Retail and Ecommerce

Business model and fraud surface

A retailer is the merchant of record. For card-not-present sales that means it carries fraud liability unless authentication (3-D Secure, network tokens with qualifying data) shifts it to the issuer. It also carries chargeback fees and network monitoring-program exposure, plus the full cost of its own refund, return, promotion and gift card policies. Unlike banks, retailers have few regulatory floors, so most of their fraud exposure comes from policies they wrote themselves.

Where value leaves, and how quickly it becomes unrecoverable:

The numbers. The MRC's 2026 survey of 1,278 merchants put payment fraud at 3.2% of global ecommerce revenue. 62% of merchants reported more first-party misuse disputes and 57% more refund/policy abuse. Refund/policy abuse has been merchants' most common attack in the MRC survey since 2024. On returns, Appriss Retail estimated $706B of merchandise returned in the US in 2025, and about $100B (14.2%) of it preventable fraud and abuse. The NRF and Happy Returns projected $850B in returns for 2025 (15.8% of sales; 19.3% online) and estimated 9% of returns are fraudulent. Methods differ, so read these figures as a range of estimates.

Decision points: account creation, login, checkout scoring and 3DS routing, payment method add, promo application, fulfillment release (especially BOPIS handover), return authorization and refund timing, claim adjudication, gift card activation and redemption, loyalty redemption, and representment.

What fraudsters want here

Fraud across the customer lifecycle

Top mechanisms, ranked

1. Refund and Return Fraud: wardrobing, empty boxes, item swaps, stolen-merchandise returns, counterfeit receipts and refund-as-a-service. In Appriss Retail's 2024 survey, 60% of retailers cited wardrobing, 55% returns with fraudulent or stolen tender, and 48% stolen-merchandise returns. NRF-reported increases centered on overstated return quantities, empty boxes and decoy returns. BORIS returns are the fastest-growing fraud and abuse vector (Appriss, 2025).
2. Chargeback and Friendly Fraud: cardholders disputing legitimate purchases. The MRC says first-party misuse is up to 80% of fraud-related chargebacks for many members. Visa's Compelling Evidence 3.0 (2023) and Mastercard's First-Party Trust (2024 US rollout) give merchants data-driven defenses.
3. Card-Not-Present Fraud: stolen and phished card data buying resalable goods. Phishing-fed, freshly provisioned wallet tokens shorten the time from compromise to fraud.
4. Promo Code Abuse: leaked and stacked codes, new-customer offers farmed through Multi-Accounting, and code enumeration. Ravelin's survey found 53% of merchants saw more promo abuse.
5. Card Testing: enumeration and account testing at weak checkouts and donation-style pages. Visa's VAMP now tracks enumeration (a 20% ratio with 300,000+ attempts) alongside fraud and dispute ratios.
6. Gift Card Fraud: stolen cards buying gift cards, balance draining, and gift cards as the payment method in scams. Scammers name specific retail brands, so retailers see the purchase at their registers. The FTC found gift cards were the most-reported fraud payment method from 2018 through 2021, and about one in four people who lost money paid with them.
7. Account Takeover (ATO): monetizing saved cards, loyalty points and store credit, often with BOPIS to avoid address checks.
8. Buyer Protection Claim Abuse (INR and SNAD): "never arrived" and "damaged" claims. Appriss estimated about $21B in claims and appeasement fraud and abuse in 2024.
9. Loyalty and Rewards Redemption Fraud: points theft via ATO, insider manipulation, logic-flaw redemptions.
10. Business Logic Exploitation: price errors, stacking bugs, race conditions in gift card and promo redemption. Rare, but they can run up large losses within hours.

Also relevant: Triangulation Fraud (the retailer is often the unknowing merchant whose goods are bought with stolen cards to fulfill marketplace orders), Insider Fraud (39% of executives cited employee return fraud or collusion), and Agentic Commerce Fraud (63% of MRC 2026 merchants are exploring agentic payments, and agent authorization and liability are unsettled).

Regulatory environment

Retail fraud is governed more by network rules and contracts than by statute:

Key metrics

General definitions: Fraud Metrics and KPIs, Loss Taxonomy and Attribution, Fraud Labeling and Feedback Loops (chargeback and return labels mature on different clocks).

How fraud teams are typically organized here

Retail fraud often sits in payments (finance-aligned) or loss prevention (stores and operations), and the split shapes blind spots:

• Payments/ecommerce fraud: checkout risk, 3DS strategy, chargebacks, card testing and vendor management. Measured on chargeback rate and approval rate.
• Loss prevention and asset protection: in-store theft, ORC, return fraud at the counter, insider investigations. Measured on shrink.
• Returns and customer care operations: return policy, appeasements, claims. Often measured on customer satisfaction, with no loss metric.
• Marketing/loyalty: promotions and loyalty programs, often with no fraud owner at all.
• Data science: shared or embedded. Returns-abuse models often live with returns ops.

The losses fall between those teams. A BORIS return of a stolen-card online purchase is a payments loss, an LP event and a returns-ops decision at the same time. Mature retailers create an omnichannel fraud function with one entity view across online orders, store transactions, returns, loyalty and gift cards, and a single net-loss number. See Fraud Operating Model, Cross-Functional Partnerships, New Product and Promo Launch Review, Vendor Selection and Evaluation.

Industry-specific signals and controls

Signals

• Basket and SKU Anomalies: high-resale baskets, quantity spikes on one SKU, gift cards mixed with electronics, baskets built around promo eligibility.
• Dispute and Return History: per-customer return rate, return-reason patterns, claims across orders, refunds to different tenders.
• Payment Instrument Signals: BIN country vs shipping, many cards per account, cards recently provisioned to wallets, prepaid cards on high-risk SKUs.
• Address Risk Signals: freight forwarders, reshippers, address mutations across accounts.
• Device Fingerprinting, Automation and Headless Browser Signals and Velocity Signals: card testing and bot checkout.
• Promo and Reward Redemption Patterns: code usage outside the intended channel, redemption bursts after leaks.
• Entity Link Analysis: accounts sharing devices, cards, addresses or pickup identifiers.

Controls

• Real-Time Transaction Risk Scoring with selective 3-D Secure and Card Verification for liability shift on risky orders.

• Bot Management and CAPTCHA and Rate Limiting and Throttling at checkout and payment-method endpoints. Visa's enumeration guidance adds velocity checks and decline-code monitoring.

• Claims and Returns Policy Controls: return authorization scoring, refund-on-inspection for high-risk returns, receipt and serial-number validation, return limits by customer history.

• BOPIS and curbside controls: pickup verification proportional to risk, and hold windows for new accounts buying high-resale items.

• Gift card controls: activation limits, cashier prompts for scam indicators, balance-check rate limiting, and draining detection (Playbook - Scam Intervention Members).

• Promotion Design Guardrails: per-identity limits, unguessable codes, budget caps, kill switches.

• Representment programs built around compelling-evidence data retention (Playbook - Chargeback Management Members).

• Consortium and Data Sharing: merchant-side fraud and return-abuse data sharing where law and contracts allow.

• Do you know your VAMP ratio this month, and which fraud reports you refunded but still counted?

• Can a return refund to a different tender than the original purchase?

• Can a new account pick up a $1,500 order an hour after placing it?

• Does every promo launch have a fraud review and a kill switch?

Members: Playbook - Chargeback Management Members, Playbook - Card Testing Members, Playbook - Refund and Claims Abuse Members, Playbook - Sign-Up Bonus and Promo Abuse Members, Playbook - Account Takeover Members, Playbook - Business Logic Exploit Response Members, Playbook - Scam Intervention Members, Playbook - Insider Fraud Members.

Notable public cases

• Amazon v. refund-service operator (2025): default judgment totaling over $2.4M: $2M against the operator of a refund-fraud service that recruited warehouse insiders, and the rest against four former employees who approved more than $400K in fake returns. See Case Study - Amazon Refund-as-a-Service Crackdown (2023-2026).
• Case Study - Talens Counterfeit Coupon Scheme (2020): about $31.8M in counterfeit coupon losses to retailers and manufacturers.
• Case Study - Pinduoduo Coupon Exploit (2019): a promo logic flaw exploited at scale within hours.
• FTC gift card data spotlights (2020–2021): gift cards as the leading scam payment method, with named retail brands where victims bought cards. This is the evidence base for register-level intervention programs.
• FTC and GOAT (2024–2026): redress over refund and buyer-protection promises that were allegedly not honored. The case shows that anti-abuse policy has to match advertised policy.
• Case Study - DraftKings Credential Stuffing (2022): a stuffing pattern that applies directly to retail accounts with stored value.

Sources and further reading

• MRC: 2026 Global eCommerce Payments and Fraud Report: 3.2% revenue lost, first-party misuse and refund abuse increases, agentic payments
• MRC: Refund/policy abuse remains the top fraud threat (Mar 2025): 2025 attack rankings
• MRC: First-party misuse (friendly fraud): terminology; up to 80% of fraud chargebacks for many members
• Chain Store Age: returns and shrink totaled nearly $800B in 2025 (Appriss Retail): 2025 returns, preventable fraud and abuse, channel split
• Business Wire: Appriss Retail: fraudulent returns and claims cost retailers $103B in 2024: 2024 returns, fraud share, fraud types
• Appriss Retail: How return and claims fraud in 2024 is shaping 2025: claims and appeasement estimate, empty-box indicator, policy friction
• Chain Store Age: losses from return fraud and abuse exceed $100 billion: counterfeit receipts and employee collusion survey figures
• AJOT: NRF and Happy Returns: consumers expected to return nearly $850B in 2025: return rates, 9% fraudulent, fraud types
• Chargeflow: VAMP explained: VAMP ratio, thresholds, enumeration criteria, dates (processor summary)
• Adyen: Visa Compelling Evidence 3.0 FAQ: CE 3.0 requirements
• Mastercard: First-Party Trust program (Oct 2023): program design and rollout
• Visa: Guidance to guard against enumeration attacks and account testing: definitions, merchant and acquirer controls, targeted merchant types
• FTC Data Spotlight: Scammers prefer gift cards (2021) and Gift cards top scammers' wish lists (2020): gift card scam prevalence and brands
• Ravelin: Why is promotion abuse a problem?: merchant survey on promo abuse (vendor source)
• KrebsOnSecurity: How phished data turns into Apple and Google wallets (2025): wallet-token monetization and merchant implications
• Courthouse News: Amazon refund-fraud ringleader ordered to pay $2.4M (Feb 2025): refund-as-a-service and insiders
• CFPB Regulation E § 1005.20: gift card expiration and fee rules