Refunduary is here

It’s not just the deluge of product returns and chargebacks that creates a holiday hangover for ecommerce merchants this time of year. January also rings in a high volume of refund claims that don’t involve a return. 

Riskified data indicates that orders placed during the holiday season, specifically in November and December, accounted for 31% of all refund claims throughout the year. This surge significantly increases the workload for customer service teams during an already busy time. In fact, Riskified found that across the network, more than 55% of January’s claims originated from pre-holiday orders.

And it’s not only an operational headache; it’s a costly abuse vector. 

What is refund abuse?

Refund fraud primarily manifests as “Item Not Received” (INR) and “Did Not Arrive” (DNA) claims. Because items do not need to be returned in these scenarios, abusers can exploit gaps between merchant and courier records. Many merchants lack reliable last-mile visibility, making it difficult to disprove a false non-receipt claim, and as a result, merchants are rightly hesitant to falsely accuse any good customers.

Riskified conducted a year-long analysis of data from a subset of major retailers to quantify abusive INR and missing-item claims and their costs. The results confirm that refund abuse is no mere operational nuisance. It is a costly and organized threat, amplified by dark-web communities that treat the busy holiday period as “prime refunding season.”

Key findings from Riskified’s analysis

01. It’s a multi-billion-dollar loss category

Across the analyzed retailers, 1–2% of their total order value is requested back as refunds; nearly 1 in 4 of the refunded dollars is from an abusive claim. For large merchants, this represents millions of dollars annually, making it a billion+ problem industry-wide.

02. Abusers use holiday volume to mask high-risk activity

While claim rates remain steady during Q4, claim volume doubles as abusers seek to blend into the heavy volume of legitimate holiday returns.

During the Q4 ramp-up, orders in October see a 10% increase in risk, while abuse attempts nearly double in November and December.

Fraudsters prefer holiday-season claims to those during a quieter time of year because already overwhelmed teams often default to accepting claims to maintain service levels.

03. Abuse is predictable (hence preventable)

Riskified data confirms that what was long considered a “cost of doing business” is now a preventable revenue leak. There are clear risk signals merchants can monitor to calibrate prevention tactics and friction. For example:

Claim type matters: INR claims are 25% more likely to be abusive than missing-item claims. Dark-web forums recommend INR specifically because merchants cannot easily verify delivery.

Timing serves as a powerful indicator: Claims filed within seven days of order delivery are 20% more likely to be abusive than average, while claims filed after three weeks are significantly safer. One reason this may be the case is that fraudsters closely monitor their orders. Unlike regular consumers, who make purchases as part of their everyday lives, for many fraudsters, this is their primary focus and livelihood — and they’re eager to turn a quick profit.

High-value orders drive disproportionate losses: While 94% of claims originate from orders under $500, policy abusers seek the maximum possible payout. Orders over $2,000 are 2.5x more likely to result in a claim; orders over $500 are 13-27% more likely to be abusive; and claims exceeding $1,000 are 33% more likely to be abusive.

How merchants can reduce refund fraud and protect margins

Use identity-based detection: Many abusers create multiple accounts and rotate their email addresses, phone numbers, and other identifying information to evade detection. Identity clustering tools, such as Riskified Policy Protect, connect these fragments into a single profile, revealing repeat offenders who would otherwise appear as unrelated shoppers.

Make predictive decisions at checkout: Stopping abuse before it occurs is far less costly than disputing it afterward. Models that flag identities with past abuse patterns at checkout allow merchants to decline, hold, or verify high-risk orders before shipping.

Automate post-checkout claims handling: Automated risk assessment for refund and INR claims enables teams to quickly approve trusted customers while routing suspicious claims to additional validation. This prevents a hectic Q4/Q1 scenario where overflowing queues lead to “approve by default.”  Machine learning systems can quickly detect patterns and operate at the speed and scale required for peak seasons.

Implement adaptive, identity-based policies: Adaptive checkout systems allow merchants to maintain generous, frictionless refund policies for highly trusted customers and apply stricter return windows, documentation, or manual review for high-risk transactions and identities.

Strengthen shipping and return controls, such as:

To effectively reduce refund abuse, merchants can also implement stronger shipping and return controls against riskier customers, including:

• Validated return labels to ensure only authorized returns are processed.
• Proof-of-delivery requirements to confirm that orders have been successfully delivered to the customer.
• Strict and well-communicated return windows to limit the timeframe for refund claims and discourage fraudulent attempts.
• Mandated return-method channels to streamline and monitor the return process, reducing opportunities for abuse.

These measures significantly increase the difficulty of executing INR abuse, protecting merchants from fraudulent refund claims while maintaining a fair and transparent process for legitimate customers.

Elevate your CX and profitability by stopping refund abuse 

Refund policy abuse is a predictable, patterned, and preventable threat that occurs most aggressively when merchants are busiest. 

With nearly a quarter of refund value being abusive, retailers should no longer treat claims as routine operational overhead. By using identity-based detection, predictive decisioning, and automated claims handling, merchants can protect peak-season profitability and deliver better experiences for legitimate customers.

Trinidad Poisson

Former Director of Loss Prevention, Rue Gilt Groupe

Riskified’s Policy Protect has enabled our customer team by being able to make decisions in a split second…You’re able to give your good customers a good experience and give fraudsters a bad experience, and put roadblocks in place to prevent them from wanting to come back.