How a pandemic-era edge case became the top fraud threat in ecommerce, and why refund abuse trends show defenses designed for 2020 are the real vintage problem
Refund abuse is so 2020. That is true in both senses. The modern version of the behavior, manufactured claims and policy exploitation filed through support channels instead of stolen cards at checkout, took its recognizable shape during the pandemic ecommerce boom. And too many merchant defenses are still dressed for that year: blanket rules written in a panic, claims judged one ticket at a time, and a fraud program pointed at checkout while the losses moved to the refund queue.
Refund abuse is the deliberate exploitation of a merchant’s refund, return, and claims processes for financial gain: returning used or substituted items, claiming deliveries never arrived, sending back empty boxes, or working support for refunds and credits the purchase never earned. It sits inside the larger category of first-party fraud, because the person doing it is the customer of record, not an intruder. Understanding how it got from fringe to mainstream is the fastest way to see why the old defenses stopped working.
Before 2020: A Returns Desk Problem
Return fraud is older than ecommerce. Wardrobing a dress for an event, renting a camcorder for the weekend, and walking shelf goods to the service counter for a receipt-free refund were loss prevention’s problems for decades. What kept the behavior contained was friction: the abuser had to show up, face a person, and hand over a physical item. The pattern lived at the returns desk, and so did the defense.
Ecommerce loosened that constraint through the 2010s as free returns became a competitive requirement, but the economics still read like a service cost rather than a fraud category. The fraud program watched the transaction. The returns program watched logistics. Nobody owned the gap between them, which is exactly where the next five years happened.
2020: The Year the Refund Went Remote
Then the stores closed. NRF measured $428 billion in merchandise returned in 2020, and online returns more than doubled from 2019 as lockdown spending moved online. Inside that flood, retailers reported $25.3 billion in return fraud, losing $5.90 of every $100 in returns they accepted, with the online share of fraud running hotter than the in-store share.
The structural change mattered more than the totals. For the first time at scale, the entire abuse loop went remote: no counter, no eye contact, no physical inspection before the refund moved. A claim became a ticket, a chat, an email, judged by an agent under queue pressure with no view of the claimant’s history. Distance did for refund abuse what the stolen card number once did for payment fraud. It removed the part that took nerve.
2021 to 2023: Normalization Sets In
The pandemic receded. The behavior did not. NRF’s 2021 returns research counted $761 billion in returns, 16.6% of US retail sales, with online purchases returned at 20.8%. The fraud rate nearly doubled in a single year: retailers reported losing $10.30 to return fraud for every $100 in returned merchandise, up from $5.90 the year before.
Something else shifted in those years that the dollar figures only hint at. Methods that once circulated in corners of the internet became openly traded knowledge, and a behavior that people once hid began to read, to a meaningful slice of shoppers, as a harmless workaround. The abuse stopped being a technique and started being a norm.
2026: Mainstream, Measured, and Professionalized
Today the mainstreaming is fully measurable, and the measurements agree with each other. NRF projects $849.9 billion in returns for 2025, and its consumer research finds nearly two-thirds of shoppers admit to costly return practices like wardrobing and bracketing, with 45% saying it is acceptable to bend the truth when returning. Mastercard puts first-party fraud above 45% of all chargebacks. The Merchant Risk Council’s global fraud research now ranks refund and policy abuse as the top fraud threat in ecommerce, ahead of the stolen-card categories that defined the field.
The supply side professionalized along with the demand side. Visa’s fall 2025 threat research describes criminals operating like tech startups, building reusable infrastructure, with AI producing impersonations and fake content at scale. The shopper bending the truth about a return and the organized operation filing manufactured claims across hundreds of accounts are different actors, but they exploit the same door: a refund process that evaluates each claim as if it were the first.
Why 2020 Defenses No Longer Hold
Every era of the refund abuse trends history produced a matching defense, and each one is now a size too small.
- The returns desk instinct says inspect harder. Blanket tightening, shorter windows, restocking fees, and verification on everyone reduces abuse and honest repurchase together, which is the one-size-fits-all policy trap in its purest form.
- The 2020 instinct says empower agents to resolve fast. Generosity at ticket speed is exactly what normalized abuse learned to harvest, from serial returners to manufactured item not received claims.
- The checkout-era instinct says screen the transaction. But the transaction in refund abuse is legitimate. The signal lives after the money moves, in return, claim, and dispute behavior across the relationship, which is what a customer risk profile exists to read.
A behavior that went mainstream cannot be managed as an exception. It has to be priced the way any mainstream behavior is priced: continuously, at the customer level, with generosity flowing to the histories that earned it and friction reserved for the patterns that did not.
How Wyllo Helps
Refund abuse trends made the customer relationship the unit of fraud, and reading intent across that relationship is what Wyllo, the risk intelligence platform for commerce, was built to do.
- Wyllo Return Fraud and Abuse Prevention scores return and refund behavior at the customer level, separating honest high-returners from the business-model abuser.
- Wyllo Claim and Policy Abuse Prevention catches claim patterns and links repeat actors across rotating identities, resolving abuse before it becomes a dispute.
- Wyllo CX Support puts that history inside the agent’s ticket, so the 2020-era blind spot, the claim judged cold, closes where it opened.
Wyllo is built for what’s next in refund abuse trends. The behavior kept evolving; the defense should too.
Frequently Asked Questions
What is refund abuse?
Refund abuse is the deliberate exploitation of refund, return, and claims processes for financial gain: returning used or substituted items, falsely claiming non-delivery, sending back empty boxes, or extracting refunds and credits through support channels. It is a form of first-party fraud, committed by the actual customer rather than an outside attacker.
When did refund abuse become widespread?
The behavior is old, but it refund abuse trends show it scaled during the 2020 ecommerce boom, when claims went fully remote and online returns more than doubled. NRF data shows return fraud losses nearly doubled per returned dollar between 2020 and 2021, and by 2025 the Merchant Risk Council ranked refund and policy abuse the top fraud threat in ecommerce.
Is refund abuse the same as return fraud?
They overlap heavily. Return fraud centers on the returned item itself, like wardrobing or empty boxes, while refund abuse covers the broader exploitation of refund and claims processes, including claims where nothing is returned at all. Both are first-party behaviors, and both are invisible to transaction-level screening.
How do merchants stop refund abuse without hurting good customers?
By moving from blanket policies to relationship-level decisions. Score return, claim, and dispute behavior per customer, give clean histories fast and generous resolutions, require verification where the pattern warrants it, and keep support, returns, and disputes working from one record so the same claim cannot be paid twice.
Bringing It Together
Refund abuse followed the classic arc of a mainstreamed exploit: contained by friction, released by distance, normalized by repetition, and finally professionalized. Each stage left merchants a defense suited to the stage before it. The returns desk playbook, the pandemic-era generosity, and the checkout-centric fraud program were all right for their moment, and none of them can see a behavior that now lives in the space between systems and inside the customer relationship itself.
The encouraging part of the history is that the answer does not require choosing between trust and protection. The same relationship-level view that catches the serial claimant is what lets the honest customer keep the easy, generous experience the last six years taught them to expect. The era is different. The defense should be too.
Start with Wyllo Return Fraud and Abuse Prevention to see refund behavior at the customer level, or explore the Wyllo platform for intent read across the whole journey.
