The Canal Street Method

Every enterprise CISO knows, somewhere below the budget slides, that the multi-million-dollar security stack is a house of cards waiting for one highly motivated, well-funded actor to find the single unpatched flaw, the one misconfigured bucket, or the one employee who resets the wrong account. The stack is not the thing that fails. The seam between two trusted things is.

In 2025, Louis Vuitton stopped being a hypothetical for this. Roughly 419,000 customers had their data exposed, names, addresses, phone numbers, email, purchase history, and passport details, across South Korea, the UK, Turkey, Taiwan, Hong Kong, the US, Italy, and Sweden. LV's own account of the cause: a compromised third-party service provider account. No zero-day on the storefront. No breach of the payment vault. The firewall held the entire time. Someone walked in through a vendor the brand already trusted, and the damage, lawsuits, a Hong Kong regulator investigation into delayed notification, a class-action posture in the US, is still unfolding.

I call the engagement that finds this first, before the actor does, the Canal Street Method. It is a New Yorker's joke with a real thesis underneath. Canal Street is where you learn that a fake does not have to be perfect. It has to pass at the counter, in the moment, at a glance, under time pressure, to someone who processes a hundred of them an hour. Every vector below is the same move in a different costume: a credential, a voice, a traveler, or a payment authorization that is good enough to pass the counter. And the counter is never more distracted than at Christmas.

This is a hypothetical holiday red-team against a Maison the size of Louis Vuitton. Nothing here is a report of an engagement against LV. It is the threat model, built on breaches that already happened, modeled on the crew running this playbook right now, with the mechanisms named and one of them written out in code.

The red team of the moment is already doing this

You do not have to imagine the adversary. Through 2025, one loosely-organized crew, tracked by MITRE as G1015 and known publicly as Scattered Spider, ran the same playbook across retail: Marks & Spencer (reported at £324 million in lost sales), Harrods, and the Co-op. The entry technique was not malware. It was the help desk. In the Co-op case, by the CDIO's own testimony to Parliament, the attacker impersonated an employee, answered the security questions, and had the account reset. The FBI and CISA issued joint advisories specifically about this group tricking IT help-desk staff into resetting credentials and registering new MFA devices (MITRE ATT&CK T1556, exploiting T1199, Trusted Relationship, when it comes in through a vendor). Four people aged 17 to 20 were arrested in the UK in July 2025.

That is the baseline. A Maison's actual attack surface in 2026 is this playbook, pointed at a luxury group's specific seams, during the one quarter when volume is highest and scrutiny is lowest.

The stack you are actually defending

A group the size of LVMH does not run one monolith. Publicly, since its June 2021 strategic partnership with Google Cloud, the group has leaned on cloud-based AI for demand forecasting, inventory optimization, and personalized customer experience. Underneath the brand, that resolves to a predictable set of load-bearing layers, and the Canal Street Method targets the joints between them, not the boxes:

• The cloud and data foundation that every brand's storefront and clienteling tool reads from and writes to.
• The third-party vendor mesh, loyalty platforms, CX tools, logistics, analytics, each holding a trusted credential into the group. This is the layer that actually failed in 2025.
• The identity and help-desk layer that can reset any of it under the right pressure. This is the layer Scattered Spider owns.
• The travel-retail channel, airport boutiques and duty-free, operating cross-border, on compressed timelines, for exactly the high-net-worth clients whose passport and purchase data is now, demonstrably, in the wild.
• The emerging agent layer, the AI clienteling and shopping agents the group's own AI strategy is pushing toward, and the payment mandates being built to authorize them.

Four counters. Four fakes. One holiday season.

Vector 1: the vendor credential that passes

The 2025 breach is the template, so it is vector one. A luxury group grants standing trust to dozens of outside providers, and that trust is a credential, an API key, a federated identity, a service account, that the inner systems honor without re-examining who is holding it. Compromise the weakest provider, inherit its trust, and you are inside the group without ever touching the brand's own hardened perimeter. T1199, Trusted Relationship, is the whole game.

The modern acceleration is on the reconnaissance side, not the exploit. Language models let an actor build a convincing, provider-specific pretext at scale, who the vendor's account managers are, what their ticket language sounds like, which of them has access to which brand, assembled from public sources faster than a defender can reason about the exposure. The fake that passes here is a support request or a login that looks exactly like routine vendor traffic. In December, buried under holiday volume, it looks like nothing at all.

Vector 2: the voice at the help desk

This is the Scattered Spider vector, upgraded for the season. The help desk exists to unblock people who are genuinely locked out, and at Christmas it is drowning, high turnover, seasonal temps, every associate under pressure to resolve and move on. That pressure is the vulnerability, not any one person's judgment.

The counter here is identity verification, and the fake is a synthetic one. The 2025 version was a confident human reciting pre-built answers to the security questions. The 2026 version adds a real-time cloned voice, enough of a target's audio scraped from a conference panel, a podcast, a product launch, to pass a voice check and to sound like the stressed executive who needs an MFA device re-registered before a flight. The technique the Co-op attacker used by hand is the technique an actor now runs faster and against more targets at once. The outcome is the same: a password reset or a new MFA device, handed to the wrong person because the fake passed the counter. Mapped cleanly to T1556 and the FBI/CISA advisory on G1015, this is not speculation; it is the documented method, re-aimed.

Vector 3: the client who is flying soon

This is the vector the LV breach built and nobody has priced yet. The stolen data was not only identity. It was passport details plus purchase history, for clients of a brand whose highest-value customers are, by definition, frequent international travelers. That combination is a travel-retail targeting kit.

Consider what the travel-retail channel actually is: airport boutiques and duty-free, operating across borders, on the clock, for a customer who is mid-transit, time-pressured, and hard to re-verify against a home system. The clienteling handoff from a city flagship to an airport location, the VAT and duty-free refund flow, the VIP appointment booked ahead of a departure, each is a counter where a traveler's identity is confirmed quickly and trust is extended generously, because the client is a known high-spender who is about to board.

The fake that passes here is a traveler. With a target's passport data, purchase history, and the knowledge that they are flying, an actor can impersonate the client to a travel-retail or concierge touchpoint, intercept or redirect a clienteling handoff, or abuse the tax-refund path, all in the window where verification is a formality and a declined check means a furious VIP missing a flight. The stolen passport is the Canal Street fake, and the airport is the counter least able to inspect it. For a group, the engagement question is blunt: once a client's travel-grade identity is out, which of your channels still treats "about to fly" as a reason to verify less?

Vector 4: the mandate that passes

The forward edge, and where the counter is being built right now with the fake already in mind. The group's own AI direction points at agents, clienteling assistants, inventory agents, and the external shopping agents that will transact on a customer's behalf. Commerce is already the center of gravity for this: Akamai's State of the Internet reporting found nearly half, 47.9%, of all AI bot traffic on its network in the second half of 2025 was in the commerce vertical. The honest shoppers and the fakes now arrive through the same door.

Authorization is the contested layer, and the industry's answer is Google's Agent Payments Protocol (AP2), which wraps agent purchases in signed, verifiable-credential "mandates": an Intent Mandate for the goal, a Cart Mandate for the exact items and totals, a Payment Mandate for the transfer, each carrying constraints like a spend cap, an allowed-merchant set, an expiry, an agent identity, and a human-present-or-not flag. A representative Cart Mandate, the structure the protocol describes, looks like this, annotated with the fields that decide whether a fake passes:

{
  "type": ["VerifiableCredential", "CartMandate"],
  "issuer": "did:web:agent.example-maison.com",
  "credentialSubject": {
    "agent_id": "agent-7f3c",            // must bind to the agent that was authorized
    "intent_ref": "urn:mandate:intent:9a1b", // must chain back to a real Intent Mandate
    "cart": {
      "currency": "EUR",
      "total": "4200.00",
      "items": [{ "sku": "M41177", "qty": 1, "unit_price": "4200.00" }]
    },
    "constraints": {
      "allowed_merchants": ["*"],         // Canal Street: wildcard scope = reusable anywhere
      "max_amount": "50000.00",           // ceiling far above the cart = room to escalate
      "human_present": true,              // a claim, only as good as what verifies it
      "expiry": "2026-12-26T00:00:00Z"    // long TTL = a stolen mandate stays valid for days
    },
    "nonce": null                         // no nonce = nothing stops replay
  },
  "proof": { "type": "DataIntegrityProof", "verificationMethod": "did:web:agent.example-maison.com#key-1" }
}

The mandate is counterfeit-resistant only where every one of those fields is tight and actually checked. A wildcard allowed_merchants, a max_amount ceiling far above the cart, a multi-day expiry, a missing nonce, or a human_present flag that no channel independently verifies, and you have a Canal Street fake in protocol form: a payment authorization that is structurally valid enough to pass, reusable past the one transaction it was signed for. Published research already names this surface. The arXiv paper "Whispers of Wealth" red-teams AP2 directly through prompt injection, and Palo Alto's Unit 42 warns that an agent able to trigger refunds on its own lets a fraud ring push on the order of 10,000 returns in a single hour. The emerging countermeasures, Know Your Agent identity, least-privilege mandates, action logging, exist precisely because the fake is expected.

That annotated mandate is not a thought experiment. I wrote the counterfeit check as a small, dependency-free validator, a lint for AP2 Cart Mandates, and ran it against three: one clean in-store purchase, the holiday-wildcard mandate above, and an unbound cart that authorizes itself. It is public at github.com/ghostintheprompt/canal_street_lab, stdlib only, with a passing test suite and every finding mapped to its nearest CWE. Real output:

[PASS] clean-store-purchase
[FAIL] holiday-wildcard  (5 issues)
         - WILDCARD_SCOPE (CWE-863): allowed_merchants is empty or '*'; reusable at any merchant
         - LOOSE_CEILING (CWE-863): max_amount 50000.00 >> cart total 4200.00; escalation headroom
         - REPLAYABLE (CWE-294): no nonce; same mandate can be submitted repeatedly
         - LONG_TTL (CWE-613): expiry 132h out (> 24h); standing token
         - UNVERIFIED_PRESENCE (CWE-287): human_present=true with no presence_evidence to check
[FAIL] unbound-self-authorizing  (4 issues)
         - UNBOUND_AGENT (CWE-639): no agent_id; any agent can present this mandate
         - NO_INTENT_CHAIN (CWE-345): no intent_ref; cart authorizes itself
         - REPLAYABLE (CWE-294): no nonce; same mandate can be submitted repeatedly
         - UNVERIFIED_PRESENCE (CWE-287): human_present=true with no presence_evidence to check

1/3 mandates passed the counterfeit check.

The honest part is what the lint refuses to claim. It reads structure, so it cannot tell you the signature is genuine (that needs the issuer's key), that intent_ref chains back to a real user-signed Intent Mandate rather than a string that merely exists, or that human_present: true was ever a human. Those three are the hard problems, and a static check that pretended to solve them would be its own Canal Street fake. What it does do is catch the forgeries that pass today because nobody read the fields, which is most of them. The engagement is to run this against your real mandates before the holiday traffic hides a million of them.

One fake funds the next

Each fake is worse because it hands off to the next, and that handoff is the part a one-vector pentest never shows. The vendor credential from the first seam puts the actor inside the group's systems, where the clienteling records live, the same records that in LV's real breach carried passport data and purchase history. That data is the script for the help-desk call: enough verified detail about a real client to pass the identity questions and get an account reset. The reset access reads the appointment and travel calendar, which VIP is flying, from where, and when, which feeds the impersonation at the airport counter. The agent layer closes the loop, because a client who now shops through an assistant can have a mandate minted or lifted that spends under their name past the one purchase it was signed for. Run these as four findings and a client patches four things. Run them as one chain and they see the real blast radius, which is the entire reason the engagement prices where it does.

The seams, not the boxes

The firewall was never the house of cards. The seams were, between the brand and its vendors, between the help desk and the people it serves, between the city store and the airport, between the shopper and the agent shopping for them. A standard penetration test points tools at the boxes and reports on the boxes. The Canal Street Method points a motivated adversary at the joints and reports what passed the counter, mapped to the frameworks a board already answers to: MITRE ATT&CK and the G1015 advisories, the OWASP guidance on excessive agent agency, the AP2 and Know Your Agent controls, the CWE codes under each finding.

It scales down. A smaller house does not run LVMH's stack, but it has the same four seams and far less staff watching them, which is exactly why the method is worth more there, not less. We run it as a hypothetical, authorized, non-destructive simulation, scoped to the seams, priced on the blast radius we can demonstrate rather than hours on a timesheet, and timed to land before the counters get busy. That last part is not a flourish. The window that matters closes on Black Friday. This is the work MDRN Red Team Sec does, and the holiday is the deadline, not the theme.

GhostInThePrompt.com // A fake does not have to be perfect. It has to pass the counter, and at Christmas, nobody is checking.