  Online retail, eCommerce, frequently falls victim to fraud conducted by
malicious customers (fraudsters) who obtain goods or services through
deception. Fraud coordinated by groups of professional fraudsters that place
several fraudulent orders to maximize their gain is referred to as organized
fraud. Existing approaches to fraud detection typically analyze orders in
isolation and they are not effective at identifying groups of fraudulent orders
linked to organized fraud. These also wrongly identify many legitimate orders
as fraud, which hinders their usage for automated fraud cancellation. We
introduce a novel solution to detect organized fraud by analyzing orders in
bulk. Our approach is based on clustering and aims to group together fraudulent
orders placed by the same group of fraudsters. It selectively uses two existing
techniques, agglomerative clustering and sampling to recursively group orders
into small clusters in a reasonable amount of time. We assess our clustering
technique on real-world orders placed on the Zalando website, the largest
online apparel retailer in Europe1. Our clustering processes 100,000s of orders
in a few hours and groups 35-45% of fraudulent orders together. We propose a
simple technique built on top of our clustering that detects 26.2% of fraud
while raising false alarms for only 0.1% of legitimate orders.
