understanding of what's Involved with the "missing Item method", so let's have a look at that now.
What Is The Missing Item Method?
If this Is the very first time you've heard of this method, I'd say It's very safe to assume that judging by the topic's title, you'd have an Inkling of what It pertains to. As Its name Implies, It's commonly used by SE'ers to say that the Item they ordered from an online store, was missing when they opened the "package/box" as delivered by the carrier. For example, we'll pretend that you purchased a CPU from a UK electrical retailer named Currys and had It sent to your home by their carrier service. Upon "opening the box", you'd call them and say that nothing was Inside, meaning the CPU was missing- with the Intention to SE them for a refund or replacement. Alternatively, you can say that when you "opened the package", there was nothing Inside, meaning the entire box as well as the CPU was missing.
Notice that I've quoted both "opening the box" and "opened the package". As straightforward and blatantly obvious as It Is, for some strange reason, many users on an SEing forum that I'm registered with, fail to comprehend and differentiate one from the other. Sure, If you're a completely new to the world of social engineering, then It's understandable, but certainly not when you're ranked In a medium to advanced level. On the grounds that you're a newbie and would like clarification on this, then you've come to the right place. I will elaborate how the above-quoted terms are used with the "missing Item method" In a very simplistic manner, so without further delay, let's get this started.
The Missing Item Warehouse Error:
There are a few ways that you can use the missing Item method, and provided you've formulated It against the nature of the Item that you'll be SEing, each one Is equally effective. This particular one relates to "opening the package" and nothing was Inside- due to a "warehouse error". In other words, when the driver dropped off the delivery, you opened the package and It was empty- the box and Its contents was missing. Obviously, that's based on Items that come packaged In a box. Evidently, you did receive what you've ordered, but you're claiming otherwise. Now for this to work, you must take the "shipping (gross) weight" Into account and not the Item alone. Do remember, that you're saying you did not find anything when you opened the package, which essentially means that the "box & Item" was not there!
I'll give you an Insight Into how this can happen from a legit standpoint. The warehouse storeperson Is given a picking slip that contains your order (and a few others), with the description and quantities of each product that needs to be picked. Whatever the reason may be, he's totally forgotten to grab your Item from the shelf/racking, then sealed the package with nothing Inside and dispatched It thereafter and as a result, you didn't receive the entire goods. This Is how the "missing Item warehouse error" Is used. For this to succeed, the "shipping weight" must be extremely light- anything under 120 grams will suffice.
The Missing Item Manufacturer Error:
Another way that you can use the missing Item method, Is by saying that you received the box but the Item was not enclosed. This Is known as a "manufacturer error", and believe It or not, It happens a lot more often than you think. For example, have you ever purchased something from Walmart or Best Buy and when you arrived home and opened the box, either all or part of the Item was missing? I'd say your answer Is "Yes" to at least one occasion. This Is no different to SEing online stores such as Amazon. As a matter of fact, I've personally been In touch with one user who ordered a set of AirPods, and only received the box and the user manual/guide. The charging case and each AirPod (earbud) was missing. Mind you, this was a genuine purchase and he had no Issue whatsoever when asking for a replacement.
If this was the result of an SE, the outcome would've been exactly the same, hence that's what makes the "missing Item manufacturer error" method so effective. But It's of the utmost Importance to be very selective with the type of Item you're looking to social engineer. How so you ask? Well, now that we're on the topic of AirPods, I'll use It as the demonstration. This Is the breakdown of the Apple AirPods with wired charging case. The latter weighs 38 grams and each AirPod Is 4 grams- totaling a combined weight of "46 grams". This will not register when weighed during dispatch and at the carrier's weighing facilities at their depot, thus when you contact the company and say that "you opened the box and the AirPods & charging case was missing", they cannot prove otherwise. All In all, with this method, you need to research the "weight of the Item" and use that when preparing your attack.
The Missing Item Tampered With In Transit:
SE'ers who are familiar with the "boxing method", whereby the rep requests to return the Item (that's deemed nonfunctional) for a refund or replacement, the social engineer will only send the box. He'll make It look as though It's been tampered with during shipment and that the Item was stolen and as such, the claim will be approved based on those grounds. The "missing Item tampered with In transit" method, works on a similar principle, but the roles are reversed- Instead of sending the package, you will be "receiving It from the online store", and then call the customer service representative advising that your product was missing, and that the box/package was torn and heavily taped when the carrier driver handed It to you.
If you haven't already gathered, the purpose Is the same as the box method- someone had taken the Item at some point from the time It was dispatched by the company, to just before It reached your premises. In other words, It was (seemingly) stolen In transit. As with all the above methods, It's Imperative to keep the Item weight under 120 grams and as a result, If an Investigation Is opened, the consignment details cannot be cross-checked to verify Its weight. Ultimately, there will be no point of reference to conclude that your Item was In the shipment- It's simply too light to register a weight. So how can your claim for a refund/replacement possibly be declined? It can't. Expect It to be finalized In your favor.
Items Suited To The Missing Item Method:
There are countless Items you can use with the missing Item method, and It's way beyond the scope of this article to cover even the minority. What I will do however, Is list a few that're guaranteed to work- but only If you apply your method based on what you've learned In the above guides. Do note that what you're about to read, relates to the "Item weight" that's used with the "missing Item manufacturer error". If you're wondering whether they can be used with the "missing Item warehouse error", hit a Google search and checkout their "shipping weight". It may be somewhat hard to find, so have a look at this website. It has the shipping weight with every Item listed for delivery.
Moving forward, here's my recommendations as per below, categorized by Item descriptions and their respective weights.
- AirPods Pro with charging case. Weight: 56.4 grams
- AirPods (Previous Model) with charging case. Weight: 46 grams.
- Versace Bright Crystal Toilette 10 ml. Weight: 45.1 grams.
- Crucial 240 GB SSD (Solid State Drive). Weight: 60 grams.
- AMD Ryzen 12 Core CPU. Weight: 45.4 grams.
- Fitbit Versa 2 Watch. Weight: 38 grams.
- Ray-Ban Justin Rectangular Sunglasses. Weight: 28.4 grams.
- Giorgio Armani for men 100 ml. Weight: 95.2 grams.
Each of the above will work with the "missing Item manufacturer error". It's also suited to the "missing Item tampered with In transit"- due to claiming that only the Item was stolen, and not the entire box It came with. Use these Items & weights as a general guide with the aforementioned missing Item methods.
In Conclusion:
As you've most likely realized, there's a lot of details to take Into consideration when using the missing Item method. It's not as simple as choosing something of lightweight, hitting your SE and expect It to run smoothly without failure. Sure, there are times where the representative Is half-asleep on the job and approves your claim with no questions asked, but for the most part, they do follow company protocol with their claims management process. This means that It's paramount to be systematic with how you formulate your method, and given you've taken everything you've read on board, you will not experience any major obstacles when SEing companies on every level.
