The Outlier Lab

Refund and Return Fraud

Wardrobing, empty-box and item-swap returns, receipt-less and counterfeit-receipt returns, false refund claims and refund-as-a-service operations that extract refunds for goods kept or never paid for.

What it is

Returns are a refund rail. Policies built for customer convenience (no-receipt returns, refund-at-first-scan, "keep it" refunds, appeasement credits) all release value before the retailer can confirm what came back. Refund and return fraud exploits that ordering.

Recent industry figures:

  • 2024: U.S. returns totaled $685 billion (13.21% of retail sales). Fraudulent returns and claims cost $103 billion, about 15.14% of returns, including about $21 billion from claims and appeasement fraud and abuse (Appriss Retail and Deloitte).
  • 2025: Returns grew to $706 billion. Preventable return loss from fraud and abuse was about $100 billion (14.2% of returns), mostly abuse (12%) rather than outright fraud (2%). Buy-online-return-in-store (BORIS) is the fastest-growing fraud and abuse vector, with about $4 billion in cross-channel fraud (Appriss Retail 2026 benchmark).
  • Merchant view: Refund and policy abuse became the top fraud attack type in the Merchant Risk Council's 2024 survey for the first time in 25 years. 48% of merchants cited it, ahead of first-party misuse (45%) and phishing (42%). It kept the top spot in 2025.

The fraud-vs.-abuse split matters more here than almost anywhere else. Most dollars are abuse: real customers bending lenient policies. Responses have to be proportionate. Over-tightening has a measurable cost: 55% of consumers say they've avoided a retailer because of restrictive return policies (Appriss Retail, 2024).

How it works

Diagram: Acquire goods: purchase, promo, stolen tender, theft, Initiate: return, claim or support contact, Refund decision: policy, scoring, agent, Refund rail: card, wallet, store credit, gift card, Monetize: keep, resell, repeat

Main families (conceptual):

FamilyMechanismNotes
WardrobingUse, then return as newMost common type retailers cite (60%)
Stolen-merchandise returnsReturn goods that were never boughtOrganized retail crime cash-out (48% of retailers cite)
Fraudulent or stolen tenderBuy with stolen cards, counterfeit or fraudulent gift cards, then return for clean value55% of retailers cite; ties to Card-Not-Present Fraud and Gift Card Fraud
Counterfeit receipts or e-receiptsFake proof of purchase or price48% of retailers cite; same evidence problem as Receipt Fraud (Cashback)
Empty-box, partial and item-swapReturn a box with nothing, less, or a substitute or counterfeitEmpty boxes were the top indicator of fraudulent online returns (31%)
False INR, damage or missing-item claimsClaim non-delivery or damage to get a refund without returning anythingOn marketplaces, see Buyer Protection Claim Abuse (INR and SNAD)
Price-arbitrage returnsReturn discounted or promo items at full price; return the paid item in a BOGO and keep the free oneSee Promo Code Abuse and Coupon Counterfeiting and Misredemption
Employee fraud or collusionStaff process fake returns or approve refunds for items never received39% of retailers cite
Refund-as-a-servicePaid operators file claims for customers using social engineeringFees of about 10–35% of order value (see below)

(Percentages are the share of retailers surveyed citing each type, from Appriss Retail and Deloitte's 2024 report.)

Transaction footprint

StageWhat you see in the dataDecision point
Original saleTender type (card, gift card, BNPL), promo applied, channel, account ageFlag high-risk tenders and items for stricter return terms
Return or claim initiationChannel (store, mail, support chat), reason code, time since delivery, account return historyAllow self-service? Require inspection? Route to review?
EvidenceReceipt (or not), tracking and carrier scan data, package weight, photosValidate receipt; reconcile weight and scan events
Refund timingRefund at first carrier scan vs. at warehouse receipt vs. after inspectionThe central policy lever
Refund railOriginal tender vs. store credit vs. gift cardRestrict cash-equivalent refunds on risky returns
Post-refundWarehouse discrepancy (empty or swapped); repeat patterns across linked accountsRebill, restrict, ban, refer

Refund timing and refund rail are the two strongest levers. Refunding at first carrier scan is great for customer experience and is exactly what empty-box and false-tracking schemes target. Refunding to store credit or the original tender (not a new card or gift card) shuts down the cash-out leg of stolen-tender returns.

Common variants by channel

ChannelVariants that dominateKey evidence
In-store (BISRIS: buy in store, return in store)Wardrobing, receipt fraud, stolen goods, employee collusionReceipt, ID capture, associate behavior
BORISStolen-tender online purchases returned in store; cross-channel identity gapsUnified customer ID across channels
BORO (buy online, return online)Empty box, swap, false tracking, refund-at-scan abuseCarrier scans, weight, warehouse inspection
Support-led claimsINR, damaged item, missing item; refund-as-a-serviceAccount history, contact patterns, delivery proof
Delivery and foodMissing or wrong items; repeated complaintsCourier data, photo-on-delivery, PINs

Refund-as-a-service (conceptual)

Refund fraud has been industrialized into a service. Operators recruit customers who want a refund on an order they keep, and file the claim themselves through the retailer's support channels, typically for a fee of about 10–30% of order value, paid after the refund succeeds (Netacea). Recent public evidence:

  • Research: A Cifas-funded study involving the University of Portsmouth (May 2026) analyzed nearly 500,000 posts in online fraud communities. It estimated refund fraud may cost UK online retailers up to £5.76 billion a year, with service vendors taking up to 30% of the refund. Offenders were mostly young males (average age 19).
  • Litigation: In an Amazon civil suit filed in late 2023 (W.D. Wash.), a court entered a default judgment totaling more than $2.4 million in February 2025 against an alleged refund-service operator and four former warehouse workers. Of that, $2 million was awarded against the operator and the balance against the workers; Amazon's own "$2M" figure refers to the operator award. The operator charged 30–35% of product cost, used social engineering against support agents, and bribed insiders. The insiders approved returns for products never returned, totaling more than $400,000 (Courthouse News).

It's hard to catch because the requester's account is often legitimately good and the operator is an experienced social engineer. Account-level history alone won't catch it. Look at contact-level and claim-pattern signals instead: claim scripts, contact channels, delivery-proof contradictions, and clusters across accounts (Customer Contact Signals, Customer Support Verification Protocols).

Where it shows up

  • Retail and Ecommerce: all channels; BORIS growing fastest.
  • Online Marketplaces: returns intersect buyer protection and seller liability; see Buyer Protection Claim Abuse (INR and SNAD).
  • Delivery platforms: refund abuse is nearly half of consumer fraud on delivery apps, per Incognia via AOL. In one press-reported case, one person created over 200 accounts and received $4,163 in refunds on more than $5,000 of orders while paying $851.
  • Cashback, Coupons and Rewards: rewards that survive returns.
  • Financial side: refunds to a different instrument than the original tender act as a laundering path for stolen cards and gift cards (Money Mules). Refund disputes overlap with Chargeback and Friendly Fraud when customers dispute instead of returning.

Impact

  • Direct: refunded value plus unrecoverable goods; claims and appeasement losses (about $21B in 2024 per Appriss Retail and Deloitte).
  • Operational: returns processing, inspection, support handling, investigations.
  • Downstream: inventory shrink, resale of counterfeits swapped back into stock, chargeback exposure.
  • Customer experience: tighter policies cost good customers. Measure the trade-off (Friction and Customer Experience Tradeoffs). Appriss Retail reports 90% of consumers would buy again after receiving a warning about abusive returns, which supports graduated messaging over blanket restrictions.

Red flags

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventClaims and Returns Policy ControlsRisk-tiered refund timing (at scan vs. at inspection), refund-to-original-tender, item-level return windows
PreventReceipt and Purchase VerificationValidate receipts against POS; ID capture on no-receipt returns
DetectMachine Learning Models on return and claim historyPer-customer, per-item scoring, with graduated responses
DetectGraph AnalyticsRing and refund-service clusters across accounts and addresses
RespondCustomer Support Verification ProtocolsAgent scripts and escalation for high-risk claims
RespondInsider Access ControlsApproval logs and anomaly review for staff
RespondConsortium and Data SharingCross-retailer intelligence on habitual abusers and refund-service patterns

Emerging variants and adversary adaptation

  • GenAI evidence. AI-generated receipts and "damaged item" photos lower the cost of evidence-based claims. The 2025–2026 expense-fraud data (see Receipt Fraud (Cashback)) suggests the same curve is coming to returns. Validate claims against transactional and logistics data, since images are now cheap to fake.
  • Refund-as-a-service professionalization (Portsmouth/Cifas 2026; the 2025 Amazon civil judgment): insider recruitment, carrier-account compromise and social-engineering scripts. Defenses move to support channels and logistics partners.
  • AI-driven return decisions and their trust gap. Retailers are adopting automated return-risk scoring. 80% of consumers want transparency on AI return decisions, and 71% trust human associates more (Appriss Retail 2026). Plan explainability and appeal paths.
  • Cross-channel seams. BORIS growth means online-purchase identity has to follow the item into the store.
  • Adaptation to tightening. When refund-at-scan is restricted, abuse shifts to INR and damage claims, which don't need a shipment. Measure the whole claims portfolio so a shift from one reason code to another shows up.

Real-world examples

  • Amazon civil-suit default judgment (W.D. Wash., Feb 2025): over $2.4M in total, $2M of it against the alleged refund-service operator and the rest against four former warehouse workers who approved more than $400,000 in fake returns (Courthouse News).
  • A guilty plea (Dec 2021) by an individual who defrauded a retailer of more than $300,000 through refund fraud over three years (Netacea).
  • Case Study - Amazon Refund-as-a-Service Crackdown (2023-2026): the REKK suit plus DOJ cases against refund-service operators, with sentences through 2026

Sources and further reading