Return abuse is a margin leakage problem, not just fraud loss

At a glance

What this is: NHI Mgmt Group's analysis, drawing on SEON's blog post: Return abuse and refund fraud are usually treated as operational noise, even though they materially erode retailer margin across stores, e-commerce and marketplaces.

Why it matters: It matters because IAM and fraud practitioners need shared signals, not separate dashboards, when identity, device and behavioural checks can stop bad refunds before cash leaves the business.

By the numbers:

• Returns fraud now accounts for nearly 14% of all U.S. returns and costs retailers roughly $103 billion in 2024.
• SEON’s 2026 Fraud & AML Leaders Report surveyed 1,010 fraud, risk and compliance leaders.
• Return fraud and promo or discount abuse each ranked as a top threat for 18% of respondents.

Context

Returns abuse sits in the gap between customer policy and loss prevention. Retailers often design generous return terms to lift conversion and loyalty, but the same terms can be exploited through wardrobing, bracketing, empty-box returns and refund abuse that never looks like classic account takeover.

The governance problem is that finance, fraud and operations measure different outcomes and therefore own different fragments of the same loss. That makes returns fraud hard to price, hard to review and easy to ignore until the margin bleed becomes visible in quarterly results.

Key questions

Q: How should retailers decide when a return request needs manual review?

A: Retailers should route a return to manual review when identity, device or behavioural signals do not fit the customer’s normal pattern, especially when the value or frequency of returns is unusual. The goal is not to block every risky customer, but to catch policy abuse before the refund clears and the loss becomes irreversible.

Q: Why do return policies create margin risk even when customers follow the rules?

A: Because policy-compliant behaviour can still be economically abusive. Wardrobing, bracketing and repeated returns exploit the cost structure of shipping, processing and restocking without breaking the written policy, so the business absorbs the loss even though the transaction appears legitimate on paper.

Q: What are the signs that return abuse is becoming a measurement problem?

A: The clearest sign is when fraud teams and finance teams report different pictures of the same loss. If chargebacks stay flat while gross margin keeps slipping, or if no one can tie return reasons to profit impact, the organisation is probably measuring the problem in fragments instead of as one control issue.

Q: Who should own refund fraud when it spans finance, fraud and operations?

A: Ownership should sit with a shared governance model, not a single silo. Fraud teams, finance leaders and operations all see different parts of the loss, so the practical answer is a cross-functional process with one escalation path, one reporting view and one decision standard for high-risk returns.

Technical breakdown

How return abuse turns policy into margin leakage

Return fraud does not need system compromise to create loss. It exploits legitimate policy paths, which means the transaction itself can appear valid while the business still absorbs shipping, processing, restocking and refund cost. Wardrobing, bracketing and returnless-refund abuse are different behaviours, but they all exploit the same trust assumption: that a posted return policy equals a legitimate claim. That is why conventional fraud rules, which look for clear rule-breaking, often miss rule-following abuse that is economically harmful. In practice, the control question is not whether a return is allowed, but whether the customer signal profile supports that return at that moment. Practical implication: move from policy acceptance to signal-based decisioning at refund time.

Practical implication: move from policy acceptance to signal-based decisioning at refund time.

Why identity and device signals matter before the refund clears

The highest-value control point is the moment a return is requested, not after the refund posts. Device intelligence, email reputation, phone reputation, loyalty history and order behaviour can reveal whether the request fits a legitimate pattern or a serial abuse pattern. Those signals do not prove fraud by themselves, but they let teams segment treatment instead of applying one return rule to everyone. That matters across channels because the same customer can initiate abuse online, in-store or through a marketplace seller, while each channel only sees part of the pattern. Practical implication: anchor return decisions on identity-linked behavioural signals instead of relying on after-the-fact manual review.

Practical implication: anchor return decisions on identity-linked behavioural signals instead of relying on after-the-fact manual review.

Why finance and fraud need one loss metric

The article’s most important operational point is not the abuse tactics themselves, but the ownership gap they expose. Fraud teams watch chargebacks and refund abuse, while finance watches gross margin and inventory shrinkage. If those metrics are never joined, no one sees the full cost of a return pattern that is policy-compliant but margin-destructive. That creates a governance blind spot where losses are absorbed by multiple teams but managed by none. A better model is to treat returns as a cross-functional risk signal with one agreed loss metric and one escalation path. Practical implication: build shared reporting that ties return reason, customer risk and margin impact to a single operational view. See the Fraud and Cyber Convergence Guide.

Practical implication: build shared reporting that ties return reason, customer risk and margin impact to a single operational view.

Threat narrative

Attacker objective: The objective is to extract merchandise value and refund value while keeping the transaction inside the retailer’s normal policy flow.

1. Entry occurs when a customer initiates a return through a valid channel, so the request looks legitimate at first glance.
2. Credential or identity signals are then bypassed because the abuse uses ordinary customer behaviour, not stolen access, to trigger a refund path.
3. The business impact follows when the merchandise, shipping and refund costs are all absorbed while the abuse remains hidden inside accepted policy.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Return abuse is a governance problem, not just a fraud problem. The article shows that organisations often treat post-purchase abuse as an operations issue because the customer is following policy rather than breaking into a system. That distinction matters because governance fails when ownership is split between finance, fraud and store operations. The practitioner takeaway is to treat policy abuse as a measurable control gap, not a miscellaneous loss bucket.

Identity-linked return controls are now part of revenue protection. A return request is not only a customer-service event; it is an identity decision that can be enriched with device, contact and behavioural signals. third-party access is not the right control domain here, but the governance lesson is similar: shared access paths need shared oversight, especially when multiple channels can execute the same economic loss.

Margin leakage creates a false sense of control when only fraud dashboards are monitored. Fraud teams can report stable chargeback rates while returns abuse quietly grows, because the loss shows up in margin rather than in classic fraud metrics. That is a measurement failure, not a detection success. Practitioners should align fraud, finance and operations around one loss view before abuse scales further.

Retailers need a named concept for this failure mode: policy-compliant fraud. The abuse is difficult to catch precisely because it does not resemble conventional compromise. That makes it a governance problem for returns policy, not just a fraud-screening problem, and the practical response is to design controls around behavioural risk at the point of refund approval.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Fraud Prevention Guide for Digital Businesses

What this signals

Policy-compliant fraud: The harder retail fraud gets to classify as “bad actor” behaviour, the more it looks like ordinary customer activity that has crossed a loss threshold. That means the control layer has to move from post-event review to pre-refund signal evaluation, because the business can no longer rely on policy language alone to distinguish profitable from harmful behaviour.

Finance teams should expect more pressure to connect loss prevention with customer experience metrics. When return friction is introduced, the real question is whether the organisation can target high-risk returns without degrading conversion for legitimate customers.

The next governance step is to treat return abuse as a shared identity and risk problem, not a departmental nuisance. That makes cross-functional reporting and signal sharing more important than any single rule set.

For practitioners

• Align finance and fraud on one loss metric Tie return reason, customer risk, shipping cost, restocking cost and margin impact into one reporting view so abuse is not hidden across separate dashboards.
• Apply risk-based review before refund issuance Use device, email, phone, loyalty and order-history signals to decide whether a return should be auto-approved, routed to review or blocked before cash leaves the business.
• Segment return policies by risk profile Reserve stricter rules for serial returners, suspicious marketplaces and repeated high-risk behaviour, rather than applying identical terms to every customer.
• Create an escalation path for cross-channel abuse Give fraud, store operations and marketplace teams a shared case process so the same customer pattern can be recognised across online, in-store and third-party sales.

Key takeaways

• Return abuse can be fully policy-compliant and still create substantial margin loss, which is why it often escapes traditional fraud ownership.
• The evidence points to a governance gap between fraud metrics and finance metrics, not just a detection gap at the point of refund.
• The most effective control is to assess identity and behaviour before the refund clears, then route risky cases into shared review and escalation.

Related NHI Mgmt Group resources: Fraud and Cyber Convergence Guide · Fraud Prevention Guide for Digital Businesses · Third-Party, B2B and Contractor Access Guide · SaaS-to-SaaS and OAuth App Governance Guide

Key terms

• Return Fraud: Return fraud is the abuse of merchant return policies to obtain refunds, replacements, or store credit without a legitimate basis. It can include exaggerated damage claims, item substitution, wardrobing, and AI-assisted narratives that make a weak claim appear credible to review teams.
• Margin Leakage: Margin leakage is profit loss that occurs gradually through operational processes rather than through a single obvious incident. In retail return abuse, it appears when shipping, handling, restocking and refund costs accumulate across many apparently valid transactions.
• Wardrobing: Wardrobing is the practice of buying an item, using it temporarily, and then returning it as if unused. It exploits generous return policies and is hard to detect when merchants rely on narrow checks instead of broader behavioural and purchase-pattern analysis.
• Behavioural Signal: A pattern in how a user acts over time that can help distinguish normal activity from abuse. In fraud operations, behavioural signals include timing, repetition, device consistency, channel switching, and claim history. They are most useful when combined with human review and case context.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It helps practitioners connect identity control to the broader security programmes they already run.