Refund & Return Fraud
Buyers — and paid "refunder" services sold on messaging apps — abuse merchants' refund, return, and chargeback processes to get their money back while keeping the goods, using false "not received" claims, empty-box returns, wardrobing, and chargeback abuse.
Last reviewed: 27 July 2026
What this scam is
Refund and return fraud is the abuse of a merchant's own refund, return, and chargeback processes to get money back — or a free replacement — while keeping the goods. Unlike a stolen-card purchase, the person committing it is usually the genuine account holder, which is why the industry calls it first-party or "friendly" fraud: the transaction is real, the customer is real, and only the later claim is a lie. It spans a spectrum. At the casual end sit wardrobing — buying an item, using it once, and returning it as unworn — and opportunistic "item not received" (INR) claims on parcels that did arrive. At the organised end sit professional "refunding-as-a-service" operations, sold openly on messaging apps, that will, for a cut, file refund claims against major retailers on a buyer's behalf using rehearsed scripts and social-engineering tricks. Because every step mimics a legitimate unhappy customer, the loss lands quietly on the seller — as refunded revenue, lost inventory, shipping costs, and chargeback fees — and is easy to miss until patterns accumulate.
How it works
The methods are a toolkit, mixed to fit each retailer's policies. The false "item not received" claim asserts a delivered parcel never arrived, betting the merchant can't disprove it. The empty-box or wrong-item return sends back a box weighted with something worthless — or an older broken unit — so the warehouse scan logs a return and triggers a refund before anyone inspects the contents. Wardrobing returns a genuinely used item as if unworn. "Did not authorise" and "not as described" chargebacks route the same dispute through the card network instead of the merchant, which shifts the burden of proof onto the seller. Refunding-as-a-service industrialises all of this: operators advertise on messaging apps and forums, take a percentage of the refund in cryptocurrency, and run scripted contacts with support — citing missing items, damaged packaging, or courier errors — targeting retailers whose policies they have mapped in detail. Some exploit "keep it" refund rules, instant-refund-before-return windows, and generous no-questions return periods. Successful accounts are reused or sold, and the same buyer or service hits the same merchant repeatedly.
Why this scam works
Refund fraud hides inside the behaviour retailers most want to encourage. Frictionless returns, instant refunds, and "the customer is always right" are competitive necessities, so the systems are built to believe the customer — which is exactly the assumption the fraud exploits. Each individual claim is cheap to honour and expensive to contest, so staff are trained to refund and move on; the loss only becomes visible in aggregate. First-party fraud is also genuinely hard to distinguish from a real problem: parcels do get lost, items do arrive damaged, and a wrongly refused refund costs a real customer and a bad review. Organised refunders weaponise that ambiguity, using scripts calibrated to stay just inside plausible. The distinction that matters most is between an isolated bad experience and a repeatable pattern — fraud is a pattern.
Common red flags
- A customer with repeated 'item not received' claims across multiple orders
- Returns that arrive underweight, empty, or containing a different or older item
- High-value orders to freshly created accounts or to reshipping and forwarding addresses
- A claim that escalates to a chargeback the moment a refund is refused
- Requests to refund without returning, or before the return has been received
- Clusters of near-identical, rehearsed complaints against the same product or across accounts
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Refunds on all major stores — electronics, fashion, up to a few thousand per order. 15% fee, crypto only. DM @handle_placeholder.
My order never arrived. Tracking says delivered but there was nothing at my door — I need a full refund today.
The box turned up empty with the wrong item inside. This is unacceptable, refund me now or I'll dispute it with my bank.
I've already contacted my card company to reverse the charge since your team won't help me.
How to verify before you act
Because you cannot judge a single claim reliably, verify at the level of patterns and evidence rather than the individual story. Link claims to identity, not just to orders: match across email, device, address, and payment fingerprint so a customer with a history of INR claims, serial returns, or prior chargebacks is visible before you refund. Require and inspect the physical return before refunding high-value items, weighing and photographing parcels at intake so an empty-box return can be proven. Keep delivery evidence — tracking, proof of delivery, geotagged photos, signatures — because it is your defence against both INR claims and card disputes. For chargebacks, respond with compelling evidence within the network's deadline. Treat clusters of similar claims, especially against the same products, as a signal to review, not to keep paying.
Payment methods used
- Credit-card chargebacks
- Refunds to the original payment method
- Cryptocurrency (paying refunder services)
- Gift-card and store-credit refunds
- Payment apps
Who is usually targeted
- Online retailers
- Marketplace sellers
- Electronics and apparel merchants
- Subscription and digital-goods sellers
What to do immediately
- Pause the refund and, for any chargeback, gather and submit compelling evidence before the deadline
- Pull the customer's full history across orders, devices, addresses, and payment methods
- Cross-check delivery and return evidence — tracking, weights, intake photos — against the claim
- Flag or restrict the account and any linked accounts sharing identifiers
- Report organised refunding services and coordinated abuse to the marketplace, your payment processor, and your national fraud service
- Preserve all records, since recurring abusers and refunder services reuse the same patterns
How to prevent it
- Track refund, return, and chargeback rates per customer and per product, and flag outliers before refunding
- Capture delivery evidence — tracking, proof of delivery, photos, and signatures — for high-value orders
- Weigh, photograph, and inspect returns at intake before issuing the refund
- Reserve instant and 'keep it' refunds for low-risk, low-value orders and established accounts
- Respond to every chargeback with compelling evidence inside the card network's deadline
- Set clear return-window, condition, and restocking policies and apply them consistently
Evidence to preserve
- Order, delivery, and returns records: tracking, proof of delivery, signatures, and intake weights and photos
- The full claim and support conversation, including exact wording and timestamps
- Account identifiers — email, device, IP, shipping and payment fingerprints — linking related claims
- Chargeback correspondence and the evidence submitted to the card network
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
What's the difference between refund fraud and a genuine complaint?
Honestly, a single claim often can't be told apart — parcels really do go missing and items really do arrive damaged. The distinction lives in the pattern, not the story. A first-time customer reporting one problem deserves the benefit of the doubt, while an account with repeated 'not received' claims, serial empty-box returns, or a chargeback filed the instant a refund is refused is showing the signature of first-party fraud. Judge histories and clusters, not individual accounts of woe.
Is 'friendly fraud' actually illegal, or just policy abuse?
Deliberately claiming a refund or chargeback you know you're not entitled to — saying a delivered parcel never came, or a used item was faulty — is a false representation for financial gain, which is fraud in most jurisdictions, even when the person is a genuine customer. Enforcement against small individual cases is rare, which is why it feels consequence-free. Organised refunding-as-a-service operations, however, are straightforwardly criminal and are increasingly pursued alongside the retailers and card networks they target.
How do refunding-as-a-service operations actually work?
They sell fraud as a service. A buyer who wants something free pays the operator a percentage — usually in cryptocurrency — and the operator files the refund claim against the retailer on their behalf, using scripts refined against that specific store's policies: missing items, damaged packaging, courier errors, or 'did not authorise' disputes. They map which retailers refund without a return, which have weak intake checks, and which cave to chargeback threats. Because they run at scale across many buyers, they can hit one merchant repeatedly.