A 17-year-old young man discovered a flaw in the refund process of a cosmetics sales platform. He transformed the breach into a large-scale operation, which allowed him to buy thousands of products, ask for the money back, and pocket around 490 thousand euros.
Online shopping is based on a tacit agreement that most people will behave honestly: click “buy”, just click “ask for refund” if it is a legitimate return.
Recently, a teenager living in Shanghai, China, considered that this agreement was one more suggestion than a rule – and he set up, alone, an elaborate fraudulent scheme, with which he earned almost half a million euros.
According to court records cited by , the 17-year-old, surnamed Ludiscovered a failure in the refund process of a cosmetics sales platform, which asked customers to indicate the shipping tracking code for those that were returned.
The platform did not check whether the numbers actually belonged to orders that were being returned; it was enough that the tracking number existedso that the refund could be processed and the amount paid for the product would be returned.
Over the course of several months, Lu created multiple accounts on the platformwith which he carried out thousands of purchases — which he then presented requests for refund with fake tracking numbers.
The platform processed them automaticallyreturning the money without confirming the codes — and without recovering the products. According to the Shanghai Public Prosecutor’s Office, Lu submitted 11,900 fraudulent orders reimbursement, receiving merchandise worth 4.76 million yuan, approximately 585 thousand euros.
The fraudulent scheme was completed with the resale operation: Lu placed the products in second-hand sales platforms and sold them, with a gain of about 4.01 million yuan, or 490 thousand euros — your real profit.
According to the SCMP, LU quickly circulated the money, which he spent on new cell phones and branded clothes; He even offered money to his friends. The young Chinese man truly believed that had found an endless loophole.
But there is no evil that always lasts, nor good that never ends: the platform ended up realizing that something was wrong. In March 2024, he reported to the police that he had detected “abnormal refund activity”, after noticing that there was a large volume of returns that were never physically returneds.
Investigators traced the accounts to Lu and detained him. In July 2025, a Shanghai court sentenced Lu to six years in prison.
Under Chinese law, fraud involving especially large amounts can result in sentences of ten years or morebut the court reduced the sentence because Lu was minor when the crimes were committed.
Interestingly, Lu seems to have advanced ingenuity for his young age — which didn’t stop him from setting up a fraudulent operation like a grown-up.
