Refund fraud as a service: how refunders work and how to stop them

A support agent receives a polite, well-written message: the parcel arrived, the box was empty, here is a photo of the open carton. The account has two previous orders and no complaints. The claim is just under the amount the team refunds without review. The agent refunds. Somewhere else, a refunder marks the order as "completed" and invoices their customer for 20% of it.

This guide explains how refunding services work, which tactics they sell, and which evidence and controls break each one. It is part of our return fraud evidence playbook.

How refunding services work

A refunding service is a business that extracts refunds from retailers for paying customers who received and kept their goods. The customer supplies a genuine order. The refunder supplies the method and the persistence, and takes a cut.

Sardine describes the cycle in four steps: the refunder advertises working methods and prices sorted by retailer; the buyer places and pays for a real order and shares the details; the refunder contacts support with a scripted claim; and the retailer refunds, after which the buyer pays the refunder's percentage. Researchers at Netacea, writing in SecurityInfoWatch, reported fees of 10 to 30% of the refunded value and services advertised on hacker forums with dedicated sections, while CNBC's investigation, syndicated by NBC San Diego, found services promoted on TikTok and Telegram charging 15 to 30%.

Three features make this harder than ordinary friendly fraud:

• The buyer looks clean. A legitimate customer with no fraud history hires an experienced fraudster, so account-level risk scores stay low.
• The claim is rehearsed. Sardine describes scripted claims that cite the merchant's own policy, escalate to a supervisor and target the amount agents can refund without investigation.
• Merchants are profiled. Netacea's researchers found refunders keep lists of retailers, noting item types, values, processing times and fees. A merchant that refunds quickly without checks becomes a listed target.

The tactics, and the evidence that breaks each one

Every refunder tactic claims something about one of three moments: what went into the box, whether it was delivered, or what came back. The tactic fails when you hold a record of that moment that the refunder cannot edit.

The definitions come from the security research above. Netacea's blog describes boxing services as creating fake postage information such as labels and receipts, fake tracking as altering tracking details so a junk parcel is logged as sent, and "scanning" as insiders flagging intact parcels as damaged or lost. CNBC reported refund groups paying retailer employees for batches of packages scanned as returned, and allegations that carrier employees altered tracking histories. Modern Retail added fabricated police reports and fake drop-off receipts to the list in 2026, and AI now writes the claim messages and, increasingly, the damage photos (see AI-generated damage photos in refund claims).

Notice what the third column has in common. Not one entry is "a better argument". Each is a record made by you or the carrier at a moment the refunder does not control.

Who has been caught

Refunding is prosecuted when it is organized, which is also when evidence from individual merchants matters most. Investigators build cases from the same per-order records a dispute reviewer asks for.

Why your fraud stack misses it

Refund fraud as a service passes payment screening because nothing about the payment is false. The card is the buyer's, the address is theirs, the device is theirs. Sardine's description is blunt: payment fraud signals stay quiet because the order and payment are genuine, and the abuse happens in the post-purchase support channel.

That moves the defense to two places: what your support team is allowed to do without evidence, and what evidence exists when they need it. The Chargebacks911 2026 field report found merchants estimate abusive requests at 27.1% of returns, and that 23.5% of merchants use five or more separate tools to compile dispute evidence. The second number is the operational problem in miniature: the evidence exists in fragments, if it exists at all, and nobody has it in one place when the claim arrives.

Operational controls that remove the shortcuts

Refunders succeed where a refund can be issued faster than anyone checks. Each control below removes one of those shortcuts, and none of them slows down an honest low-value claim.

How to respond to a suspected refunder claim

The response has one goal: replace the refunder's script with records they cannot produce, without accusing a customer who might be genuine.

Copy-ready replies

Refunders escalate when they meet resistance, so keep every message short, factual and on the platform's own record. The same wording works for genuine customers.

If the buyer then files a card chargeback, the same records answer it. Turn them into a document the issuer can read: card disputes run on PDFs and images, not video files, as covered in which disputes packing video supports.

How PallasMark handles this

PallasMark puts the records from the third column of the tactic table into one place per order, made on the phones your team already uses, so the evidence is there when the scripted message arrives.

A packing record the refunder cannot edit. Scan the order barcode and the app opens that order, so the recording is bound to it before the first frame. Every stored file gets a SHA-256 fingerprint, there is no edit button for recordings anywhere in the product, and a public verification page re-hashes the file on demand, so a buyer, bank or marketplace agent can check it with no account. See tamper-proof video.

The buyer's own approval before dispatch. Set a rule so that orders above an amount are held for buyer review; one tap then sends the buyer the sealed recording. They watch on a link with no app or account and choose Approve or Report an issue, and the record keeps how many seconds they watched and, if you enable it and they allow it, their location. An empty-box or not-as-described claim after that has to contradict the buyer's own confirmation. See buyer approval.

Footage for damage and return claims. When a buyer opens a Shopify or ShipHero return, PallasMark automatically sends them a link to film or photograph the item and its packaging; WooCommerce orders get a one-tap request, and any open return can be requested from the Returns page. See return evidence.

One dispute file. On request, PallasMark builds an evidence dossier for the order: a PDF with four stills from each recorded video, order details, fingerprints, the buyer's approval and the return evidence, plus the carrier and tracking number read from your store. You upload it to the payment provider or marketplace yourself. Shopify Payments chargebacks open a case in PallasMark and email your team, with reminders 7 days and 48 hours before the deadline. See chargeback evidence.

There is no hardware to buy and no per-station fee, and you can start on the free plan with no card. See pricing, or the buyer trust use case for how sellers use approval links to cut disputes.

Related reading

Refunders sell variations of the claims covered in the return fraud evidence playbook. For the most common scripted claim, see the customer says the box was empty. For returns that come back as a different unit rather than an empty box, see return swap fraud and serial numbers, and for collecting buyer footage on Shopify returns, see Shopify return photo upload.