Click and Collect fraud is on the rise as retailers are failing to check ID when customers pick up orders, it can be revealed.
The Daily Telegraph sent mystery shoppers to pick up prepaid for parcels at branches of Waitrose, M&S and Tesco, where staff failed to follow their own security policies by handing over items without checking either IDs, payment cards, or order numbers.
According to security experts hundreds of thousands of shoppers are being targeted by fraudsters who are using click and collect as an easy way to steal pre-paid for items.
It comes amid an online shopping boom which has led to a record £1 in every £5 spent in shops now coming through online orders.
Action Fraud, the City of London police's fraud arm, said it was currently looking into 562 reports of fraud where “click and collect” had been mentioned, with around a third of these relating to instances where fraudsters have stolen click and collect items by posing as shoppers.
Security experts accused shops of not doing enough to combat click and collect fraud, including conducting proper checks on IDs and payment cards.
Click and collect is a free and highly convenient service which lets online shoppers pay for items online and then pick them up either in their local branch of a shop, or sometimes an independent local newsagent or business.
However experts warned it is making life easier for organised crime gangs who are trying to gain access to shoppers' online accounts to steal items. It is also being abused by shoppers' friends and family members who are gaining access to people's emails and credit cards to steal items by picking them up in store.
When picking up an item from M&S the mystery shopper was only asked to provide their name before receiving the parcel, despite M&S's policy stating that staff must first ask for proof of purchase and a postcode.
At Waitrose this newspaper's mystery shopper was asked to provide their name and ID or payment card before receiving the item, which is in line with its company policy.
However on presentation of a library card, which does not count as official ID, the shopper was handed their parcel.
At Tesco the mystery shopper was only asked for a last name and asked to sign a form before the parcel was handed over. Tesco's policy states that shoppers must first present an order number, payment card, clubcard or photo ID.
Sainsbury's and Argos staff correctly followed their own policies of asking shoppers to produce proof of order, or ID.
Joseph Carson, chief security scientist at security firm, Thycotic said retailers were failing to step up ID checks to prevent click and collect fraud.
He said: "They're more interested in the bottom line than they are interested in security. They're more focused on getting revenue in and dealing with security afterwards. It's more mostly the retailers are being notified from the banks or from law enforcement.
"Typically it's the bank that notifies the retailer of a potential malicious activity occurring within their retail stores."
Jason Lane Sellers, director of fraud and identity management at LexisNexis Risk Solutions, said a higher risk of theft existed because customers expect to be able to pick up items from small local shops, which are out of control of national chains.
An M&S spokesman said: “M&S does not have an issue with fraudulent online order collections. We have a system in place to ensure that orders are handed out to the right customers. We have spoken to the store referred to in this piece to ensure that they are following this system.”
A Waitrose & Partners spokesman said: We apologise this has happened and will investigate why our procedure has not been followed on this occasion in this shop."
A Tesco spokesman has been contacted for comment.