Skip to main content
ThreatScams & fraud

Fake mystery shopper / secret shopper advance-fee scam — victim selected as shopper, given fake cashier's check, asked to buy gift cards and wire back overpayment keeping a "commission"; FTC 2024: $337M in mystery shopper losses; average loss $1,200+

fake-mystery-shopper-gift-card-advance-fee-scam

What this tier means

High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.

How Gorganizer detects this

Advance-fee fraud targeting consumers with a "congratulations, you've been selected as a mystery shopper" notification — then instructing them to cash a fake cashier's check, purchase gift cards (Google Play, iTunes, Amazon, Steam) at retail stores, photograph the card codes, and "wire back" the overpayment while keeping a commission. The check bounces weeks later; the victim is liable for the full amount. Key facts: (1) FTC 2024: mystery shopper and secret shopper scams cost Americans $337M with an average loss of $1,200+ per victim; the scam has been in the FTC's top-10 consumer fraud categories for over a decade; (2) The fake-check mechanism is the core exploit: banks make funds provisionally available within 24-72 hours before the check clears — victims who spend these funds before the check bounces owe the full amount to the bank with no recourse; (3) Gift-card purchase is the definitive indicator: no legitimate mystery shopping company instructs evaluators to buy gift cards, photograph codes, or share PINs — evaluators purchase and return merchandise through official channels with proper expense reporting; (4) Legitimate mystery shopping agencies (MSPA Americas members) never send unsolicited email offers, never pay via cashier's check, and never ask evaluators to wire funds. Warning signs: unsolicited selection notification, cashier's check mailed in advance, gift-card purchase task, instruction to "wire back" the overpayment.

False-positive guard

Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.

About the scoring engine

Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.

Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.

Ready to clean your inbox?

Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.

Get started