CISCyber Investigation Services
Get Criminal Alerts

ResearchORC series, Part 1

The Anatomy of an ORC Ecommerce Fence

How Stolen Goods Become Ordinary Listings: Part 1 of a Series on Organized Retail Crime's Online Fences

Cyber Investigation ServicesJuly 2026

A Storefront in Burien

On a commercial strip in Burien, Washington, a sign read “We Buy Gold, Silver, and Electronics.” It looked like a hundred other cash-for-valuables shops. Inside, according to federal charging documents, it was something else. The business, run through an entity called MBA Trading LLC, bought goods stolen from area retailers, paid cash to the thieves who brought them in, and resold the merchandise online.

Federal prosecutors in the Western District of Washington charged its two operators, Vitaliy Bobak and Andrey Balun, with conspiracy to transport stolen property across state lines. Between 2021 and June 2023, the operation grossed more than $4.5 million. When agents executed search warrants in December 2023, they seized over 74,000 stolen items valued at roughly $2.4 million.

The stolen goods did not move through a back alley. They moved through Amazon and eBay, listed like any other product, bought by ordinary customers who noticed nothing wrong. This is what modern retail theft looks like on its way to a buyer. To understand how it works, start with the word at the center of it.

What a Fence Is, and Why the Internet Changed the Math

A fence buys stolen goods and resells them. The term is old. What is new is the marketplace.

Organized retail crime, or ORC, is theft carried out by coordinated groups rather than lone shoplifters. The people who do the stealing are called boosters. A booster sweeps merchandise off retail shelves, often to order, and hands it to a fence for cash. The fence pays pennies on the dollar, then sells the goods at closer to full price to buyers who have no idea where the product came from. The chain runs booster to fence to buyer.

For most of retail history, the fence was the weak link. A pawn shop or a flea-market table could only move so much, in front of so many people, at so steep a discount. Selling stolen goods in person meant local buyers, local risk, and low prices.

Online marketplaces broke that ceiling. A federal watchdog put a number on the shift. In a 2011 report, the U.S. Government Accountability Office found that “retailers indicate that e-fencing can often yield 70 percent or more of the retail value of the product versus approximately 30 percent through traditional fencing venues.” The same report noted that online selling adds global reach and the perception of anonymity.

Online fencing captures more than twice the retail value of the goods that street-level fencing returns, which is why stolen merchandise migrated to the marketplace.

Double the return, a national buyer pool, and a screen to hide behind. That is the economic engine. The Burien case shows the machine running end to end.

The Anatomy of the Operation

Acquisition

The front end was cash for goods, no questions asked. Boosters brought stolen merchandise to the storefront, and the operators paid them a fraction of retail value. The inventory told on itself. Many items still had anti-theft devices attached. Others carried labels or stickers restricting their sale to a specific retailer, the kind of marking a legitimate wholesaler never sees.

The product mix pointed straight at store shelves. Charging documents describe over-the-counter medications and health and beauty products as the core inventory, with named examples including Braun electric shavers, Keurig coffee makers, Sonicare toothbrushes, and Rogaine.

Processing

Stolen goods carry evidence, and the operation worked to remove it. According to charging documents, Bobak used tools to physically strip security devices from some items before they went up for sale. That single act converts a stolen product back into something that photographs like new stock.

Some evidence stayed in plain sight. The eBay listings carried near-term expiration dates in the titles of consumable products, phrasing such as “Exp 07/2024” and “Exp 01/2024.” Fresh expiration dates are consistent with product pulled recently from a retail shelf rather than aged surplus or liquidation lots. Every listing title also carried a four-digit tag, entries like “#3346” and “#9318.” Those numbers are consistent with an internal inventory-tracking system, the operator’s own way of keeping 800-plus listings straight.

Distribution

Two channels carried the goods to buyers. On Amazon, the storefront traded as “Medikus.” Its eBay identity was “ABC STORE 555,” under the handle abcstore555. Both looked routine. The eBay store held a 99.6 percent positive rating in a July 2022 capture.

Archived copies of the eBay pages, preserved by the Internet Archive, show exactly what shoppers saw. The catalog ran through familiar brands at everyday-discount prices. Consumables clustered between roughly $13 and $31.

Product Price Title detail
Flonase Allergy Relief Nasal Spray 2x144 $23.99 “Exp 07/2024+ #3346”
Nexium 24HR Clear Minis 42 Capsules $19.60 “Exp 01/2024 #2425”
Align Probiotic 42 caps $23.99 “Exp 2025+ #4177”
Vital Proteins Collagen Peptides 20oz $30.80 “Exp 2026+ #5089/#3564”
MAC Cosmetics Prep + Prime Fix+ 3.4oz $25.99 “#9318”
La Roche-Posay Anthelios 60 Sunscreen 1.7oz $19.90 “Exp 07/24 #2993 #8607”
Crest 3D Whitestrips 1 Hour Express 20 Ct $20.90 “Exp 01/2024+ #1929”
Aleve PM 80 caplets $13.99 “Exp 01/2024 #1899”

The brand list ran wide. It spanned over-the-counter medicine such as Nexium, Flonase, Allegra, and Aleve, supplements such as Align, Metamucil, and Vital Proteins, and premium skincare and cosmetics such as La Roche-Posay, Neutrogena, MAC, and Urban Decay. One line appeared on every archived page, a disclaimer set in capital letters:

“SELLER IS NOT AFFILIATED WITH THE PRODUCT MANUFACTURER AND IS NOT AN AUTHORIZED DEALER OR RESELLER OF THE MANUFACTURED PRODUCT. WARRANTIES, SERVICE, ASSISTANCE, QUALITY, SATISFACTION, SHIPPING STANDARDS, SAFETY, AND OTHER GUARANTEES OFFERED BY THE PRODUCT MANUFACTURER DO NOT APPLY.”

The buyers did not blink. Feedback ran generic and cheerful. “Perfect!!! A++++! Let it be known, I will be buying from this seller again!” one wrote. Another left “Terrific seller! fast ship, just as listed.” Marketplace data shows the account fulfilled orders itself rather than through Amazon’s warehouses, so the goods shipped straight from the operation to the customer’s door.

Money

The volume was real, and so were the proceeds. The charging documents measure the money and the volume over two overlapping windows. Gross revenue topped $4.5 million between 2021 and June 2023. Across January 1, 2022 through November 28, 2023, the two stores ran more than 150,000 sale transactions. Each defendant admitted personally taking at least $1 million out of the scheme, and each agreed to forfeit $1 million. Some of the money went to the ordinary costs of a shipping business, wages and postage. Bobak spent $66,000 in cash on a new Lexus. Balun put proceeds toward a home in Las Vegas.

Bobak pleaded guilty in September 2025. In January 2026, Judge Tana Lin sentenced him to 11 months in prison, three years of supervised release, and forfeiture of $1 million. Balun pleaded guilty in December 2025, with prosecutors agreeing to recommend no more than 57 months. His sentence is not in public records as of this writing.

The Whole Arc Was Sitting in Public Data

Court records tell you what the operation did. The public marketplace record tells you how long it did it, and it was hiding in plain sight the entire time.

The Amazon storefront was first tracked in November 2017. It had operated for more than four years before the charged conduct began. This was an established business with a history, not a shell spun up to move a single haul.

Live listings on the Amazon storefront held steady through the charged window, then collapsed to zero within weeks of the December 2023 search warrants. Listing-count sampling begins in April 2019; the account itself dates to November 2017.

Listing counts stayed steady through the period in question. The store carried somewhere between 750 and 1,000 active listings through 2022, then held in the 800-to-972 range through 2023. On December 17, 2023, it showed 887 listings. Then the warrants hit on December 19. By January 5, 2024, the storefront had dropped from 887 listings to zero. Seventeen days after the warrants, the catalog was empty.

The buyer feedback record follows the same shape. Lifetime feedback climbed from a single entry in November 2017 to more than 2,100 by mid-2025, at a rating near 95 percent. Roughly 460 feedbacks landed across the charged window, a steady pace of roughly 60 to 70 a quarter. Growth was fastest at launch in 2018 and 2019, not during the fencing period. The honest read is a storefront that ran at a constant clip for years, then stopped dead at seizure.

Cumulative buyer feedback grew at a steady pace through the charged window, then flatlined the moment the storefront went dark.

None of this required inside access. The listing histories and the archived pages are open records. The arc of the whole operation, its scale, its steadiness, and its abrupt end, was legible from public data long before it appeared in an indictment.

Not an Outlier

Burien was not a freak event. It sits in the middle of a spectrum, and two other prosecuted cases mark its edges.

At one end is a single pawn-shop front. Roni Rubinov ran New Liberty Loans, a pawn shop in Manhattan’s Diamond District, at the center of a network the New York Attorney General and NYPD spent three years investigating before a May 2022 takedown that named 41 defendants. Court records document the pay scale that street theft runs on. Boosters were paid 6 to 8 percent of retail value for stolen clothing, and $1 to $2 per item for stolen pharmaceuticals and cosmetics. Rubinov’s eBay store moved $1,373,728 in stolen goods over about two and a half years. Investigators seized $3.8 million in stolen merchandise and roughly $300,000 in cash. Rubinov was convicted of Enterprise Corruption and sentenced to 2.5 to 7.5 years in state prison.

At the other end is an organized boosting crew. Michelle Mack, of Bonsall, California, opened an Amazon storefront called “Online Makeup Store” in 2012. She recruited about a dozen women and covered their airfare, rental cars, and travel to hit over 200 Ulta stores plus Sephora locations across at least eleven states. Stolen makeup flowed back to her 4,500-square-foot home, where investigators found it organized and prepped for shipping, still intact in the manufacturers’ packaging. Mack resold roughly $8 million in goods since 2012, including $1.89 million in 2022 alone. She was sentenced to about five years and four months in state prison and ordered to pay $3 million in restitution to Ulta.

Three operations, three shapes. A pawn-shop front, a two-man storefront, an organized crew feeding one account. Different sizes, same machine.

What This Case Tells Us

The Burien operation is worth studying because it is ordinary. No exotic tradecraft, no dark web. A physical shop bought stolen retail goods for cash, peeled off the security tags, and listed the merchandise on the two largest marketplaces in the country under a disclaimer that all but announced the source. It ran for years, serving customers who left five-star reviews. And the record of it, start to finish, was public the whole time.

That is the uncomfortable part for anyone in loss prevention or brand protection. The evidence was never truly hidden. It was distributed, sitting across court dockets, listing histories, and archived pages, waiting for someone to assemble it.

Which raises the question this series exists to answer. If one storefront this legible left a public trail for six years, how many like it are running right now?

A Note on Method

This reconstruction draws on two kinds of records. The narrative of the crime, the charges, the seizures, the sentences, comes from federal and state court records and official law-enforcement releases. The timeline of the storefront, its listing counts, its feedback history, and its archived product pages, comes from public marketplace data and Internet Archive captures. One caveat matters throughout. Buyer feedback counts understate real transaction volume, because most buyers never leave feedback. The roughly 2,100 lifetime feedbacks on the Amazon account sit against more than 150,000 recorded transactions across the two stores. Feedback marks the floor of activity, never the ceiling. The same understatement runs through every marketplace signal. Sales trackers, too, see only what they sample. They credit a listing’s sales to whichever seller holds Amazon’s Featured Offer, the box sellers still call the Buy Box, when the tool looks. And since 2023, Amazon has filled U.S. orders from eight largely self-sufficient regional networks, so the featured seller can differ by a customer’s location. A tool watching from one vantage point catches one region’s winner and misses the rest. In our casework, when a seller’s own records finally surface, the real volume routinely runs higher than any public estimate. We say that as experience, not as a measured figure.

Sources

About Cyber Investigation Services

Cyber Investigation Services is a licensed private investigation firm with 16 years of work in ecommerce crime. The firm builds intelligence on counterfeit, stolen, and diverted goods moving through online marketplaces, and works with brands and law enforcement to act on it.