Refund and Returns Fraud Guide

Refunds and returns are designed to be fast and trusting, and organised fraud groups now sell that trust as a service. Refund and returns fraud covers every way of getting money back, or keeping goods, that the retailer did not owe: false "not received" claims, returning different or used items, receipt and price tag tricks, insiders issuing refunds, and paid "refund services" that manipulate customer support on a buyer's behalf. US prosecutors sentenced eleven members of one such service in 2026 for a scheme that charged customers 15% to 25% of the item price to secure full refunds while they kept the goods. This guide explains the fraud types, the signals that separate abuse from genuine customers, the controls across the order, return and support journey, a rollout plan and how to measure it. It is written for retail and e-commerce fraud, customer service, loss prevention and payments teams.

Key takeaways

The return desk and the support chat are the attack surface. Most refund fraud succeeds by persuading a person, or increasingly an AI agent, to approve a refund the rules would not allow.
Refund-as-a-service is organised crime, not customer behaviour. US Department of Justice cases describe groups that advertise openly on messaging platforms, take a percentage fee and tailor methods to each retailer.
Decide on evidence, not on the claim. Carrier scan data, weight at dispatch and at return, serial numbers and photos turn a disputed story into a checkable fact.
Score the customer and the case together. Repeated high-value claims, many accounts sharing addresses or devices, and claims raised just inside policy windows are stronger signals than any single refund.
Keep the honest majority fast. The goal is targeted friction for risky cases, since returns are huge: the National Retail Federation projected $890 billion of US retail returns in 2024.

Refund and returns fraud types

Type	How it works	Who commits it	Best evidence against it
False non-receipt claim	Customer says the item never arrived although it was delivered	Individuals, refund services	Carrier scan, geolocated delivery photo, signature for high-value items
Different or lower-value item returned	Customer returns a cheaper or broken item, or an empty or weighted box, in place of the original	Individuals, refund services, resellers	Serial number or IMEI capture at dispatch, weight comparison, inspection before refund
Wardrobing	Item is used, for example worn to one event, then returned as new	Individuals	Tags and condition checks, restocking rules
Receipt fraud and stolen goods returns	Fake or altered receipts used to return shoplifted or differently priced goods	Individuals, organised retail crime	Receipt lookup against sales records, receiptless return limits with identity
Price switching	Price tag or barcode swapped to buy cheaply, then returned with a receipt for the higher price	Individuals	Item-level SKU matching at return
Refund-as-a-service	A paid group takes the buyer's order details and contacts the retailer with a tailored story	Organised groups	Linking cases by script, device, timing and account clusters
Insider refunds	Staff issue refunds to themselves or accomplices, or accept bribes to approve claims	Employees, contractors	Separation of duties, refund limits per agent, refund-to-different-card checks
Chargeback after refund or delivery	Customer disputes the card payment despite receiving the goods or a refund	Individuals	Delivery and refund evidence submitted in the dispute

Stripe's merchant guidance describes wardrobing, receipt fraud, price switching and "not received" chargebacks in similar terms. The final row overlaps with first-party fraud, covered in depth in the First-Party Fraud Guide.

How refund-as-a-service operates

Public prosecutions give a clear picture of the model, without the playbooks the groups sell.

Open advertising: the Artemis Refund Group, according to the US Attorney's Office for the Northern District of Oklahoma, ran from April 2019 to October 2023 and advertised heavily on online messaging forums. Amazon's own write-up names Telegram and Reddit as platforms used by such groups.
Customer as accomplice: the customer buys the product, hands over the order details, and the group contacts the retailer. The customer keeps the item and receives a full refund, paying the group 15% to 25% of the item's price.
Tailored per retailer: the DOJ release says the group used "a variety of methods tailored to that retailer", and the named victims included Amazon, Walmart, Target, Wayfair, Dell Technologies, HP and Adidas, among others.
Support manipulation: Amazon describes the groups using social engineering of customer service to obtain refunds for items that are never returned, and running like businesses with their own marketing and customer support.
Scale: Amazon reports that the Artemis group worked across 249 customer accounts and obtained more than $774,000 in concessions from Amazon alone, and that a separate operation, Simple Refunds, caused more than $4 million in losses to retailers.

Sellers can run the scheme in reverse. In a 2022 case the US Attorney's Office for the Central District of California described a marketplace seller who posted fake tracking numbers to release sale proceeds, then claimed goods bought in other people's names were "Different from what was ordered" and returned lower-value items, causing Amazon about $1.3 million in losses. Marketplace operators therefore need refund controls on both the buyer and the seller side.

Detection signals

No single signal proves fraud: genuine parcels do go missing and genuine items do arrive broken. Stripe's guidance lists multiple refunds to one customer, frequent high-value returns, sudden spikes in refund requests, worn or tampered items and fake receipts as indicators. Combine signals from three levels, the customer, the case and the person approving it, and act on the combination rather than any one flag.

Customer and account signals

Claim history: refund rate per customer far above the norm, repeated "not received" or "wrong item" claims, and high-value items making up most claims.
Account clusters: many accounts sharing a delivery address, device, payment card, phone number or email pattern, which is how refund services and multi-account abusers show up. See the Fake Account Creation and Sign-up Fraud Guide.
New account, high value: a first order of a high-value, easily resold item followed quickly by a claim.

Case signals

Timing: claims made very soon after delivery scans, or just before a policy window closes.
Story patterns: similar wording, the same claimed defect, or the same sequence of escalations across unrelated customers, a sign of a shared script.
Return evidence mismatch: a return parcel much lighter than the outbound parcel, a serial number that does not match dispatch, or a drop-off location far from the customer.
Support channel switching: repeated contacts across chat, phone and email until an agent approves, or requests to escalate to a specific team.

Insider and agent signals

Agent outliers: one agent approving far more refunds or overrides than peers, refunds to a card or wallet different from the original payment, and refunds without a matching return.
Policy outliers: refunds above a threshold approved without a second person, or issued just after a supervisor login from an unusual location.

Controls across the journey

Stage	Control	Fraud types reduced
Dispatch	Record serial numbers or IMEIs and parcel weight for high-value goods; require signature or photo on delivery above a value threshold	Non-receipt claims, different item returned
Claim intake	Risk-score each claim using customer history, account links and case signals; route high scores to a trained team	Refund services, repeat abusers
Identity	Verify the account holder through the logged-in session or a one-time code before discussing an order; never accept order details alone as proof	Refund services impersonating customers, account takeover
Return receipt	Inspect high-value returns before refunding, match SKU and serial, weigh parcels	Empty or substituted boxes, wardrobing, price switching
Refund decision	Refund to the original payment method only; cap refunds per agent; second approval above a threshold	Insider refunds, cash-out to other cards
After refund	Link cases across accounts, feed outcomes back into the scoring model, share confirmed fraud data with peers where lawful	Organised groups moving between accounts
Disputes	Keep delivery, refund and communication evidence ready for representment	Chargebacks after delivery or refund

For card dispute handling and evidence, see the Payment Fraud Guide. For cross-industry sharing of confirmed fraud indicators, see the Fraud Data Sharing and Consortium Intelligence Guide.

Where identity fits

Refund fraud is an identity problem on three fronts. First, customer identity: support teams that accept an order number and email address as proof are easy for refund services to impersonate, so tie conversations to an authenticated session. Second, staff identity: every refund, override and policy exception must be logged against a named individual with role-based limits, which the Retail and E-Commerce Identity Security Guide identifies as the main control against insider refund fraud. Third, AI agents: a support chatbot or agent that can issue refunds holds real financial authority. OWASP's Top 10 for LLM Applications 2025 lists Excessive Agency (LLM06) for this risk. Give agents their own scoped identity, cap the refund value they can approve, require human or rules-engine approval for anything outside policy, and log every action. The Air Canada chatbot ruling shows that a business can be held to what its bot says about refunds: the tribunal found the airline liable after its chatbot misstated its bereavement refund policy.

Decision guidance

Inspect before refund or refund on scan: refund-on-carrier-scan gives the best experience but invites substituted returns. Use it for low-value items and trusted customers; inspect high-value, high-risk categories first.
Deny, delay or educate: outright denial of a claim from a long-standing customer costs more than the refund. For first anomalies, ask for evidence; reserve account restrictions for linked, repeated cases.
Human team or automated rules: automate low-risk approvals and clear denials, and give a trained team the middle band, with scripts that resist pressure tactics.
Small versus large retailers: a small shop can rely on clear policy, signature-on-delivery thresholds, refund-to-original-method and a simple claims log. A large retailer or marketplace needs case linking across accounts, a scoring model, a specialist investigations team and links to law enforcement and peers.

How to implement

Size the problem: pull 12 months of refunds and returns by reason code, value, customer and agent; identify the categories and reasons with the highest loss.
Publish a clear policy: state evidence requirements, return windows, condition rules and refund methods, visible online and in store, so that refusals are defensible.
Capture evidence at dispatch: start with serial numbers, weight and delivery confirmation for the top loss categories.
Introduce scoring in shadow mode: score claims for four to six weeks without changing decisions, then review how many confirmed fraud cases high scores would have caught and how many good customers they would have delayed.
Turn on targeted friction: route high-score claims to inspection or a specialist team; keep low-score claims on the fast path.
Harden support: require authenticated sessions or one-time codes, set refund limits by role, add second approval above a threshold and train agents on refund-service scripts.
Roll back or tune: if complaint rates or net promoter scores fall in a segment, loosen rules there and record the change.
Close the loop: feed confirmed outcomes back into scoring, refer organised cases to law enforcement and pursue civil recovery where justified.

Detection and measurement

Metric	What it shows
Refund rate by reason code and category	Where abuse concentrates, for example "not received" on electronics
Confirmed fraud loss as a share of refunds	Overall exposure and trend
Hit rate of high-risk routing	Share of claims sent for review that are confirmed abuse
Good-customer friction rate	Share of genuine claims delayed or challenged
Refunds per agent and override rate	Insider and social engineering risk
Chargebacks on refunded or delivered orders	First-party abuse that slips past refund controls

Framework mapping

Control	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Refund risk in enterprise risk management	GV.RM-03	Not applicable
Refund limits and second approval	PR.AA	AC-5 Separation of Duties; AC-6 Least Privilege
Agent and case anomaly analysis	DE.AE-02, DE.AE-03	AU-6 Audit Record Review, Analysis, and Reporting
Alerts to investigators	DE.AE-06	SI-4 System Monitoring
Training support staff on social engineering	PR.AT-02	AT-2 Literacy Training and Awareness
AI support agents with refund authority	PR.AA	AC-6; OWASP LLM06 Excessive Agency

Common failure patterns

Order details accepted as identity: refund services only need the order number and email that the real customer gives them; support that accepts these as proof is doing the fraudster's work.
Refund-on-scan for everything: refunding high-value items as soon as a carrier scans the return label pays out before anyone sees the box is empty or holds the wrong item.
Refunds to a new payment method: allowing refunds or store credit to a different card or wallet turns every successful claim into clean cash-out.
Treating each claim alone: without linking accounts by address, device and payment data, a group spreading claims across hundreds of accounts looks like hundreds of ordinary customers.
Unlimited agent authority: no per-agent caps or second approval invites insider fraud and makes agents easy targets for pressure and bribery.
AI agents trusted with policy: a chatbot that can promise or issue refunds without a rules check creates both fraud and liability exposure.

Lessons from incidents

The Air Canada Chatbot Ruling 2024 was not fraud, but it shows that refund commitments made by an automated agent bind the business. As support moves to AI agents, refund services will target them with the same pressure tactics used on human agents, so refund authority must sit in a rules engine with logged, capped actions rather than in the model's judgement.

Practitioner checklist

Analyse 12 months of refunds by reason, value, category, customer and agent.
Publish clear refund and return rules covering evidence, windows and refund methods.
Record serials, weights and delivery confirmation for high-value dispatches.
Score claims and link related accounts; route only high-risk cases to review.
Authenticate customers before discussing orders; never treat order details as proof of identity.
Refund to the original payment method only, with per-agent caps and second approval above a threshold.
Give AI support agents scoped identities, refund caps and rules-engine checks, with full logging.
Train support staff on refund-service tactics and escalation pressure.
Track friction on genuine customers alongside fraud losses.

Refund and Returns Fraud Guide: Detect Refund Abuse and Organised Refund Services