Fraudsters spy out credit card details or get hold of personal details of online shoppers on the dark web.
Fraudsters visit online shops, claiming to be the owner of the stolen means of payment. They order products in the name of the actual owner which they can then easily sell on.
Neither the online retailer nor the actual owner of the means of payment know anything about the data theft. Unaware that anything illegal is happening, the retailer dispatches the products to the fraudster's address.
The rightful owner of the means of payment notices the fraud and commissions the bank to reverse the payment. The retailer then not only loses both the products and revenue, but must also pay chargeback fees.