Refund abuse peaks after the holidays, exposing policy gaps

At a glance

What this is: Riskified’s analysis shows that post-holiday refund abuse concentrates in January, where Item Not Received and Did Not Arrive claims exploit operational gaps between delivery evidence and merchant workflows.

Why it matters: For IAM and fraud practitioners, the lesson is that refund control is an identity and authorisation problem as much as an operations problem, because trust in claimants, delivery signals, and approval paths has to be governed together.

By the numbers:

• November and December orders drive 31% of all refund claims across the year.

Context

Refund abuse is a governance problem when claim handling depends on fragmented evidence, overwhelmed teams, and rules that assume operational capacity will match seasonal demand. In retail, the control gap appears when delivery status, customer claims, and refund approvals are not evaluated as one decision path.

The identity angle is real even in a retail abuse case: merchants must decide whether the claimant, order, device, and fulfilment signals belong together before a refund is approved. When that linkage is weak, fraudsters can exploit process timing rather than technical compromise.

Key questions

Q: What breaks when refund policy controls are static during peak season?

A: Static refund controls break when operational pressure changes how decisions are made. During peak season, teams face higher claim volumes, slower reconciliation, and more pressure to keep service levels moving. That combination turns formal policy into approval-by-default behaviour, which fraudsters can exploit by timing claims for the period when review quality is lowest.

Q: Why do Item Not Received claims create higher fraud risk after the holidays?

A: Item Not Received claims become riskier after the holidays because merchants are handling more orders, more returns, and more delivery exceptions at once. Fraudsters can hide abusive claims inside normal seasonality, while delayed fulfilment updates and overloaded queues make it harder to challenge weak evidence before a refund is issued.

Q: How should retailers decide when to automate refund approvals?

A: Retailers should automate refund approvals only when the claim type, claimant history, and delivery evidence all fit a low-risk pattern. Automation is most defensible for routine, reconciled cases. When delivery signals are incomplete or a claimant has repeat disputes, the workflow should shift to higher scrutiny rather than faster closure.

Q: What should fraud teams measure to spot refund abuse early?

A: Fraud teams should measure claim timing, claim type concentration, approval rates under backlog conditions, and repeat-claim behaviour across customer accounts. If approval rates rise as queues grow, the control is no longer functioning as designed. Those signals show whether refund governance is adapting to seasonal pressure or quietly degrading.

Technical breakdown

How Item Not Received claims exploit delivery data gaps

Item Not Received and Did Not Arrive abuse works when merchant systems treat delivery evidence and customer claims as separate workflows. A fraudster does not need to defeat a payment control if the refund path accepts a claim before fulfilment data is reconciled. During peak season, that gap widens because order volume, carrier updates, and support queues all move at different speeds. The technical issue is not simply false claims. It is the absence of a governed evidence join between logistics and refund decisioning, which creates a window where abuse looks like ordinary service recovery.

Practical implication: tie refund adjudication to fulfilment evidence before approval, not after the queue is already overloaded.

Why static refund policies fail under seasonal load

Static refund policies assume the same decision thresholds work across normal and peak periods. That breaks down when November and December volumes create January backlogs, because manual reviewers start optimising for throughput rather than assurance. The result is policy drift: exceptions become defaults, and fraudsters learn that timing a claim after peak season increases approval odds. In governance terms, the policy exists, but the operating context has changed. Controls that do not adapt to volume, claim type, and customer risk become easier to game precisely when business pressure is highest.

Practical implication: calibrate refund thresholds dynamically so peak volume does not quietly lower the effective control bar.

Identity-based fraud signals in refund abuse

Refund abuse is increasingly an identity and trust problem because the merchant must decide whether the claimant is legitimate, whether the order history matches the claimant, and whether the pattern fits the account’s past behaviour. That means refund governance should look beyond the claim text and include identity-linked signals such as account age, repeat-claim behaviour, device consistency, and order-to-claim timing. When these signals are not bound into the workflow, operators see only a service request, not a potentially abusive identity event. This is where fraud controls and IAM thinking overlap: both depend on knowing who or what is actually acting.

Practical implication: embed identity-linked risk signals into refund workflows so claims are evaluated as trust decisions, not just support tickets.

Threat narrative

Attacker objective: The attacker seeks to obtain refunds for purchases that were delivered or otherwise not legitimately refundable, converting workflow pressure into direct financial gain.

1. Entry occurs when a fraudster files an Item Not Received or Did Not Arrive claim after the holiday rush, using seasonal volume to blend into normal support traffic.
2. Credential or trust abuse follows when the merchant accepts the claimant’s story without sufficiently binding it to delivery evidence, account history, or prior behaviour.
3. Escalation happens as overwhelmed teams approve refunds by default, allowing repeated abuse patterns to scale across many orders.
4. Impact is margin erosion, customer service strain, and large-scale refund leakage that compounds across the retail sector.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Refund abuse is a policy-governance failure before it is a fraud event. The article shows that claim handling breaks when static rules meet peak-season workload and cross-system evidence gaps. That means the real failure is not just abuse volume, but the absence of a control model that ties fulfilment evidence, claim context, and approval authority into one governed decision. Practitioners should treat refund governance as a lifecycle control, not a back-office exception process.

Identity-linked decisioning is the named concept retailers need to adopt. Refund abuse is not solved by generic fraud thresholds alone because the merchant must assess whether the claimant, account, device, and order history belong to the same trust boundary. This is where IAM logic matters in commerce operations: if the identity context is weak, the refund process becomes easy to game. Practitioners should bind customer trust signals into refund approvals before operational pressure turns them into defaults.

Seasonal overload turns manual review into a control illusion. When January backlogs force teams to approve refunds for service continuity, the policy is still present but no longer effective in practice. That creates a false sense of governance because the organisation can point to a rule set while the real decision path has already shifted to throughput. Practitioners should assume peak-volume conditions will change control behaviour and design for that failure mode explicitly.

The abuse pattern is predictable, which means it should be measurable and preventable. The article’s figures show that a concentrated period of claims carries disproportionate annual loss, so merchants should stop treating refund abuse as random noise. The better approach is to monitor timing, claim type, and approval drift as operational risk indicators. Practitioners should use these signals to tighten controls before the post-holiday surge becomes a recurring loss event.

What this signals

Refund abuse is a control-adaptation problem. When volume spikes, the organisation’s actual control state changes even if policy documents do not. Retailers should assume that seasonal pressure will alter approval behaviour and design refund governance around that reality, not around an ideal operating day.

Identity-linked fraud signals belong inside refund workflows. Claim timing, account history, device consistency, and repeat behaviour are not secondary details. They are the evidence that determines whether a support request is legitimate or an abuse attempt, and they need to be evaluated before refund authority is exercised.

For practitioners

• Bind refunds to fulfilment evidence Require delivery status, order history, and claim context to reconcile before automated or manual refund approval.
• Segment refund policies by claim type and season Use different thresholds for Item Not Received, Did Not Arrive, and exchange-related claims, especially during January backlog periods.
• Introduce claimant risk scoring Weight account age, repeat-claim behaviour, device consistency, and claim timing so support teams see risk before approving a payout.
• Monitor approval drift under peak load Track whether manual teams begin approving more refunds by default when queues rise, and treat that shift as a control failure.

Key takeaways

• Post-holiday refund abuse is not just a fraud spike. It is the point where seasonal load exposes weak decision controls and fragmented evidence.
• The article’s figures show concentrated loss pressure in January, with November and December orders driving a large share of annual refund claims.
• Retailers reduce exposure by binding claims to delivery evidence, using claimant risk signals, and preventing manual backlog from becoming an approval shortcut.

Key terms

• Refund Abuse: A monetisation tactic where an attacker uses a compromised account to request illegitimate refunds, credits, or reversals. It often follows successful takeover because the account has enough history to look trustworthy. In practice, refund abuse is a business-loss expression of identity compromise.
• Item Not Received (INR) Claim: An Item Not Received claim asserts that an order never arrived, even when delivery may have occurred or evidence is incomplete. In practice, INR abuse succeeds when merchants cannot reliably reconcile fulfilment data, claimant history, and support decisions before issuing a refund.
• Did Not Arrive (DNA) Claim: A Did Not Arrive claim is a refund or dispute assertion that the customer never received the item. The security concern is not the phrase itself, but the decision workflow around it, where poor evidence binding and overloaded operations can turn a claim into a financial loss.
• Claimant Risk Scoring: Claimant risk scoring is the practice of weighting identity and behavioural signals, such as account age, repeat claims, device consistency, and timing, to decide how much trust to place in a refund request. It helps separate routine service recovery from patterns consistent with abuse.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.