Did-Not-Arrive Fraud

What Did-Not-Arrive Fraud Means in Practice

Did-not-arrive fraud exploits the refund process by creating a dispute about delivery rather than a dispute about product quality. The core issue is not that delivery data is absent, but that the buyer can challenge the evidence trail in a way that forces the merchant to absorb the loss unless it can prove receipt convincingly.

This matters because the scam sits at the boundary between logistics and payments, so teams often assume the carrier's proof is enough. In practice, package scans, signatures, photos and GPS traces can each be true and still be insufficient when the claim is about who received the item or whether the item was stolen after drop-off.

Why This Fraud Is Hard to Resolve

The difficulty is evidentiary. A carrier may show delivery at an address, yet the merchant still needs a defensible basis for deciding whether the shipment reached the intended person, was intercepted, or was later claimed to be missing. That ambiguity is why this fraud can be profitable even when the shipping record looks complete.

It is also a trust problem across parties. The merchant, courier, payment provider and customer may each hold partial evidence, but none of them controls the full chain of custody. For that reason, the strongest disputes are often those where the account history, shipping destination and payment signal all look ordinary.

When the control environment is weak, the merchant may rely on NIST Cybersecurity Framework 2.0-style governance habits such as better asset and process visibility, even though the fraud itself is commercial rather than technical.

Common Signals and Evidence Gaps

Did-not-arrive claims are most convincing when they arrive after a low-friction checkout, a first-order purchase, or a delivery method that does not create strong receipt evidence. Claims become harder to rebut when the merchant stores only a single proof point, such as a photo at the door, because that proof rarely establishes final possession.

Repeated claims from the same account, address or device can also indicate abuse patterns. A mature review process looks for clustering, such as multiple non-receipt disputes, mismatches between billing and shipping behaviour, or delivery patterns that do not fit the customer's normal history.

For payment and fraud teams, the operational lesson is to treat proof as a layered record, not a single artifact. Delivery confirmation, order history, customer reputation, route data and dispute history each add context, but each can also fail in different ways.

How Merchants Reduce Exposure

Reducing this fraud usually means tightening the evidence standard for high-risk orders rather than trying to eliminate all disputes. Merchants often need stronger delivery confirmation for high-value items, better exception handling for stolen-after-delivery claims and clearer internal rules for when a refund can be issued without escalation.

Fraud prevention also depends on whether the merchant can recognize repeat abuse early enough to step up controls without creating excessive friction for legitimate buyers. That balance is important because overly aggressive denial policies can increase chargebacks and damage trust, while overly permissive policies invite serial abuse.

Where shipment integrity and chain-of-custody controls matter, NIST Cybersecurity Framework 2.0 offers a useful governance lens for identifying gaps, while OWASP API Security Top 10 is relevant when order, payment and delivery systems depend on APIs that must preserve trustworthy transaction records.

Practitioner Guidance

Why practitioners should care: This fraud is best managed as a business-control problem, not just a customer-service issue. The decision point is whether your refund policy and evidence threshold are strong enough to distinguish a genuine non-delivery from a deliberate false claim.

What to watch for: Escalating claims from the same buyer, repeated disputes on high-risk routes or categories, and a pattern of refunds that is always supported by the weakest available proof. Those signals often matter more than any single delivery artifact.

Practitioner takeaway: The best defence is a consistent, documented dispute standard that combines logistics evidence with order context, rather than trusting one proof point to settle every case.

Related resources from NHI Mgmt Group

• How should security teams reduce supplier fraud risk when invoices or payment requests arrive from trusted business partners?
• What is the difference between account takeover and new account fraud?
• Who is accountable when a SoD conflict leads to fraud or compliance failure?
• Why do conflicting access rights increase fraud risk more than broad access alone?