Inside organized crime rings targeting retailers Ulta, TJX, Walgreens

In a tony suburban enclave in the San Diego foothills, police say, an organized retail crime “queenpin” had built an empire.

Tucked behind the stone walls of her 4,500-square-foot Spanish-style mansion, Michelle Mack had stockpiled a small fortune in cosmetics that had been stolen from Ulta and Sephora stores across the country, authorities said. 

Police don’t suspect that Mack, 53, took the items herself. Instead, they say, she pulled the strings from the shadows, employing a network of around a dozen women who stole the items for her so she could resell them on Amazon.

With their airfare, car rentals and other travel expenses paid by Mack, the suspects committed hundreds of thefts up and down the California coast and into Washington, Utah, Oregon, Colorado, Arizona, Illinois, Texas, Florida, Pennsylvania, Massachusetts and Ohio, investigators said. Mack selected which stores to target and what merchandise to take and the women were sent to clear out entire shelves of merchandise before making off with the stolen goods stuffed into Louis Vuitton bags, investigators said.

Investigators began referring to the theft group as the “California Girls” and considered Mack the crew’s ringleader. She made millions reselling the stolen items on Amazon to unwitting customers at a fraction of their typical retail price, investigators said, before she was arrested in early December.

Law enforcement officials say Mack’s alleged theft ring is just one of the many that are plaguing U.S. retailers and costing them billions in losses annually. Their rise has led many companies to lock up merchandise, hire security guards and lobby lawmakers for stricter regulations.

These organized theft groups don’t typically carry out the splashy “smash and grab” robberies seen in viral videos. Instead, they pilfer goods quickly, quietly and efficiently. They often function within elaborate, organized structures that in some ways mimic the corporations they’re stealing from, police said.

CNBC has spent about eight months embedding with various law enforcement agencies and investigating theft groups to understand what organized retail crime looks like from the ground. In some cases, CNBC witnessed low-level shoplifting incidents involving people who appeared to be homeless or mentally ill. In other instances, CNBC saw takedowns of alleged organized theft groups that police said were reselling stolen merchandise at flea markets. Mack’s group, from her alleged network of professional thieves to her lucrative Amazon marketplace, was by far the most sophisticated one CNBC tracked alongside police.

But federal agents with Homeland Security Investigations, the Department of Homeland Security’s law enforcement branch, said some crime groups are even more elaborate — and theft is just one facet of their enterprises.

“We’re talking about operations that have fleets of trucks, 18-wheelers that have palletized loads of stolen goods, that have cleaning crews that actually clean the goods to make them look brand new,” said Adam Parks, an assistant special agent in charge at HSI, which is the main federal agency investigating retail crime.

“Just like any business, they’ve invested their capital into business assets like shrink wrap machines, forklifts,” Parks, who works out of HSI’s Baton Rouge, Louisiana, office, told CNBC in an interview. “That is what organized theft looks like, and it actually is indistinguishable from other e-commerce distribution centers.”

These theft groups in their myriad forms have become a thorn in the side of retailers big and small, prompting retailers to cite crime as the reason for lower profits, the inability to hire and retain staff, and the degradation of the in-store experience. They have also united politically divided Americans in their disdain for seeing everyday products locked up behind glass cases and witnessing brazen theft gone unchecked in stores.

Whether organized retail crime is actually rising is up for debate. Retailers including Target, Foot Locker, Walgreens and Ulta have said theft is a growing problem in recent years. But few have said how often it’s happening or how much money they’re losing from it, fueling accusations from some experts and analysts that they’re blaming crime in order to mask operational missteps.

The National Retail Federation estimates that retailers lost $40.5 billion to external theft, including organized retail crime, in 2022. That represented about 36% of total inventory losses — slightly lower than the 37% in 2021.

Even if theft has not meaningfully reduced some retailers’ profits, many have warned that crime can threaten the safety of workers and shoppers.

“The financial impact is real, but way more important is the human impact, the impact it has to our associates, the impact it has to our guests,” Ulta CEO Dave Kimbell told CNBC in a rare sit-down interview.

“It also impacts the communities in which we live,” he said. “If people don’t feel safe going in to shop in certain areas of a community, it really has an impact and can change neighborhoods and change communities over time.”

The government response to the issue has grown in turn. Both local and federal agencies have stepped up enforcement of laws targeting organized retail crime, and lawmakers are proposing and passing more measures that stiffen penalties for theft offenses.

HSI initiated 59 cases against organized theft groups in fiscal 2021, resulting in 55 indictments and 61 arrests, the agency said.

By the end of fiscal 2023, cases had more than tripled, to 199. Indictments spiked more than fivefold to 284, while arrests soared to 386, more than six times the number in 2021.

California Highway Patrol, which runs one of the most active retail crime task forces in the country, reports it made 170% more arrests for organized theft offenses in 2023 than it did in 2022.

It’s not clear whether organized theft offenses increased in that time or officials ramped up enforcement as the issue got more public attention and the retail industry’s lobbying engine pressed them to make it a priority.

CNBC embedded with teams from HSI and California Highway Patrol to witness four organized retail crime operations for this investigation. The probe is also based on more than a dozen interviews with law enforcement officers, retail leaders and customers, along with records, including court filings, company reports and property records.

On a sweltering Monday morning in July, about a dozen agents from HSI New Orleans gathered behind the U.S. Custom House, preparing for Operation French Quarter.

The officers were instructed to pose as shoppers inside three Walgreens stores and one CVS store in the area seeing high rates of theft, sometimes as many as 20 to 30 incidents per day, agents said.

As federal law enforcement agents who typically investigate terrorism, sex trafficking and gang leaders such as Joaquin “El Chapo” Guzman, the officers weren’t there to arrest people for petty theft. They had a clear directive: Find out who’s stealing and follow them out of the store to determine who else they may be working with.

“Obviously, the name of the game, guys and girls, is trying to get the bigger and better fish,” Assistant Special Agent in Charge Scott Robles, who led the operation, told the assembled officers. “We’re trying to identify the people who are in charge of this organized crime.”

At the bottom of organized retail crime rings are boosters — the people who go into stores and take the items. Robles was hoping the serial thieves targeting the drugstores could lead them to a larger operation.

“It can be anybody. It could be the mom with five kids just looking for extra money. It can be somebody that’s part of a team. … They may be getting paid with food, they may be getting paid with beer or drugs,” Robles said. “Some people get paid cash or they’re trying to work off a debt.”

Throughout the hourslong operation, agents identified at least one case that they say plainly showed organized theft.

Surveillance footage of the incident shows a man enter one of the Walgreens stores, head to the cosmetics aisle, remove a plastic shopping bag from his pants and calmly load it up with 17 jars of nail polish, valued at around $200. He then walked about a half mile away to the New Orleans Public Library’s main branch, where he sold the nail polish to a security guard, police said.

Federal agents briefly questioned the security guard, and the incident remains under investigation.

Beyond that instance, the vast majority of the thefts agents witnessed during the operation were low-level and petty, involving people who appeared to be homeless, mentally ill or transient. One man stole paper towels and then walked into a homeless shelter. A group took a case of beer and later went to a park to drink it. A woman stole a case of water, set up a stand to resell it and then defecated on the sidewalk.

Operation French Quarter showed how the lowest level of a retail crime operation can function, and how even small thefts can involve coordination among bad actors. Still, the incidents underscore the challenges investigators face when trying to build cases; they also demonstrate just how petty many thefts are, especially in urban areas with high rates of homelessness and addiction.

A Walgreens spokesperson told CNBC that the chain is “focused on the safety of our patients, customers and team members” and is taking steps to “safely deter theft” and “deliver the best patient and customer experience.”

“We are working closely with law enforcement, elected officials and community leaders to draw greater attention to and improve our response to retail crime,” the spokesperson said.

Crates filled with unopened jugs of Gain, Tide and Downy detergent. Boxes stuffed with Gillette razors, Olay moisturizer and Allegra allergy pills. A pile of sparkly silver boots in sizes 8, 9 and 10 with the T.J. Maxx tags still on.

This is just some of the merchandise that California Highway Patrol found inside a home and storage container belonging to suspected members of an organized retail crime ring during a raid in November.

In all, investigators uncovered nearly 20,000 items valued at more than $550,000 across five locations connected with the group, according to CHP. Police suspect the majority of the items were stolen from T.J. Maxx stores and a variety of drugstores and grocery stores in and around the Bay Area.

CHP’s probe began in September, when investigators from TJX Companies, the owner of T.J. Maxx, reached out to the agency’s organized retail crime task force with information about a crime ring that it said was buying and reselling stolen goods — a “fencing” operation.

When boosters need to cash in on the items they take, they turn to fencers, who buy the products for pennies on the dollar and resell them at a margin Wall Street could only dream of, retail crime investigators have said.

Experts said retailers can have a hard time persuading law enforcement to investigate theft at stores because it is often considered a property crime, which police tend to see as less urgent than homicides, shootings and narcotics crimes.

To show law enforcement the scope of the problem, TJX investigators began conducting surveillance on the alleged crime ring. CHP agreed to take the case. Sgt. Manny Nevarez, who oversees all organized retail crime investigations in the Bay Area for CHP, told CNBC the group had hit stores in multiple counties in an effort to evade detection.

“They are not catching on that some of the retailers have their own loss prevention personnel and typically, if you target one store in San Jose, then the word gets out and then the next store is notified,” said Nevarez. 

Police learned that alleged members of the group were reselling the suspected stolen merchandise out of their homes and at the local Capitol Flea Market — a sprawling swap meet on the outskirts of San Jose. Officers also witnessed members of the crew receiving suspected stolen merchandise, transferring those goods to others in their network and exchanging money.

At the end of November, dozens of CHP investigators working with TJX descended on the five locations connected with the alleged fencing ring and carried out search warrants in a raid cops dubbed “Operation Kingsfall.” The locations included numerous homes along with a storage unit. 

“Nosotros somos policia,” the officers shouted in Spanish outside one of the homes. “Police, search warrant. Open the door with your hands up,” they continued, switching between English and Spanish before using a battering ram to knock down the door.

The location, an innocuous single-family home with Christmas decorations out front, looked like any other on the block. But on the sidewalk and grass near the property line sat dozens of discarded clothing tags, anti-theft devices, hangers and other retail store detritus.

Inside the home, CHP officers and TJX personnel found mountains of goods they suspect were stolen to resell, including bags of apparel with the tags still affixed, boxes of Huggies diapers, liquor and power tools.

By the time authorities completed the raids, they had enough suspected stolen merchandise to fill three 20-foot-long U-Haul trucks. A spokesperson for the Santa Clara County District Attorney said it is charging nine defendants in connection with the alleged crime ring.

The law enforcement operation witnessed by CNBC showed the breadth of some of the fencing rings in the U.S. and how flea markets can play a role in the sale of stolen goods. Capitol Flea Market didn’t respond to a request for comment. 

“There’s certain crimes that come up where the public reaches a point where they’re like, ‘We have had enough of this,’ right?” Lt. Michael Ball, who helped oversee the operation, told CNBC. “And this is one of those that’s reached that level where people are saying widely and shouting it all the way up to our governor’s office that they have had enough of this.”

In a statement, a TJX spokesperson said the company is “thankful” for CHP’s efforts and is taking organized retail crime “very seriously.” The spokesperson said TJX is “laser-focused on ways to mitigate theft in our stores.”

The company told CNBC it will not resell the recovered merchandise. If TJX considers the items to be in suitable condition, it will donate them to charities in the area where they were found, the company said. If it deems the products unsuitable, it will work to dispose of them “responsibly,” it said.

When Donna Washburn started shopping for a Christmas gift for her daughter in December, she wanted to “splurge” and buy her a bottle of Nars foundation. But she couldn’t find it in stock at a store close to home.

So, like many consumers, she Googled the product. She saw it was available on Amazon and cost around $38 before tax, nearly 30% cheaper than its typical retail price of $52.

“I said, you know, ‘It’s Amazon, it’ll come fast.’ It was the beginning of December. So I really didn’t want to wait too much longer for Christmas,” Washburn told CNBC in an interview, adding she was told it would arrive by Dec. 11.

Unknown to Washburn, police say, that bottle of foundation had likely been stolen by the crew of boosters allegedly employed by Mack — the suspected retail crime mastermind accused of running an illicit business from her San Diego mansion.

The Christmas gift ultimately never arrived, because Mack was arrested before she could ship the package, which was one of many found in Mack’s residence by investigators.

“I pay attention, but not that much, you know?” said Washburn, a 63-year-old clinical education associate in St. Augustine, Florida. “I’m shopping from Amazon. Hopefully you can trust it. So now that we know better … we’ll think twice.”

Washburn had bought the foundation from an Amazon storefront dubbed Online Makeup Store, which Mack had opened in 2012. CNBC viewed it before it was taken down in late 2023.

On its face, Mack’s storefront looked no different from the millions of others on Amazon’s marketplace. It had 4.5 stars on more than 100 reviews, and featured cosmetics from popular brands such as Mac, Tarte and Charlotte Tilbury that shoppers can find in neighborhood beauty stores.

There was just one red flag: the prices. Many of the products for sale at Mack’s store were listed at a fraction of the typical retail price, including a $25 bottle of Estee Lauder foundation that typically retails for $52 and Too Faced mascara that typically goes for $29 and was being sold for $17.

The store brought in millions. Since 2012, Mack sold nearly $8 million in cosmetics through the storefront before it was shut down, and she brought in $1.89 million in 2022 alone, Amazon sales records provided to investigators show.

Mack could offer such low prices, police suspect, because her crew of boosters had stolen the products in hundreds of incidents over more than a decade. Some of the thefts brought in around $2,000 in merchandise while others netted as much as $50,000 worth of merchandise, prosecutors said.

Mack’s business was humming along ahead of the holiday shopping season until the carefully crafted empire police say she built crumbled. On a cool December morning just before dawn, a convoy of CHP and HSI agents, armed with a search warrant, raided her sprawling mansion.

Mack, dressed in a baby pink pajama set and a pair of fuzzy mule slippers, was handcuffed and put into a police car as her teenage daughters stood in the driveway, watching.

Inside her garage, investigators found what they described as a “mini-store” — shelves and shelves of beauty products, sunglasses and designer bags organized in neat bins and categorized by product. They also found hundreds of postmarked yellow envelopes destined for unwitting customers, including Washburn, with “Online Makeup Store” marked as the return address.

Police recovered nearly 10,000 items worth a total of more than $387,000, CHP said.

In February, California Attorney General Rob Bonta filed a total of 140 felony charges against Mack; her husband, Kenneth Mack; and seven other alleged members of the crew. The charges included conspiracy to commit organized retail theft, grand theft and receipt of stolen property. The defendants have all pleaded not guilty. CNBC contacted each defendant multiple times for comment, but none of them responded.

“This is a multimillion-dollar criminal scheme. It was complex. It was orchestrated,” Bonta said when announcing the charges. “We are not talking about garden-variety shoplifting.”

Court records filed in connection with the case provide a rare glimpse into the inner workings of an alleged organized retail crime ring. They show text messages between the suspects and details about the operation.

“I’m not stealing regular I’m going to start filling up my bag quick. So I want to know stuff I can grab in bulks too,” Kimora Lee Gooding texted Michelle Mack on Jan. 7, 2023.

Between Jan. 30 and Feb. 16, 2023, Gooding committed at least 10 separate thefts at Ulta stores across California, prosecutors allege in court records. In each case, Gooding took more than $950 worth of goods, the records say.

On Feb. 21, a few days after Gooding’s string of thefts, Mack sent her a screenshot of “Online Makeup Store” with an address she could ship the stolen products to. It was the same business address that was listed on Mack’s Amazon page before it was shut down, and traced back to a post office box a few miles from her home.

“Even without lancome we still did well,” Michelle Mack texted her husband two days later, allegedly referencing a prestige cosmetics brand owned by L’Oreal.

Soon, orders were pouring into Michelle Mack’s Amazon store.

“Lots of orders let’s get shipping,” Kenneth Mack texted Michelle Mack alongside an image that showed a bin full of paper.

By July 8, it appeared that the haul Gooding and others had allegedly brought in had dried up. Michelle Mack needed more things to sell.

“Did you get some new girls?” Michelle Mack texted Alina Franco, another person charged in connection with the theft crew. “I really need product so if you have anything please let me know.”

A day later, two more thefts connected to the ring were committed and many more followed, prosecutors said.

In addition to Ulta and Sephora, the theft organization targeted a range of other retailers, including Macy’s-owned Bloomingdale’s, Prada, Bath & Body Works, Victoria’s Secret, and Luxottica’s Sunglass Hut and LensCrafters, prosecutors said.

Sephora and Bath & Body Works declined to discuss the case with CNBC. Victoria’s Secret, Macy’s, Prada, Sunglass Hut and LensCrafters didn’t respond to requests for comment.

Despite the recent surge of headlines and commentary on the topic, organized theft groups have long operated around the world. But retail industry leaders and some law enforcement officials argue the rise of online marketplaces and e-commerce has caused such incidents to increase or have made it easier for theft groups to operate.

“There’s an ease of distribution that has become even more prevalent for stolen goods through online marketplaces. … You used to have to sell stolen goods at flea markets or out of the trunk of your car or maybe just locally,” said Ulta’s Kimbell. “Now, you have more sophisticated tools to have a broader reach across the country or even internationally.”

While Kimbell didn’t name Amazon specifically, he said online marketplaces are “part of the problem” and should be using the data, analytics and other technology available to them to be more “proactive” in shutting down bad-actor sellers.

“We shouldn’t have an environment where it’s possible to steal from one retailer and [have it] end up on any other platform, any other large-scale, mainstream platform” that people consider legitimate, said Kimbell.

Bonta called on Amazon and other marketplaces to “do more.” He said they could inform law enforcement, or at least talk to a seller, when red flags such as unusually cheap goods pop up.

“If you freeze out the demand and remove the market by closing out the marketplace where the stolen goods are so easily sold, you make organized retail crime as an organized crime less attractive. And we need to create barriers, instead of ease, for the ability to commit these crimes,” Bonta said in an interview.

In response, an Amazon spokesperson said that the company has “zero tolerance for the sale of stolen goods” and that the company invests more than $1 billion annually in preventing fraud and abuse.

“We leverage sophisticated detection and prevention solutions across our stores and fulfillment operations, allowing us to quickly spot a range of organized retail crime (ORC) schemes,” the spokesperson said in a statement.

The spokesperson said Amazon supports efforts to trace items throughout the supply chain and investigates allegations of stolen merchandise to find out how products were obtained.

“When we identify an issue, we work closely with law enforcement, retailers, and brands to stop bad actors and hold them accountable, including withholding funds, terminating accounts, and making law enforcement referrals,” which have led to arrests, product seizures and the disruption of retail crime rings, the spokesperson wrote.

The company said it assisted with the investigation into Michelle Mack’s alleged theft crew and provided evidence to investigators. It said it’s “pleased” the suspects were arrested because it “sends a strong message that the sale of stolen goods has severe consequences.”

Consumers, many of whom are hungry for deals as they contend with lingering inflation and high interest rates, may feel that buying stolen goods is a victimless crime, experts say.

Michael Krol, HSI’s special agent in charge, disagrees with that idea. He said not only does theft lead to higher prices for consumers but also the items they’re buying could be unsafe because of how they were stored or otherwise manipulated.

“Those items might not have the quality assurance and compliance that we expect in the United States. Baby formula, your medicines … [Consumers] could be buying baby formula that’s expired by three months,” said Krol.

The Inform Consumers Act, which took effect in June, was designed to curb the sale of stolen, counterfeit or otherwise harmful products on online platforms by requiring marketplaces to verify and share identifying information on certain third-party sellers.

The law was designed to prevent the exact type of illicit business Michelle Mack is accused of conducting on Amazon. If sellers are required to provide their contact information to marketplaces and on their listings, bad actors may be deterred from selling illicit goods.

However, Michelle Mack’s business name and an address belonging to it had been verified and was publicly available on her seller’s page. She’d already been on the platform for more than a decade by the time the Inform Act rolled around.

The verification process that Amazon conducted for Michelle Mack’s store after the Inform Act passed wasn’t enough to raise the company’s suspicions, either.

“In this instance, we did not receive signals to identify the seller was engaged in selling stolen goods,” Amazon said.

As part of the law, marketplaces are also required to provide a way for people to report suspicious product listings. But the law doesn’t require the marketplaces to do anything with that information.

“Amazon works hard to ensure our store is a safe and trusted place for shoppers,” Amazon says on a page where people can report suspicious listings. “If you believe any product, seller or other activity in our store is suspicious, please report this using one of the below methods.”

“While we are not able to respond directly to each report,” it says, “we appreciate your feedback.” 

— Additional reporting by Ali McCadden