E-commerce sites got smart and kicked out affiliate networks that made suspiciously high claims, Grossman says, but scammers responded by stuffing cookies from SSL Web pages because the cookies don't reveal what pages they came from.

Online ordering systems can also be a risk to businesses, Grossman warned. Home shopping network QVC was hit for $412,000 in merchandise by one scammer because of a lag in its online ordering system, he says. Customers could order items online then immediately cancel the order, but the order would be sent anyway.

A North Carolina woman took advantage of this: She ordered and canceled merchandise, then sold it on e-Bay. She was caught only because her customers thought it odd that she was mailing the items in QVC packaging and reported her.

She wasn't prosecuted for selling the goods because they were legally hers, Grossman says. Rather she pleaded guilty to wire fraud, he says.

Other potentially lucrative hacks include:

* Guessing the numbers of online discount coupons and buying merchandise with them. One scammer got $50,000 worth of merchandise and was caught because he entered his new batches of guessed coupon numbers all at once in the middle of the night, causing a suspicious spike in traffic that the merchant noticed. He was prosecuted for mail fraud because items were sent to a non-existent address and a colluding postal worker intercepted them and turned them over to him.

* Setting up multiple bank accounts and arranging for transfers among them. Before banks actually make electronic transfers they make a small transfer—cents or a few dollars—just to make sure the real transfer will work. Scammers arrange for large transfers to a central account, then cancel them after the dry run transfer. Enough of those can add up, Grossman says.

* Cracking captchas, the distorted numbers and letters that some sites use to verify that a human being, not a machine, is contacting the site. Some captchas use the same number-letter combinations over and over, so automated guessing can work to crack them, says Evans. Some sophisticated optical scanners can read captchas, and there are even overseas businesses that offer to break them for cash.