Return fraud prevention: the evidence playbook for every false claim

A refund request lands in the inbox with a photo of a cracked screen, an empty carton or a hoodie in the wrong size. Somewhere a support agent has about two minutes to decide whether it is true. This playbook is for the seller, returns manager or warehouse lead who wants that decision to rest on evidence instead of instinct.

It maps every common false claim to the record that answers it, then links to a full guide for each one. If you only read one section, read the master table: it tells you what to capture, and when, for each claim you are likely to see.

What return fraud covers, and what it does not

Return fraud is any return or refund claim that misstates what was shipped, what arrived or what came back, made to get money or goods the buyer is not owed. It sits inside a wider family of post-purchase abuse, and the boundaries matter because each one is fought with different evidence.

What it does not cover: stolen-card fraud, where the cardholder never placed the order. That is a payment authorization problem, answered with transaction and device data rather than anything that happened at the packing bench. If your dispute says "unauthorized", start with which disputes packing video supports instead.

The useful way to think about the rest is by the moment the claim is about. Every return fraud claim points at one of three moments: what went into the box, what came out of it at the buyer's door, or what came back to you. Your evidence has to exist at that moment. Everything in this playbook follows from that.

How big return fraud is in 2026

Refund and policy abuse is now the fraud attack merchants report most often, according to the Merchant Risk Council's 2026 survey. The numbers below come from the most recent survey or report each source has published; follow the links for methodology.

Two patterns run through all of them. First, the abuse is post-purchase: the order and payment are genuine, so card fraud screening never sees it. Second, the merchant almost always holds less evidence than the buyer at the moment of the claim. The buyer has a photo. The merchant has an invoice.

The master table: evidence by claim type

Each return fraud claim is answered by one specific record, captured at one specific moment, and the table below lists both for nine claim types. For each claim, the third column is the record that answers it, and the fourth is the moment it has to be captured. Miss that moment and the record cannot be made later.

Read the fourth column again. Eight of the nine rows depend at least partly on a record made before the parcel left you, and four on a record made when the return arrives. That is the whole operational model: two capture points, one at dispatch and one at return receipt, both tied to the order.

Empty box claims: the hardest one to argue after the fact

An empty box claim is answered only by a record of the item going into that specific carton before it was sealed. Tracking proves delivery, the invoice proves what was ordered, and a photo of a closed box proves a closed box exists. None of them shows what was inside.

The strongest version of the record is one continuous take: the order reference in frame, each item placed in the carton, and the flaps closing and taping on camera. A carrier's scan weight consistent with a full parcel is a useful second signal, but it is corroboration, not proof. In the MRC data above, false "not received" claims were the single most common form of refund abuse, and empty-box claims are their close cousin: the parcel arrived, and the buyer says the contents did not.

The full response, including platform-by-platform filing routes and reply templates, is in the customer says the box was empty.

Arrived damaged: condition at the moment you sealed it

A damage claim is answered by showing the item intact and adequately cushioned before the box closed, plus the buyer's own photos of the outer and inner packaging. Two separate questions sit inside every damage claim: whether the item left you intact, and whether it was packed well enough for normal handling. Carriers refuse claims that fail either one.

Concealed damage (a broken item in a box that looks fine) is where a pre-shipment record matters most, because it removes the explanation a reviewer otherwise assumes: that you shipped it damaged. It is also the claim that AI-faked photos imitate, covered further down this page. Read customer says it arrived damaged for the 48-hour response sequence and carrier evidence pack.

Wrong item, wrong variant, missing unit

A wrong-item claim is an identity question, so it is answered by identifiers, not by how the product looks. The order reference and the unit's SKU barcode, size label or serial number need to appear in the same frame before sealing. A pristine product photo proves the SKU exists; it does not prove which order it went into.

There are four versions of this claim (different product, wrong variant, missing unit, "not authentic"), and each needs a different identifier. Variant claims are the hardest, because a size M and a size L hoodie are identical in a photo; the label is not. The full breakdown, with an evidence pack for each version, is in customer says you sent the wrong item.

Wardrobing: the return that is technically inside policy

Wardrobing is answered by comparing the item's condition at dispatch with its condition when the return was opened, both tied to the same order. The purchase is real, the return is inside your window and the buyer has said nothing false in writing. Only the item's condition tells the story.

Without a "before" record, a photo of a worn garment proves only that it is worn now, not who wore it. With one, a reviewer does not need to judge fabric; they only need to see that something changed. Non-reattachable tags turn a subjective wear argument into a visible fact. Our guide they wore it, then returned it covers platform deduction rules and measured reply templates.

Return swap: a different unit comes back

Return swap fraud is answered by a unique identifier, such as a serial number or IMEI, recorded at dispatch and checked on the unit that comes back. A buyer keeps the new unit and returns an older, broken or counterfeit one, or a box of e-waste. Without a unique marker there is no way to show the returned unit is not yours.

The pattern became headline news in June 2026, when Tom's Hardware reported that a buyer who ordered a roughly $700 RTX 5070 graphics card from Amazon received a DVD rewriter and a logic board from an old AV receiver, most likely the remains of an earlier buyer's swapped return that went back into stock. The fix starts at dispatch: put the serial in the recording next to the order number, then open every return of that SKU on camera. The step-by-step version, with appeal templates for marketplaces, is in return swap fraud and serial numbers.

AI-generated damage photos: when the evidence itself is fake

AI-faked damage photos are answered by evidence the buyer did not create: your sealed record of the item before dispatch, footage the buyer films of the item and its packaging when the return opens, and the physical return before a refund. Detecting the fake from the image alone is not reliable.

In March 2026, Modern Retail reported that Boll & Branch had received a torn-sheet photo carrying an AI watermark, and that a Bogg customer had resent an earlier photo of a tote with a rip added. Boll & Branch ended its case by asking the shopper to show the damage on a video call, which never happened; Bogg now requires the product back before refunding a suspicious defect. Metadata checks, reverse image search and AI detectors all help at the margin and all produce false negatives. The guide AI-generated damage photos in refund claims includes a copy-ready reply to a suspicious photo that asks for evidence without accusing anyone.

Refund fraud as a service: claims written by professionals

Refund fraud as a service is answered by the same evidence as the claims it imitates, plus controls that remove the shortcuts refunders rely on: refunding at first carrier scan, auto-approving small claims, and never weighing or opening returns. A buyer places a real order, then pays a "refunder" a percentage of the order value to extract a refund with a scripted claim.

Refunders sell specific tactics: empty-box and missing-item claims, "never arrived" claims backed by forged police reports, fake return tracking, and, in the worst cases, insiders who scan parcels as returned. Security researchers at Netacea put the typical fee at 10 to 30% of the refunded value. Because the order and payment are genuine, payment fraud tools stay quiet. The full tactic-by-tactic table, with the evidence that breaks each one, is in refund fraud as a service.

Collecting return photos on Shopify

Shopify's native return request collects the items, a return reason and a note, but no photos, so a store that wants damage evidence has to collect it another way. The options are an email back-and-forth, a returns app with photo upload rules, or a dedicated return evidence request that also keeps the footage next to your packing record.

The practical rule is to require photos only where they change the decision: damaged, defective, wrong item and not as described. Asking for footage on "changed my mind" returns adds friction to the buyers least likely to be committing fraud. The comparison of each option, with listed prices of the leading returns apps, is in Shopify return photo upload.

Item-not-received abuse: where packing evidence ends and carrier evidence begins

A false "not received" claim is answered first by the carrier's delivery record, not by a packing record. The question is whether the parcel reached the door, and only the carrier's scan, delivery photo, signature or one-time code speaks to that.

A packing record still has a role: it establishes that the parcel existed and was sealed with the right contents, which closes off the "you never shipped it" version of the claim and the "it arrived empty" fallback that often follows a failed not-received claim. For high-value orders, the delivery-side control that matters most is signature or one-time-code delivery: Netacea's researchers found that refunders' not-received claims work best on unsigned, no-contact deliveries. Platform-specific dispute routes are in seller dispute evidence by platform.

Seven mistakes that turn a winnable return dispute into a refund

Most lost return disputes are lost on timing: refunding, inspecting or recording at the wrong moment, rather than on weak arguments.

The two-capture routine that covers every claim

Every claim in this playbook is answered by a record made at one of two moments: dispatch, or return receipt. A routine built around those two moments covers the whole cluster without recording everything you ship.

How PallasMark covers the whole return fraud cluster

PallasMark is the complete evidence system for both capture points, running on the phones your team already has. It turns the routine above into one record per order, from the moment the item goes into the box to the moment the buyer's footage comes back.

At dispatch. Scan the barcode on the picking slip or shipping label and the app opens that order, so the recording is bound to it before the first frame. Photos are stamped with your company name, the order number and the upload time inside the image file. Every stored file gets a SHA-256 fingerprint, there is no edit button for recordings anywhere in the product, and each proof has a public verification page that re-hashes the stored file and shows whether it still matches. A buyer, a bank or a marketplace agent opens it with no account. That is what makes the record tamper-evident rather than just a clip.

Before the parcel leaves. For high-value or dispute-prone orders, hold the parcel and send the buyer the sealed recording with one tap. They open a link with no app and no account, watch, and choose Approve or Report an issue. The record keeps how long they watched, and you can require them to watch a share of the video before the approve button unlocks. The buyer approved this exact parcel before it shipped, which is hard to contradict later. See buyer approval.

When a return opens. Shopify and ShipHero returns trigger a return evidence request automatically: the buyer gets a link to film or photograph the returned item and its packaging. You choose which of seven return reasons trigger it, whether evidence is optional or required, and how long the link stays open (1 to 168 hours), with one reminder. WooCommerce orders get a one-tap request button, and any open return can be requested from the Returns page. The buyer's footage is fingerprinted and lands on the same order as your packing recording.

When a dispute arrives. On request, PallasMark builds one evidence dossier for the order: a PDF with four stills from each recorded video, order details, photos, fingerprints, the buyer's approval and the return evidence, plus the carrier and tracking number read from your store. You download it and upload it to the payment provider, marketplace or carrier yourself, or share a time-limited link with an optional PIN. Shopify Payments chargebacks open a case and email your team with reminders before the deadline. See chargeback evidence.

At the warehouse. Receiving, packing and dispatch records can be tied to a facility and, for 3PLs, a client brand, with custom fields such as a serial number. On the Scale plan, AI label reading fills those fields from a photo of the label into a form the operator checks before saving.

The whole setup runs on iPhone, Android or a browser, with no cameras to mount and no per-station fees. Start on the free plan with no card, or see pricing and the returns use case for how teams roll it out.