Covert Test Buy and Counterfeit Test Purchase Service

A covert test buy is the purchase that turns a suspect listing into proof. A licensed investigator buys the product the way any customer would, freezes the listing before paying, opens the package once on continuous video and holds it under chain of custody. We then measure it against the genuine article and record every fact the purchase reveals about the seller. The licensed investigator with firsthand knowledge of the purchase and handling signs the declaration. Brand owners and their outside counsel use our buys for marketplace takedowns, cease and desist work, Schedule A suits and criminal referrals.

Book a Confidential Consultation Call (877) 732-6648

The Listing Is Captured Before We Spend a Dollar

Sellers edit or pull listings the moment they sense scrutiny, so the record starts before the order. At intake we capture the full listing page as an image and as source code, every product photo, the price, the seller name and storefront link, the item identifiers (ASIN, SKU, UPC or item number), the review count and the shipping promise. Each file is hashed with SHA-256 and logged with the time and the person who captured it. At the same stage we pull the brand's own reference images for the genuine product, so the comparison set exists before the package does.

The Buyer Leads Back to No One

A purchase made by the brand, its employees or its law firm hands the seller an easy attack on the evidence and often tips off the network. Our buys run through accounts and delivery addresses that lead back to neither the client nor this firm. Repeat buys from the same seller or the same product never reuse the same delivery point, and orders are spaced so a pattern of buying does not announce itself.

We buy what the seller offers, as offered, at the listed price. We never ask a seller to make, alter, relabel or source anything. That keeps the purchase clean of any claim that we manufactured the violation.

We Buy Wherever the Fakes Are Sold

Marketplaces: Amazon, eBay, Walmart Marketplace, Etsy and Facebook Marketplace.

Social and live commerce: TikTok Shop, Instagram and Facebook sellers who close the sale in direct messages, WhatsApp and Telegram sellers, and live stream sales.

Cross border platforms: Temu, Shein, AliExpress, DHgate, and Alibaba sample and small lot orders.

Orders from sellers overseas are received in the United States with the customs paperwork preserved as evidence of where the goods came from. Each order is placed by hand on the same checkout any customer uses, and the order ID or message thread is logged to the case the moment the sale closes.

The Ship-To Address Is Chosen for the Court That Will Hear the Case

Where a purchase is meant to support personal jurisdiction, the delivery address sits in the state of the court that will hear the case. In NBA Properties, Inc. v. HANWJH, 46 F.4th 614 (7th Cir. 2022), one purchase by the plaintiff's investigator, shipped to an Illinois address before suit, supported jurisdiction over the seller. In Liu v. Monthly, No. 25-2074 (7th Cir. Mar. 31, 2026), checkout screenshots with a Chicago address and no completed order did not, and the default judgment was vacated. Our buys are completed, delivered and documented to the address counsel designates in that state, and the person who receives the parcel signs a statement of receipt.

The Package Is Opened Once, on Camera

The parcel is logged on arrival with the date, time and receiving investigator. Before it is opened we photograph the sealed outer package, the shipping label, the return address, any customs declaration and the carrier markings. The opening is recorded on continuous video from the uncut seal to the last insert.

The product is then photographed on a measurement grid under fixed lighting: front, back, both sides, top and bottom, every label, the barcode, every lot code, serial number and expiration date, every safety seal and hologram, and the product with its packaging. Inserts, invoices and packing slips are photographed and kept. Weight is recorded. Every photo and video file is hashed with SHA-256 on upload.

The item, its packaging and every insert are labeled with the case number and placed in secure evidence storage. Each later handling is entered on the custody log with the name of the person and the time.

Authentication Is Measured Against the Genuine Article

The received product is compared three ways: against the brand's genuine reference, against the seller's own listing photos, and the listing against the brand's official images to show whether the seller used the brand's pictures to sell something else. We document each difference by type and location: print and font, color, logo size and placement, label text and regulatory marks, barcode and UPC registration, dimensions against the grid, missing or altered seals, and lot or serial codes that do not exist in the brand's records.

Our report states what we observed. The finding that an item is counterfeit belongs to the brand's own authentication team or its lab, and the sealed item is shipped to them under custody when they need it in hand. For gray market and diversion matters the same examination shows genuine goods with stripped or scratched batch codes, foreign market packaging or a lot the brand sold to a specific distributor.

The Purchase Shows Who Is Behind the Storefront

A completed order surfaces facts a listing never shows. We record the merchant name on the payment record, the seller's registered business name and address where the marketplace discloses them, the shipper and the shipping origin, the return address, the sender on the customs form, the names, phone numbers and web addresses on inserts and invoices, and the route a refund or return would take.

Those facts are checked against every other buy in the matter. When storefronts with different names ship from the same return address, use the same merchant account or pack the same insert, we document the link. That connection is what joins defendants in one suit and points the next stage of the investigation toward the importer and the maker. Identifying who is behind the network is the work of our counterfeit product investigations.

The Investigator With Firsthand Knowledge Signs the Declaration

Each buy can be delivered with a sworn declaration signed by the licensed investigator with firsthand knowledge of the purchase and handling, with the custody log showing every person who handled the item. It attaches the listing capture, the order and payment records, the delivery record and signed statement of receipt, the unboxing video, the photo set and the custody log as exhibits. Where a matter goes to a hearing or trial, that investigator is available to testify to the purchase and the handling.

The Evidence File Arrives Ready to Attach

For each buy the client receives:

The frozen listing: page image, source code, product photos and SHA-256 hash values.
The order confirmation, payment record and tracking history.
The sealed package and label photos, the unboxing video and the full product photo set.
The comparison against the genuine reference, with each discrepancy marked.
The seller identity sheet: merchant name, business name and address, return address, shipper, customs sender and insert details.
The chain of custody log.
The sworn declaration, when ordered.

Files arrive in a format that drops straight into a marketplace complaint, an Amazon Report a Violation submission, a demand letter or a court filing.

One Buy, a Schedule of Sellers or a Standing Program

Single buys answer a single question. Batches cover a full Schedule of defendants or every unauthorized seller on a product. Standing programs run scheduled buys across a brand's top products, distributors and repeat offenders each month, with rapid buys added when a new listing or complaint appears.

Each buy is $295 plus the cost of the product. Buys are ordered in batches, and every batch is paid in full before work starts. Larger counterfeit investigations include a set number of buys inside a fixed fee. The physical item is held for 14 days after the report at no added charge. The client then directs whether it is stored longer, sent to a lab or the brand, shipped to counsel or destroyed, and the disposition is logged.

The Principal Behind the Program

E3 Legacy Intel is a division of Southern Recon Agency, LLC, a Florida licensed investigative agency. The firm is led by Matt Aubin, CDFE, FBCI, Managing Partner, with seventeen years in cybercrime and open source intelligence. He ran operations for one of the first Amazon unauthorized seller enforcement programs, working for brand owners and their outside counsel, and his casework spans counterfeit and diversion operations across Amazon, eBay and Walmart. He has investigated cases jointly with the FBI, the SEC, the U.S. Secret Service and the U.S. Marshals, and has been qualified in court as an expert witness in cyber intelligence and cyber forensics. Coverage is nationwide, investigated from Florida. Read more about E3 and Matt Aubin.

The Test Buy Feeds the Rest of the Case

Counterfeit product investigations, identifying the sellers and the supply behind the fakes.
Brand protection investigations and the monthly brand enforcement program.
Product diversion and gray market investigations, where the buy proves which distributor leaked the goods.
Organized retail crime investigations, where stolen goods resurface online.
Marketplace pages for TikTok Shop, Shein and Temu, Walmart Marketplace and resale marketplaces.
Sellers facing a counterfeit complaint they believe is false should start with our Amazon counterfeit complaint investigation.

Questions Brand Owners and Counsel Ask Before the First Buy

What is a covert test buy?

A covert test buy is a purchase of a suspect product by an investigator who cannot be connected to the brand or its counsel. The investigator captures the listing before ordering, the package is opened on continuous video, and the item is held under chain of custody and compared against the genuine product. The result is physical proof of what the seller ships and facts about who the seller is.

Can the brand just buy the product itself?

It can, and that gives the seller's lawyer an opening. A buy by the brand or its law firm invites a challenge to bias and handling, can expose the brand's people as witnesses and can tip off the seller. A licensed independent investigator removes those problems and can testify to the purchase and the handling.

Will a test buy hold up in court?

Investigator purchases are routine evidence in trademark and counterfeit cases. In NBA Properties v. HANWJH (7th Cir. 2022), a single purchase by the plaintiff's investigator, delivered to Illinois, supported personal jurisdiction. What makes a buy hold up is a completed order, a listing captured before purchase, an unbroken custody log and a declaration from the licensed investigator with firsthand knowledge of the purchase and handling.

Does Amazon need a test buy to act on a counterfeit report?

Its Report a Violation form asks for the order ID of a test purchase on counterfeit reports, and a report backed by a delivered order and a documented examination carries more weight than one based on photos of the listing. We supply the order ID, the examination and the evidence file in a form ready for submission.

Can you buy from TikTok Shop, Temu, Shein, DHgate and Alibaba?

Yes. Along with Amazon, eBay, Walmart Marketplace, Etsy and Facebook Marketplace, we buy on TikTok Shop and live stream sales, from Instagram, Facebook, WhatsApp and Telegram sellers who close in direct messages, and on Temu, Shein, AliExpress, DHgate and Alibaba sample and small lot orders. Overseas orders are received in the United States with the customs paperwork preserved as evidence of where the goods came from.

What do you capture about the seller?

The merchant name on the payment record, the seller's registered name and address where the marketplace discloses them, the shipper, the shipping origin, the return address, the customs sender and every name or contact on the inserts. Matched across many buys, those facts show which storefronts are one operation.

How much does a test buy cost?

Each buy is $295 plus the cost of the product. Buys are ordered in batches and each batch is paid in full before work starts. A sworn declaration and expanded seller identification are quoted per matter in writing.

What happens to the product after the report?

It stays sealed in evidence storage for 14 days at no added charge. The client then decides whether it is stored longer, sent to a lab or the brand's authentication team, shipped to counsel or destroyed. Every movement is entered on the custody log.

Bring us the listings. We will tell you which buys answer the question and what the evidence file will show.