Refund Fraud: The Hidden Threat Inside Every Returns Policy

Key takeaways

• Refund fraud could be costing UK online retailers up to £5.76 billion a year, according to research funded by Cifas.

• Fraudsters openly trade techniques on cybercrime forums and Telegram, and some "refund-as-a-service" vendors charge up to 30% of the refund value.  

• Generative AI is being used to fabricate damage photos and doctored receipts, and AI-generated damage claims are reported to be the fastest-growing form of return abuse.  

• Because each refund looks like an ordinary customer service interaction, refund fraud is rarely caught by traditional payment fraud controls.

• Detection depends on joining up returns, logistics and payments data, and on external intelligence into where refund methods are being shared and sold.

A growing attack surface for fraudsters

Fraud in the UK continues to evolve as criminals adapt to new payment methods, new platforms and new customer habits. The sheer volume of transactions gives them plenty of places to hide. UK Finance's UK Payment Markets 2026 report shows that 49.7 billion payments were made in the UK in 2025, excluding CHAPS, and that around 45.9 million people, or 80% of UK adults, bought goods or services online during the year.  

Every one of those online purchases creates a potential gateway: a checkout, a delivery, a customer service chat, a returns portal and, eventually, a refund. With so many touchpoints spread across retailers, couriers, payment providers and outsourced support teams, it is easy for certain types of fraud to slip through unnoticed. Refund fraud is one of the clearest examples, and this blog explains how it works, why it is so often missed and what organisations can do about it.

The scale of fraud in the UK

The wider fraud picture sets the context. UK Finance's Annual Fraud Report 2026 found that criminals stole £1.28 billion through payment fraud in 2025, an increase of 4%. Ruth Ray, Managing Director of Economic Crime at UK Finance, said "Fraud operates on an industrial scale, harming people, businesses and the UK economy".

Online retail is a particular pressure point. Remote purchase card fraud, where stolen card details are used to buy goods online, rose to £423.5 million in losses, while case numbers climbed 13% to 3.2 million. Refund fraud sits alongside these figures but is largely absent from them, because the loss is typically absorbed by the retailer as a returns cost rather than reported as a payment fraud case.  

What is refund fraud?

Refund fraud is the act of obtaining a refund, replacement or credit that the claimant is not entitled to, usually by manipulating a retailer's returns or dispute process. It differs from traditional card fraud because the original purchase is often entirely legitimate. The deception happens after the sale, when the fraudster convinces the merchant that an item never arrived, arrived damaged or has been returned when it has not.

The financial impact is significant. New research supported by the University of Portsmouth estimates that refund fraud could be costing UK online retailers up to £5.76 billion a year, a figure that dwarfs many of the payment fraud categories the industry tracks closely.  

How refund fraud works: the main techniques

The most common methods that fraudsters use include claiming items did not arrive, reporting partial or empty boxes, using fake tracking IDs to simulate returns, returning substitute or counterfeit goods, wardrobing, and abusing food delivery refunds. Each exploits a different weakness in the returns chain.  

• "Did not arrive" claims exploit the gap between a courier's delivery scan and what the customer says happened at the doorstep, particularly where there is no photographic proof of delivery.

• Empty or partial box claims target the difficulty of proving what was inside a sealed parcel, especially when warehouse packing weights are not recorded or checked.

• Fake tracking IDs create the appearance that a return has been shipped, so that automated systems release a refund before the warehouse confirms receipt.

• Substitution involves returning a cheaper, counterfeit or broken item in place of the original, relying on returns teams not inspecting goods closely.

• Wardrobing involves using an item, such as clothing for an event, and returning it as unused.

• Food delivery refund abuse takes advantage of the low value and high volume of these orders, where providers often refund quickly rather than investigate.

Many of these schemes also rely on social engineering. Fraudsters script conversations with customer service agents, probe for staff who are likely to approve a refund without escalation, and learn exactly which phrases trigger automatic resolutions.

Refund-as-a-service: an organised underground economy

What has changed in recent years is the professionalisation of these methods. The Cifas-funded study analysed nearly 500,000 posts across cybercrime forums, Telegram, Nulled and Cracked, where fraudsters openly share techniques, select target retailers and sell fraudulent refunds as a paid service. Some of these vendors were charging up to 30% of the refund value in return for a guaranteed outcome.  

In practice, a "refunder" advertises a list of retailers they can target, the maximum order value they will handle and their fee. The customer places a genuine order, hands over the order details, and the refunder handles the fraudulent claim on their behalf. This model lowers the barrier to entry considerably, because the end customer needs no technical knowledge at all.

Mike Haley, CEO of Cifas, said "Refund fraud is not harmless - it is organised, widespread and costing UK retailers billions."  

How AI is accelerating refund fraud

Generative AI has given refund fraudsters a new way to manufacture evidence. Fraudsters can now quickly doctor receipts or create realistic images of damaged goods, such as torn clothing, to support false refund claims, and organised groups are using AI to fabricate convincing evidence ranging from fake damage photos to detailed "item not received" narratives.  

This matters because many returns processes were designed on the assumption that a photograph is reliable proof. When a convincing image of a cracked screen can be generated in seconds, photo-based verification alone is no longer sufficient. The same article notes that 44% of UK businesses say they are being affected by returns and refund abuse.  

Why refund fraud is so easy to miss

Refund fraud tends to fall between organisational silos. The payment itself is genuine, so payment fraud models see nothing unusual. The claim arrives through customer service, where the priority is fast, friendly resolution. The logistics evidence sits with a third-party courier, and the physical inspection of returns happens in a warehouse that may not be connected to the fraud team at all.

Individual losses are also usually small enough to be written off as a cost of doing business. A single £80 refund rarely triggers an investigation, but the same refunder may be running hundreds of similar claims across multiple accounts and multiple retailers. Without a way to link those claims together, each one looks like an isolated customer complaint.

Detecting and preventing refund fraud

Effective defence combines internal data analysis with external intelligence. Useful technical controls include:

• Cross-referencing logistics data, such as courier scan events, delivery geolocation and parcel weights at dispatch and on return, against the customer's claim.

• Linkage analysis across accounts, devices, delivery addresses and payment methods to identify clusters of claims that point to a single operator or refund service.

• Velocity and pattern monitoring to flag accounts with unusually high claim rates, repeated use of the same claim wording, or refunds concentrated on high-value items.

• Image forensics that check metadata and look for signs of AI generation or manipulation, while recognising that metadata can be stripped and should not be relied on in isolation.

• Tiered refund policies that hold refunds until returns are physically inspected for higher-value or higher-risk orders, rather than releasing them on a tracking number alone.

• Intelligence sharing across the sector. The researchers called for an industry-wide database, like Cifas' National Fraud Database, so retailers can track known offenders and share intelligence more effectively.

The role of threat intelligence

Because refund-as-a-service operators advertise openly, their activity leaves an intelligence trail. Monitoring cybercrime forums, Telegram channels and underground marketplaces allows organisations to see when their brand appears on a refunder's target list, which weaknesses in their returns process are being discussed, and when new methods or tools are being circulated. That insight turns refund fraud from a reactive customer service problem into something that can be anticipated and designed out.

CYJAX provides threat intelligence that helps UK organisations understand how fraud tactics are developing in these spaces, giving fraud, security and operations teams the context they need to adjust controls before losses mount. To find out how CYJAX can support your organisation, get in touch with our team.