Returns abuse exposes the cost of identity blind spots in ecommerce

At a glance

What this is: Riskified’s playbook argues that returns and refund abuse is a major ecommerce cost problem, but blunt policy tightening can shift the burden onto legitimate customers instead of stopping fraud.

Why it matters: For IAM and fraud teams, the lesson is that policy enforcement alone does not solve abuse when identity, behaviour, and account history are not part of the control model.

By the numbers:

• Returns, refunds, and exchanges are a $394 billion expense for ecommerce merchants worldwide.
• Riskified commissioned a survey of 500+ directors of ecommerce with oversight of fraud, risk, and policy abuse.

Context

Returns abuse becomes difficult to control when merchants treat refunds, exchanges, and policy exceptions as isolated transaction events rather than as patterns tied to customer identity and behaviour. That blind spot is especially costly in ecommerce, where the same account may look legitimate at checkout while repeatedly exploiting lenient post-purchase rules.

Riskified’s report frames the issue as a governance problem as much as a fraud problem: stricter rules can reduce some abuse, but they also risk creating friction for good customers and obscuring which controls are actually working. The identity angle matters because policy abuse is rarely just about a single order, it is about recognising repeated behaviour across accounts, devices, and claims.

Key questions

Q: What breaks when merchants use blanket return policies to stop abuse?

A: Blanket return policies often reduce flexibility for legitimate customers before they remove meaningful abuse. The core failure is that they treat every request the same, so repeat abusers can adapt while trusted customers absorb the friction. Risk-based decisioning works better because it distinguishes patterns, not just outcomes.

Q: Why do returns and refund controls need identity and behaviour signals?

A: Because abuse is usually repetitive and contextual, not random. Identity and behaviour signals let merchants see whether a request comes from a normal customer journey or from an account that has already shown suspicious refund, exchange, or exception patterns. That improves both fraud detection and customer experience.

Q: How do you know if prompt-abuse controls are actually working?

A: Look for falling rates of rejected expensive prompts, stable latency under load, and fewer extreme token-generation events from the same identities. If those indicators improve while legitimate long-form tasks still succeed, the controls are doing their job instead of just suppressing usage.

Q: Should merchants prioritise policy changes or identity-based decisioning first?

A: Identity-based decisioning should come first when abuse patterns are recurring, because policy changes alone mostly shift where the pain lands. Once merchants can recognise repeat behaviour, policy settings can be tuned more precisely. Without that visibility, every stricter rule risks becoming a blunt instrument.

Technical breakdown

Why returns abuse is an identity problem

Returns fraud and policy abuse are often analysed as checkout or logistics issues, but the control failure usually sits in identity continuity. A merchant can authenticate a shopper at purchase time and still have no effective way to distinguish a first-time buyer from a repeat abuser at refund, exchange, or exception request time. That gap matters because the abuse pattern is behavioural and longitudinal, not purely transactional. When merchants rely only on rules such as fee changes, time windows, or rigid policy checks, they create friction without building an abuse memory. The result is a control plane that can see orders but not customer intent or repetition.

Practical implication: merchants need controls that connect post-purchase actions to account history, device signals, and abuse patterns rather than treating each return in isolation.

How stricter policies can backfire

Policy hardening is attractive because it is easy to implement, but it often shifts cost instead of removing risk. If a merchant raises fees, narrows return windows, or tightens exchange eligibility without better identity-based screening, the obvious effect is customer friction. The less obvious effect is adversary adaptation, where abuse simply migrates to the weakest policy path or becomes harder to distinguish from normal behaviour. In governance terms, this is a classic case of compensating control failure: the organisation changes the rule set but not the detection model. That means good customers feel the pain first while repeat abusers continue to exploit the system.

Practical implication: teams should test whether policy changes reduce abuse rates or simply move abuse into a different channel.

What an identity-based returns control model changes

An identity-based approach treats refund and returns decisions as risk decisions that should incorporate who is acting, how often they have acted, and whether the pattern fits legitimate shopping behaviour. That does not mean blocking every unusual return. It means enriching decisions with behavioural history, account linkage, and abuse typologies so that merchants can separate genuine customer service cases from policy exploitation. This is where fraud governance overlaps with identity governance: the objective is not just to reject bad requests, but to preserve trusted customer experience while creating repeatable decision logic for abuse cases. The discipline is closer to access governance than to static policy enforcement.

Practical implication: merchants should build decisioning that combines customer history, behavioural signals, and exception routing rather than using one-size-fits-all policy rules.

NHI Mgmt Group analysis

Returns abuse is an identity governance problem disguised as a policy problem. The report shows that merchants can tighten refund rules and still fail to stop repeat abuse because the control model does not recognise behavioural continuity. That is the core blind spot: the organisation sees a transaction, but not the customer pattern behind it. Practitioners should treat post-purchase policy abuse as a governed identity decision, not a static rule-engine issue.

Blunt policy tightening is a weak substitute for risk-based decisioning. Fees, shorter windows, and narrower eligibility criteria can reduce volume, but they also penalise legitimate customers when the business lacks a way to distinguish abuse from normal returns. In effect, the merchant converts a fraud problem into a customer experience problem. The better governance question is whether controls can separate high-risk patterns from ordinary commerce without making every exception a manual review.

Post-purchase behavioural continuity is the named control gap this article exposes. Returns abuse persists when merchants do not maintain memory across orders, claims, and account interactions. Without that continuity, the same actor can present as trusted at sale time and opportunistic at refund time. Practitioners should design controls that preserve a consistent view of risk across the full customer lifecycle.

Fraud and identity teams need shared ownership of returns governance. Returns, refunds, and exchanges sit at the boundary of policy, customer operations, and fraud prevention, so no single team can govern them well in isolation. The article’s framing implies that merchants should stop separating abuse prevention from customer experience design. The practical conclusion is to measure abuse controls by both loss reduction and legitimate customer friction.

What this signals

Post-purchase behavioural continuity: merchants that cannot link refund and exchange requests to prior account behaviour will keep mistaking repeat abuse for ordinary customer service. The governance shift is to make post-purchase decisions observable across the full customer lifecycle, not just within a single order event.

Identity and fraud teams should treat returns abuse as a lifecycle control problem. That means measuring whether policy changes reduce abuse without turning legitimate customers into collateral damage, because the wrong fix can create more operational friction than it removes risk.

For practitioners

• Define post-purchase risk signals Link refund, exchange, and exception decisions to account age, prior claims, device continuity, and repeat-claim patterns so abuse can be recognised across the customer lifecycle.
• Replace blanket policy tightening with tiered controls Use different handling paths for low-risk, ambiguous, and high-risk return requests instead of applying one fee or one return window to every customer.
• Create an abuse memory for customer accounts Persist outcomes from prior refunds, chargebacks, and policy exceptions so future decisions can see whether the current request fits an established abuse pattern.
• Measure friction and abuse together Track abuse loss rates alongside approval rates, customer complaints, and manual review volume so policy changes do not quietly degrade legitimate experience.

Key takeaways

• Returns abuse is not only a pricing or policy problem, it is a control problem that depends on whether merchants can recognise behaviour over time.
• Stricter return fees and tighter windows may suppress some abuse, but they can also harm good customers if identity signals are missing.
• The strongest governance model links post-purchase decisions to customer history, repeat patterns, and exception tracking so abuse is harder to hide.

Key terms

• Return Abuse: Return abuse is the misuse of a legitimate returns process to extract value without following the merchant's intended rules. Common forms include wardrobing, product switching and repeated opportunistic returns. It is operationally difficult because it often looks like ordinary customer behaviour until patterns are analysed across time.
• Identity-Aware Decisioning: A control approach that evaluates both the request and the requester before allowing an action. In customer operations, it combines identity, behaviour, and transaction context so the system can distinguish legitimate service from fraudulent or out-of-policy requests.
• Policy Hardening: Policy hardening is the practice of making refund or exchange rules stricter by narrowing windows, adding fees, or limiting eligibility. It can reduce some abuse, but without better risk signals it often shifts friction onto good customers rather than removing the underlying fraud pattern.
• Behavioural Continuity: The consistency of an identity's actions across sessions, devices, merchants, and time. It is a stronger trust signal than isolated profile data because it is harder for an attacker to imitate convincingly across multiple touchpoints without exposing anomalies.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners building stronger control models. It helps identity and security teams connect governance design to the operational decisions that shape access and trust.