← field notes

Refund Fraud: How Retailers Catch the It Never Arrived Scam

somewhere in a returns database there is a customer who has been refunded for forty orders that all supposedly never arrived. forty packages, forty separate claims, every one ending the same way. it left the warehouse, it never reached the door, here is your money back.

any single one of those claims is ordinary. parcels really do go missing and couriers really do leave packages at the wrong house. but forty in a row, to one account, is not bad luck. it is a pattern, and somewhere a system finally noticed it.

this is the quiet war inside every online store. not dramatic theft, but a slow leak through the one promise retailers make to win your trust. you can send it back, you can get your money. and a small number of people have turned that promise into a business.

what refund fraud actually is

refund fraud is getting money back for something the customer was not actually owed. the goods arrived fine, or arrived at all, and the customer claims otherwise to keep both the item and the cash. it is theft dressed up as a routine customer service request.

it works because returns run on trust by default. a store that argues with every unhappy customer loses far more in goodwill than it saves, so the profitable path is to believe people. fraud lives in the gap between believing people and being able to prove anything.

the common claims

most refund fraud hides behind a handful of ordinary stories, the same ones an honest customer might genuinely tell. that is the point. the claim has to be the kind of thing that happens to real people all the time.

the first is the item never arrived. tracking says delivered, the customer says it is not here, and now it is one person’s word against a courier’s scan. the second is that it arrived empty, or broken, or clearly the wrong item, so the box came but the value did not. the third is a quiet swap, where something real is returned but not the thing that was bought.

each maps onto a true thing that happens by accident. packages are stolen off porches, items break in transit, warehouses pick the wrong thing. the fraud borrows the texture of honest mistakes, and those are common enough that a store cannot simply refuse them all.

when refunds become a business

for most people a false refund is a one off temptation, a single parcel they decide to lie about. that is a rounding error to a large retailer. the real problem is the organized version, where refunds stop being an accident and become the entire model.

at that scale it stops looking like a customer and starts looking like an operation. the same stories get filed over and over, across many accounts, against many stores, and some of it is even sold as a service. seen from the inside it has the texture of a small logistics business rather than a crime, which is part of why it persists.

why generous policies are the target

the stores hit hardest are often the ones trying hardest to be liked. free returns, no questions asked, instant refunds before the item is even back. every one of those policies exists to win customers, and every one widens the door that fraud walks through.

an instant refund issued before anything is checked is fast and pleasant for the honest majority. it is also a gift to anyone willing to lie, because the money moves before the proof does. so retailers sit on a genuine tension. the policy that converts the most browsers into buyers is also the one that invites the most abuse, and they cannot simply tighten everything without losing the honest customers it was built for.

detection starts with history

the first thing a retailer looks at is not the claim. it is the person making it. a single never arrived report from an account with years of clean orders barely registers. the same report from an account that has filed five this month is a different thing entirely.

this is why your account quietly carries a record. how many orders you have placed, how many you have returned, how many times you have said a package never came or arrived damaged. all of it builds a picture of how risky your next claim is to believe. the logic mirrors a credit history, except it scores your honesty about deliveries instead of your repayment of loans.

pattern analysis across customers

a single account only tells you so much. the sharper view comes from stepping back and looking at everyone at once, because fraud that hides perfectly at the level of one customer often stands out the moment you compare customers to each other.

one person claiming a package never arrived is noise. fifty accounts claiming the exact same product never arrived, from the same area in the same week, is a signal no honest pattern produces. so the systems look for clustering across supposedly unrelated accounts. the lie is rarely in any single claim. it is in the shape of all of them together.

delivery proof and carrier data

against the most common claim, the never arrived one, the strongest answer is evidence from the delivery itself. the tracking scan, the timestamp, the route, and increasingly a photo the driver took of the package on the doorstep.

carriers feed a surprising amount of data back to retailers. the gps point where the scan happened, whether it matched the shipping address, and the parcel weight leaving versus returning. an empty box claim runs straight into a weight log that says the return weighed almost nothing. none of it is perfect, but it shifts the question from one person’s word against another to something closer to a record.

serial returner scoring

out of all this history, retailers build something like a risk score for returns. quietly, every shopper sits somewhere on a scale from obviously honest to repeatedly suspicious. the industry sometimes calls the high end serial returners.

a high score is not an accusation. it is friction. the instant refund gets held until the item is inspected, the claim gets routed to a human, the next return requires the package back before money moves. the uncomfortable part is that a genuinely unlucky customer who received three broken items in a row can look identical to an abuser on a graph. the system is making a bet on probability, not a finding of fact.

linking accounts that share signals

the organized version relies on having many accounts, because one account filing endless claims burns out fast. so a lot of detection is aimed at undoing that, at proving that a dozen separate looking accounts are really one operation.

the links are the things people forget to vary. a shared delivery address, a reused payment method, the same device fingerprint, the same home network. each is a thread, and pulling on enough of them collapses a crowd of accounts back into a single actor. once accounts are linked, history stops being something you can escape by starting fresh, because a new account inherits the suspicion of the ones it is tied to.

the cat and mouse that never ends

none of this ends, because the incentives never go away. stores that demanded the item back before refunding taught abusers to return an empty box that weighs about right. stores that leaned on delivery photos taught them to claim the photo shows the wrong door. every control narrows the gap, and the response is to find a new one.

the defenders know they cannot win outright. zero fraud would require treating every customer like a suspect and destroying the business in the process. the goal is to make abuse expensive and slow enough that the honest experience stays smooth for almost everyone.

the balance, and the quiet score

both kinds of error are expensive. approve too many false claims and the leak drains real money year after year. challenge too many real customers and you insult the honest majority the policy was built to please. a wrongly refused refund is not one lost sale, it is a customer telling everyone the store called them a liar over a parcel that genuinely never came.

so here is the tension that never resolves. the easier a store makes it to send something back, the more customers it wins and the more it invites the exact behavior it cannot afford. there is no setting that gives frictionless returns and zero abuse at once. so every store that offers easy returns is also, quietly, scoring you, deciding before you even file a claim how much of your word it is willing to take. for the honest majority it stays invisible for life. but it is always there, running in the background, the unspoken cost of a promise that only works because somebody is quietly watching who keeps it and who does not.

The Hidden Internet takes apart the systems that quietly run the modern web, explained from the inside. No products, just the machinery. Subscribe on YouTube.

watch
The Hidden Internet on YouTube

Every field note starts as a short documentary. Watch the systems in this piece explained on screen.

subscribe →
read on
More field notes

The rest of the series on how the modern internet detects, tracks, and sorts the traffic that reaches it.

browse the archive →