Return fraud: how to spot refund abuse before it scales
Return fraud is when someone abuses a returns or refund policy for gain, from wardrobing and empty-box returns to false not-received claims. It overlaps with refund abuse and friendly fraud. Merchants detect it by linking accounts, devices and payment methods across claims, watching return velocity, and matching delivery or usage evidence to each request.
Updated · RiskCogs team
Key facts
- Return fraud covers policy abuse on returns; refund abuse is the wider pattern of unjustified refunds and chargebacks.
- Common tactics: wardrobing, empty-box or brick returns, false not-received claims, and serial returners across linked accounts.
- Honest buyers share some signals with abusers, so most teams score and add friction rather than hard-block every return.
- Linking devices, addresses and payment methods across claims is usually stronger than any single order flag.
What is return fraud?
Return fraud is the misuse of a returns or refund policy to get money, store credit or goods the buyer is not entitled to under the rules. Related terms are refund abuse, return abuse and friendly fraud when the same pattern ends in a chargeback.
It is a form of first-party fraud: the buyer is often a real customer with a valid payment method. Identity checks pass; the signal is in behaviour and history across orders.
- Wardrobing: buy, use once, return as unused.
- Empty-box or switched-item returns.
- False not-received or damaged claims after delivery.
- Serial returns across many accounts linked by device or card.
How return fraud works
A typical cycle looks similar across e-commerce verticals.
- Place an order with a card or wallet that will pass basic checks.
- Receive the goods, or claim they never arrived.
- Open a return, refund or chargeback using a reason that fits the policy.
- If blocked, repeat with a new email, address or payment method.
- Scale across linked accounts when one identity is limited.
Signals that expose return and refund abuse
No single signal proves abuse. Teams combine velocity, links and evidence mismatches.
How to reduce return fraud without hurting good customers
Most teams score return requests and add friction for medium risk instead of denying every odd return.
- Publish a clear return window and condition rules customers can follow.
- Require tracking and photos for high-value returns.
- Link accounts by device, address and payment method before approving store credit.
- Set velocity limits on returns and refunds per customer and per device.
- Keep delivery and usage evidence ready for not-received disputes.
- Feed confirmed abuse outcomes back into payment and refund scoring.
Return fraud signals and typical actions
| Signal | What it suggests | Typical action |
|---|---|---|
| Many returns per device or card | Serial returner or multi-accounting | Raise score; limit store credit |
| Not-received claims after tracked delivery | False claim risk | Request proof; review before refund |
| Empty-box or weight mismatch | Switched-item return | Investigate; flag account |
| New account, high-value first return | Probe for policy abuse | Manual review |
| Chargeback after denied refund | Friendly fraud path | Evidence pack; tighter future score |
| Shared address across many returning accounts | Linked ring | Link identities; review promotions |
How RiskCogs helps with return and refund abuse
RiskCogs links events by device, account, card BIN and IP, so repeat refund and chargeback patterns show up in the score and its reasons. You can write rules on prior chargebacks or many linked accounts and test them in shadow mode before enforcement.
RiskCogs does not run your returns desk. It is a risk scoring layer next to your payment provider and does not process payments or decide refunds for you. See the pricing page for current plans.
See what you would have blocked — free shadow modeFrequently asked questions
What is the difference between return fraud and refund abuse?
Return fraud usually means abusing a physical or digital return policy. Refund abuse is broader and includes unjustified refunds, chargebacks after use, and promotion clawbacks. Both are first-party patterns where the buyer is often genuine. Detection focuses on links across claims, not only on one order.
How do retailers detect return fraud?
They combine return velocity, linked accounts, delivery evidence and product condition checks. Useful clues include many returns on one device, not-received claims after tracked delivery, and chargebacks after a denied refund. Manual review still matters for edge cases that automated scores cannot settle alone.
Is wardrobing illegal?
Wardrobing is usually a breach of the seller terms of service. Whether it is also unlawful depends on the facts and jurisdiction, and this page is not legal advice. Treat clear repeats as a policy and fraud-ops issue first, and involve counsel when stolen goods or identity theft appear.
How can I cut return fraud without blocking honest buyers?
Score return and refund requests, add friction for medium risk, and reserve hard denies for clear linked abuse. Keep policies clear, ask for tracking on high-value returns, and measure false declines on good customers when you tighten rules. Shadow tests on real traffic help before you enforce.
Sources and related reading
- Visa and Mastercard public chargeback materials on goods not received and not as described reason codes — named as text sources only.