That sounds... weird?
Not saying it doesn't happen, but if this is indeed the case, what is preventing the same scammer from essentially registering all still-unregistered UPC codes to do something akin to domain squatting?
(I am not familiar with how Target online works so maybe I am missing something)