This month, E-Enforce™ is deviating from our typical white paper format. Rather than providing an in-depth review of one aspect of E-Commerce enforcement, we’re taking our readers inside our world of tracking and stopping cyber-offenders.

For nearly a decade, E-Enforce™ (and its sister company, Cyber Investigation Services™) has been laser-focused on helping brands and manufacturers identify and take down those who improperly, fraudulently, and criminally use the internet to exploit brands for their own profit.

Through the years, as E-Commerce has proliferated, we have witnessed an explosive emergence to two types of cyber-offenders: unauthorized sellers and counterfeiters. And, as time progressed, we have seen these offenders become more technically sophisticated and more likely to be hiding far away from the U.S. marketplaces where they derive the bulk of their profits.

Fortunately, we have spent the last decade building proprietary tools and processes that keep our investigators one step ahead of unauthorized sellers and counterfeiters. These tools are rooted in strategies and tactics honed during former careers and extensive education in both law enforcement and software engineering. The end result of all that hard-work is a best-in-class track record of identifying, finding, and putting a stop to online offenders.

Before we delve into the nuts and bolts of a cyber-investigation, however, let’s review the current E-Commerce environment and how that environment is fostering uncontrolled growth for unauthorized sellers and counterfeiters.

The State of E-Commerce 

As an overall percentage of retail, E-Commerce accounts for roughly 10% of U.S. sales. That number differs wildly with respect to individual product categories and retailers, however. For example, in the apparel industry, over 20% of purchases are made online. And for brick and mortar stalwarts Neiman Marcus and Nordstrom, a quarter of present-day sales come from the interneti.

While 10 – 25% of sales may not seem significant, the revenue numbers are impressive, and the trend toward online commerce is continually growing. Indeed, more than 50% of the U.S. population now reports a preference for online shopping over traditional shoppingii. Impressively, E-Commerce sales are expected to exceed $4.0 trillion in 2020iii.

The proliferation of E-Commerce has occurred, thanks in no small part, to mega online marketplaces like Amazon and Amazon is the undeniable leader of the E-Commerce revolution. In fact, the National Retail Federation reports that Amazon is now the largest online retailer in the worldiv. The latest numbers show the company’s annual sales nearing $140 billionv

Although Walmart has yet to reach those astronomical numbers with its online efforts, the company is bound and determined to become a marketplace contender. Over the past year, it announced major changes within the internet division of the company which analysts believe led to a recent 50% growth in E-Commerce salesvi.

The Third-Party Retailer Problem

For consumers and brands, one of the most startling statistics about marketplaces like Amazon and Walmart relate to each company’s third-party retailer (“TPR”) program. Amazon was among the first web retailer to allow individuals and entities unrelated to its organization to sell products in its virtual marketplace. In some product categories, TPRs now sell over 75% of the products moved by Amazonvii.

Recognizing Amazon’s success with the TPR program, Walmart is aggressively building its own TPR marketplace. In fact, the company has publicly claimed to be adding “hundreds of new sellers monthly.”viii Unfortunately, both Walmart and Amazon are doing a poor job of keeping unscrupulous TPRs – such as unauthorized retailers and counterfeiters – out of their dominant venues.

Let’s be clear – not all TPRs are unauthorized sellers or counterfeiters. But enough of them are that they are having undeniable negative effects on manufacturers and brands. The trouble stems from immense pressure among TPRs to compete with each other (and sometimes the marketplaces themselves) to make a sale.

In both Amazon and Walmart marketplaces, multiple TPRs may offer a single product for sale, but only one of them will have its product listing featured on a given day. For example, even if 37 TPRs are selling “widgets” on Amazon (or, consumers searching for “widgets” will only see one listing. The manner each online marketplace uses for choosing which TPR becomes featured is beyond the scope of this paperix, but suffice it to say that offering that product at the lowest price is the most important factor. This leads TPRs to continually drop product prices in order in hopes of generating sales. As one industry-watcher put it, “The problem is when you start trying to compete on price. You are suddenly running around like headless chickens and you don’t make any money. We have seen businesses that have tried [to compete] go under.”x

With the lowest prices driving sales, TPRs who have obtained products surreptitiously – such as unauthorized retailers and counterfeiters – can enjoy a much greater sales volume than legitimate TPRs. Because they have obtained products at prices far below typical wholesale pricing, they can offer those products at retail for prices far below the manufacturer’s minimum advertised price (“MAP”) and still recognize a handsome profit.

Authorized retailers, who are often contractually bound by MAP policies, thus face a dilemma if they want to compete online. Like their unauthorized counterparts, they too can violate MAP policies in order to generate sales (which not only eats away at their margins but puts them at risk for legal action by the manufacturer). Alternatively, they can lose sales. Notwithstanding the risks, many authorized retailers feel they have no choice but to violate MAP by participating in the online pricing war.

This process has a cascading effect on overall product prices, which is referred to in industry circles as “the race to the bottom.” As online price erosion continues, manufacturers and brands suffer from a host of additional problems. For example, many face pressure from authorized brick and mortar retailers to lower MAP so physical stores can compete with internet sellers. And, as more and more consumers see rock-bottom prices emerge, brand reputations start to falter. The entire process can descend on a brand with surprising speed and devastating force.

The Call to E-Enforce™

It is against this backdrop that E-Enforce™ typically receives calls from new clients. Often, the call comes from an in-house legal team overwhelmed by the sudden uptick in indicia of unauthorized sales and/or counterfeiting. Whether they are global companies, mid-sized firms, or small, emerging brands, their concerns are similar. They include:

• A sudden rise in complaints about MAP policies and pricing from authorized retailers;
• Complaints from consumers that product warranties or money-back guarantees were not honored for products purchased in an online        marketplace;
• Consumer complaints about poor customer service received from online sellers;
• Complaints about poor-quality or phony merchandise;
• In-house searches for online product listings reveal several brand products being offered far below MAP;
• Product labeling that contains spelling errors or off-brand imaging.

The majority of the time, this in-house team has tried to take matters into their own hands, only to find that they are unable to locate, identify, or communicate effectively with online sellers. Sellers operating in online marketplaces tend to run virtual storefronts through fictitious businesses. To the extent in-house teams have reached an actual person behind those businesses, at best they receive rushed promises about taking the products offline.

That seems like a victory until the legal team notices new sellers selling the same unauthorized products within a matter of days or hours. In truth, the seller they contacted has not taken products offline. To the contrary, they have simply set up a new storefront under a new business name in order to peddle the same lot of illicit products.

By the time clients contact E-Enforce™, they frequently report feeling like they’ve been in a prolonged game of whack-a-mole. Every time they think they’ve shut down one seller, another one (or two or three) emerges. Some clients have already tried using other private investigation firms without any measure of success. By the time they call us, most believe the chances of putting a stop to fraudulent online sales is dubious at best.

In this paper, we intend to show that there are fast and efficient ways to deal with illicit sellers in online marketplaces. To that end, the first part of this paper will explore what we call “Level One Enforcement.” Level 1 efforts are usually undertaken to find, track, identify, and stop unauthorized retailers.

The next part will discuss “Level Two Enforcement” – the level that is deployed when we discover that our clients’ products are being counterfeited. Level 2 efforts are aimed at finding the source and location of counterfeit operations, as well as the identities of the key players behind them.

The final part explains “Level Three Enforcement.” Like Level 2, Level 3 Enforcement is also principally undertaken against counterfeiters. At this level, however, major counterfeiting or organized crime rings are suspected, and full organizational take-downs are the ultimate goal.


Absent extraordinary circumstances, every new case that comes into E-Enforce™ begins at Level 1 Enforcement. Level 1 is intended to do two things: (1) determine the full extent of the client’s TPR problem; and (2) identify and put a stop to any and all fraudulent sellers that are plaguing the brand. Level 1 proceeds quickly through the following steps:

Client Interview

The first thing the E-Enforce™ team does is perform an exhaustive written and/or oral interview with the client. We want to know what red flags the client has seen in the marketplace, any previous measures they’ve taken to try to identify or stop online offenders, and any internal procedures they have put in place (if any) to thwart future fraudsters from attacking their brand. In addition, however, we obtain extensive information about the client’s policies and procedures that may impact legal proceedings against illicit sellers, should that become necessary.

For example, with the oversight of in-house our outside attorneys, we look at the client’s trademark portfolio to determine the availability and viability of legal positions rooted in trademark law. Many times, the strength of a client’s trademark portfolio is the lynchpin on which we can take down less sophisticated unauthorized sellers.

E-Enforce™ also reviews the client’s policies and contracts with authorized distributors and sellers. Of course, this process involves review of MAP policies, and any previous methods the client has used to enforce those policies. Further, we want to know who is authorized to distribute and sell the client’s products. Aside from being generally useful information, we may need to investigate those entities for possible product leakage.

Monitoring & Intelligence

The next phase of Level 1 Enforcement happens simultaneously with the client interview process. Specifically, E-Enforce™ begins a thorough marketplace intelligence analysis. Investigators set up automated processes that scour the internet and online marketplaces searching for indicia of unauthorized sales and/or counterfeit sales. To accomplish this, they will deploy proprietary software and pricing algorithms that root out troublesome sales around the globe. Among other things, these specialized programs locate products sold far below MAP, sold outside of the intended sales channels, and other proprietary indicators.

Investigators can quickly pinpoint sales of defined SKUs/ASINs, as well as the business identities of online TPRs selling those products. This information provides E-Enforcement teams with a real-time snapshot of how each product under investigation is being sold online. Lamentably, initial reports often reveal dozens of unauthorized sellers or counterfeiters that the client wasn’t even aware of yet.

Importantly, while the initial intelligence gleaned from this process comes in very quickly, monitoring is not a static operation. Fraudulent sellers use intricate schemes to hide their identities from those looking to stop them. By continually monitoring the internet for red flags indicating an improper sale, investigators are immediately alerted any time one of those red flags is waived. This process continues throughout the engagement. Indeed, it is the primary tool E-Enforce™ uses to determine when a fraudulent seller problem is finally at bay – when we stop seeing new illicit sales pop up around the globe, we know we’ve done our job.

Fast Action

Putting a stop to unauthorized sales and counterfeiting begins with identifying the TPRs who are selling the improperly-obtained merchandise online. Typically, the first “identification” is a business name – the name under which the seller operates its virtual marketplace. Once that entity is identified, E-Enforce™ can takes steps to begin shutting down his sales.

As a measure of first resort, E-Enforce™ will transmit an electronic cease and desist notice (“EC&D Notice”) to all illegitimate sellers. The EC&D Notice is sent directly to the business entity located in the relevant marketplace via the online communication method offered by that venue. Amazon, for example, offers a communication portal designed for consumers to communicate with TPRs. E-Enforce™ initially uses that vehicle to send EC&D and other notices.

Although this is a simple step, it is an important one. Many unauthorized sellers are small-time operators who are unaware that they are doing anything wrong. In fact, many of them are simple hobbyists who purchase items using in-store discounts, coupons, and rebates, and then attempt to resell those products for a quick profit using Amazon or Walmart. Often, they will go away after receiving the first or second EC&D Notice.

That is the beauty of the initial EC&D Notice – it quickly dispenses of small-time or “annoyance” sellers. This is significant because these types of sellers typically make up 40% to 70% of the illicit operators we find in each investigation.

The remaining sellers, however, are not so easily dissuaded. They hide behind their fictitious business names or close-up shop for a while, only to crop up again in a few days using a slightly different business name. In other cases, we find them operating under the same name, but selling in a different online marketplace.

These hide-and-go-seek tactics are highly ineffective given that the proprietary E-Enforce™ monitoring software doesn’t have an “off” button. We are alerted the moment they reappear and take same-day steps to renew cease and desist demands. When a case is at this point, however, those demands are usually not enough. Sellers grow comfortable behind the anonymity offered by the internet.

With E-Enforce™ on the case, that confidence is misplaced. Once secondary cease and desist notices are ignored, enforcement efforts are elevated. The goal of these next steps is to identify and exert legal pressure on the actual people making the sales behind fictitious business names.

Covert Product Purchases

The personal identification process often begins with undercover product purchases from those entities that continue to pop up within our monitoring programs. We find that many of our client’s in-house teams have tried this step without yielding much additional offender information. In our view, it is critical to have outside investigators like E-Enforce™ handle this step for two reasons.

First, our investigators are well-versed in the modus operandi of individuals and sham entities who sell counterfeits or make large volumes of unauthorized sales. These individuals know brands will come hunting for them sooner or later and they are quite discerning about the addresses they will ship products to. E-Enforce™ investigators make these purchases under assumed names (with credit cards that match those names) and ensure products are shipped to untraceable addresses.

Additionally, E-Enforce™ executes the product purchase with extreme caution so that the chain of custody is preserved. In other words, we follow precise steps to ensure that the offending products are admissible as evidence in court should it ever come to that.

Upon receiving the goods, our team works in conjunction with the client to examine the products for indicia of unauthorized sales or counterfeiting. These include things like obscured bar codes, expired “sell by” dates, damaged packaging, or slightly altered logos and designs. Results of this examination will be documented and preserved for evidentiary purposes.

Critically, E-Enforce™ will can also convert any information obtained through the covert purchase into actionable intelligence. Packaging, post information, and product inserts provide just the right clues to take products to the next level.

Lightning-Fast Identification of Individual Wrongdoers

Armed with this additional information, E-Enforce™ deploys next-level proprietary investigative tools. We have developed best-in-class software that allows us to reach information about the illicit sellers that other investigators simply can’t access. And we do so with alarming speed.

Many of today’s sophisticated cyber criminals undertake high-tech measures to avert detection. For example, some use secure proxy servers that route their communications through multiple countries hide their true locationxi. We are not intimidated by these measures, however. The E-Enforce™ software quickly sorts through data noise and eradicates information intended only to obfuscate investigations.

Using the seller information obtained to this point, E-Enforce™ can typically find individual offenders’ names, physical addresses, the addresses of every place they’ve ever lived, their telephone number(s), social security numbers, email addresses, and other relevant background information. While most internal investigators, and average private investigation firms try to glean this type of information, they typically come up empty handed. E-Enforce™ generally has it in hand within 15 -30 minutes of starting our search because of the tools, training and expertise we have developed in this area.

Most of the time, this process successfully locates and identifies unauthorized sellers so that further enforcement measures can be applied to halt sales of our clients’ goods. In some cases, however, investigation tactics must go further.


As noted above, Level 1 enforcement is typically deployed against unauthorized sellers. These offenders, even those selling large volumes of goods across multiple marketplaces, tend to be less sophisticated than their counterfeiting brethren.

Counterfeiters, on the other hand, can be highly sophisticated both from the standpoint of technology, as well as making themselves very far to find. Indeed, as anti-counterfeiting technologies increase, counterfeiters themselves are becoming more technologically sophisticatedxii.

It’s no surprise that they go to such great lengths to avoid detection. The counterfeit industry is estimated to cause a global loss of $500 billion in manufacturer revenues annuallyxiii. Moreover, there is a high correlation between counterfeiting and organized crimexiv. Add to that the fact that many counterfeiting operations are operated across multiple bordersxv, and you can quickly understand why tracking and identifying counterfeiters requires an elevated level of investigation.

Using Technology to Track Counterfeiters

When an E-Enforce™ client is faced with a counterfeiting problem, the initial investigation will follow Level 1 protocols at first. In many instances, however, the individuals running counterfeiting operations are using false identities in their everyday lives, making the task of locating them more difficult.

Level 2 enforcement therefore relies on undercover communications with the entities selling counterfeit products in online marketplaces. Rather than sending these sellers cease and desist demands, investigators will pose as concerned customers, or large buyers seeking additional information about products. They will try to engage the seller in as many forms of communication as possible.

This usually starts with initial questions sent through the online customer communication portals. From there, investigators will try to move the conversation into direct emails, text messages, and phone calls. They will also ask for a company website address outside of the virtual marketplace they sell through. Notwithstanding the fact that all these communications are likely made by counterfeiters through burner phones and emails opened using false identities, the resultant information can yield valuable clues.

For example, some people use photos of themselves as “icons” that accompany the emails they send. Often, counterfeiters will use a real photo of themselves even if their email address falls under an assumed name. If they make this mistake, E-Enforce™ can use photo-recognition software to find instances of their likeness wherever it may be located on the internet.

This process often leads to social media accounts. Investigators can then legally penetrate the counterfeiters’ social media profiles to obtain information about their whereabouts, families, and associates. Even if they use a false name on social media, users tend to leave endless technological breadcrumbs floating around their profiles.

Likewise, to the extent we can lure the counterfeiter into providing us with a website address, and into exchanging texts and/or phone calls, those bits of information can be used to track down the person’s physical location. Manytimes, valuable I.P. addresses and device fingerprints can be obtained in this manner.

Once E-Enforce™ has had contact with a person’s mobile devices, we can use our law-enforcement level databases and other proprietary tools to trace the phone number to an actual person. In other instances, we can use signals from the phone itself to physically locate an offender.

Follow the Money Trail

Another critical investigative technique in Level 2 enforcement is monitoring financial transactions. Through covert buys or product returns, we can often get information about a seller’s bank account. Once we’re able to trace that bank account, we can get all sorts of information that is critical to our investigation.

The account, for example, may tell us the counterfeiter’s country or city of origin. Transactions within that account may also lead us to others in the counterfeiting network. Regular purchases or deposits may reflect business dealings with an upstream counterfeiter. Transactions involving shipping or transportation firms may tell us how products are making their way around the globe.

At this point, the purpose of the investigation is to gather evidence for law enforcement. Another E-Enforce™ advantage is that we have operative relationships with law enforcement agencies in nearly every country around the globe. That means that no matter where counterfeiters hide, we have the resources and official relationships to see that they are brought down and prosecuted to the fullest extent of the law.


Level 3 Enforcement is the most drastic and is reserved for the most serious counterfeiting cases. These are cases that tend to involve hundreds of thousands of dollars’ worth of phony products that are being shipped all over the world. The principle goal in these cases is to completely prevent counterfeit products from entering the marketplace and locate and shut down the factory developing the products.

At this point, E-Enforce™ has identified low-level counterfeit sellers and has traced their actions up the chain of command. They know a great deal about how the counterfeit ring operates, where it operates, how it ships, and how it distributes products. Information and evidence obtained during the investigation has been carefully documented, preserved, and handed over to law enforcement.

Now is the time for E-Enforce™ to leverage its global relationships with the agencies charged with bringing down counterfeiters. The operational tactics can vary from case to case.

In some instances, E-Enforce™ works with local authorities to shut down the counterfeiters’ internet service provider. This prevents the fraudsters from pursuing online sales while additional enforcement measures proceed.

The next step, however, involves getting products our of the chain of commerce. To that end, E-Enforce™ intelligence is often used to justify products seizures either at the port of origin or through Customs and Border Patrol (“CBP”) officials once the products are off-loaded in the United States. These seizures can keep scores of phony products from making their way to consumers. In one raid in May 2017, for example, CBP confiscated 29,000 bottles of perfume that counterfeiters were trying to bring into the countryxvi.

In other cases, E-Enforce™ works directly with foreign officials to shutter entire manufacturing operations. This takes a high level of coordination with multiple agencies and usually involves retaining a foreign law firm to advise our team with respect to local evidence preservation standards and other procedures. Importantly, E-Enforce™ also maintains relationships with legal counsel across the globe and can leverage those relationships to our clients’ advantage quickly.

Even after product seizures and plant raids are completed, E-Enforce™ investigators are not done with our work. We stay on as expert witnesses and/or litigation support consultants for any criminal and/or civil cases that stem from our prior efforts. Our goal in each case is the same: to lawfully and efficiently track, identify, and halt the illicit online sales that plague our clients. Our track record in that regard speaks for itself.


E-Enforce is a division of an internationally recognized investigation firm, Cyber Investigation Services. We have been providing litigation support and investigations for high profile cases and top law firms since 2010.

In 2012, we began combatting unauthorized sellers at the request of our client, Zo Skin Health. When we began that process, the company was overwhelmed with unauthorized retailers in online marketplaces. Today, they have virtually zero. They have also enjoyed exponential growth in that time. In February 2017, we made our proprietary E-Enforcement system available commercially.

Today, E-Enforce™ employs a dedicated team of engineers, software developers, data analysts, product purchasing specialists, licensed cyber investigators, and seasoned former law enforcement officers. We dedicate our time and attention to helping our clients deal with this rapidly evolving problem of unauthorized sellers, grey market sellers and counterfeiters. In addition to our in-house team, we regularly partner with legal professionals around the world who are specialized in the many aspects of fighting cyber-crime. “E-Enforce™ is committed to mitigating unauthorized sellers and assisting clients with counterfeiters and traffic diverters determined to erode our clients’ hard-earned margins and brand reputation.

We currently work with over numerous brands, including global fortune 500 companies, mid-sized operations, and small-but-growing manufacturers to thwart unauthorized sellers and counterfeiters alike. Our clients represent the following industries:

• Cosmetics
• Direct sales
• Paper products
• Home repair                                                                       
• Clothing
• Women’s accessories
• Food supplements
• Pet products
• Sunglasses & accessories
• Consumer electronics
• Vacuum cleaners
• Purses and bags
• Radar detectors
• Cutlery
• Skin care
• Health products
• Vitamins
• Hair products

If you have questions about cyber investigations or would like additional information, contact the E-Enforce™ team at, or call us at (800) 892-0450. You can also follow us at, via the ECommerce Enforcement Group on LinkedIn, or visit




[ix] For a more detailed treatment of this process, please ask for December 2017 E-Enforce™ white paper entitled “E-Enforcement 101.”




Thank You. An E-Enforce Representative Will Contact You Shortly.