Return Fraud Rings: How One Address Files Forty Returns

Organized return fraud runs through refund-as-a-service groups that file refunds on a customer's behalf for a percentage, using scripts, stolen accounts, and staged damage photos. The NRF's 2025 survey puts fraudulent returns at 9 percent of all returns, and 65 percent of retailers tracking empty-box returns saw them increase.

The scale, in the retailers' own numbers

The National Retail Federation and Happy Returns put projected US retail returns in 2025 at $849.9 billion, 15.8 percent of annual sales, and 19.3 percent of online sales. Retailers estimate 9 percent of returns are fraudulent. The NRF does not publish a dollar figure for fraudulent returns, and applying 9 percent to $849.9 billion would give about $76 billion, which is an illustration, not an NRF figure. Appriss Retail puts it differently: 15 percent of all returns and claims estimated to be fraudulent, costing retailers $103 billion a year. However you count it, the number is large enough that 37 percent of retailers lost more than $1 million to return fraud in 2023, and 10 percent lost more than $5 million.

The tactics are getting more organized, not just more common. The NRF survey found 71 percent of retailers tracking it saw an increase in overstated-quantity returns, 65 percent saw more empty-box or box-of-rocks returns, and 64 percent saw more decoy returns, counterfeit items sent back in place of the real thing. Those are shares of retailers reporting an increase, not fraud rates, but the direction is the same across every tactic.

Refunds as a service

The organized version of this problem is not a customer. It is a business. In a case from the US Attorney's Office for the Western District of Washington, an operator of a Telegram service called Simple Refunds pleaded guilty to wire and mail fraud, received a three-year prison sentence, and was ordered to pay $4,353,819, with more than $4 million in retailer losses reported. Simple Refunds was one of several cases in Operation Chargeback, an FBI investigation into organized refund fraud groups in the US and abroad.

The Artemis Refund Group case is the same shape at larger scale: ten men indicted in November 2023, charging customers 15 to 20 percent of the refunded item's price, targeting Amazon, Walmart, Target, and Wayfair. Amazon sued REKK, a network selling fraudulent refunds on Telegram, whose main channel had more than 35,000 subscribers and charged a 30 percent fee. The model is consistent: the group requests the refund on the customer's behalf for a percentage, with scripts, accounts, and staged evidence. The customer keeps the item and the money. The group takes its cut.

How the rings actually work

The playbook has three parts, and each one exploits a different generosity in the returns process. First, the policy: money returned before the product is received. Forter stopped an $800,000 ring that abused exactly that policy, instant refunds on a claim, no inspection first. Second, the evidence: Forter reports that 80 percent of fake return claims are now backed by AI-made evidence, and fabricated damage is the fastest-growing form of return abuse. A photo of a damaged item that never existed is cheaper than damaging a real one. Third, the identity: rings use multiple accounts, multiple addresses, and sometimes a warehouse employee paid to mark items as returned without them ever coming back. In one Amazon scheme, fraudsters paid a warehouse employee $3,500 to falsely mark items as returned in Amazon's system.

The returns that feed organized retail crime follow the same pattern. ReturnPro's 2024 survey found 57 percent of retailers report the return of stolen goods as the most prevalent form of return fraud, closely linked to organized retail crime, and 42 percent contend with returns of items fraudulently obtained. Wardrobing, buying items to use them temporarily with intent to return, affects 50 percent of retailers. The line between a customer testing a policy and a ring running a business is volume, repetition, and coordination, and the data to see it is in the retailer's own return records.

What actually stops a ring

The defense is not a stricter return policy. It is pattern recognition. A ring shows up as the same address filing forty returns, the same device behind a dozen accounts, the same damage photo on different claims, or a return velocity no real customer matches. The Merchant Risk Council's 2026 report found refund and policy abuse was the top attack type, experienced by 41 percent of fraud professionals surveyed, which means the detection problem is now the mainstream fraud problem, not an edge case. The retailers that catch rings are the ones that link returns to identities, devices, and addresses instead of treating each return as a separate transaction. A single fraudulent return is a cost. Forty from one address is a ring, and it is the ring that pays for the detection.

Related reading

Readers working through “Return Fraud Rings: How One Address Files Forty Returns” often find these earlier guides useful as well: Damaged or Defective Returns: The Policy That Keeps the Customer, Return Processing: The Twenty Dollars That Never Shows on the Receipt, and Final Sale Means Nothing If Shoppers Learn It at the Return Portal.

Frequently asked questions

How common is return fraud?

The NRF's 2025 survey of large US retailers puts fraudulent returns at 9 percent of all returns. Appriss Retail estimates 15 percent of returns and claims are fraudulent, costing retailers about $103 billion a year. Either way, most retailers lose real money to it.

What is a refund-as-a-service group?

An organized group, usually operating on Telegram, that files fraudulent refunds on a customer's behalf for a percentage, typically 15 to 30 percent of the refund. They provide scripts, accounts, and staged evidence. Several have been prosecuted, including Simple Refunds and the Artemis Refund Group.

What is the most common type of return fraud?

ReturnPro's 2024 survey found the return of stolen goods is the most prevalent form, reported by 57 percent of retailers. Empty-box returns, decoy returns with counterfeit items, and wardrobing are all rising, with 65 percent of retailers tracking empty-box returns seeing an increase.

How can a retailer spot an organized return fraud ring?

Look for patterns, not single returns: the same address or device behind many accounts, the same damage photo on different claims, return velocity no real customer matches, or refunds claimed before the product is received. Link returns to identities, devices, and addresses instead of treating each one separately.