If you had a successful ride on the roller coaster that is the holiday shopping season, your refund policy could soon be coming back to haunt you in the form of empty box scams. Across the board, policy abuse including promo abuse and item-not-received (INR) is on the rise, and merchants have come to expect more of these grey-area cybercrimes during and post-holidays. According to a Riskified survey, almost 40% of merchants see policy abuse as the most challenging fraud MO they face. 

Specifically, empty box returns are slowly making their way to the top of the policy abuse list. Contrary to the name, empty box scams are characterized by boxes that are not necessarily empty. Abusers have returned a wide variety of surprising objects including old crumpled newspapers, a variety of produce, and the classics: used or completely different products. 

A 31-year-old man was recently charged with defrauding Amazon of almost $300,000 – for making 300 fraudulent returns over four years. During that time, he systematically ordered expensive items only to claim they arrived damaged, “returning them” for a refund. Of course, the boxes he returned never contained the original items, but rather similar, cheaper merchandise. 

Amazon’s lenient return policy can sometimes let abusers get through unnoticed, and this is exacerbated by the fact that the Fulfillment by Amazon (FBA) model promises to take care of product storage, logistics, and returns for external merchants on its marketplace. This puts Amazon in the position of having to take responsibility for plenty of empty-box returns. As a dominant market leader, Amazon typically influences other merchants to adapt their own policies, creating more online competition and forcing merchants to adopt potentially risky policies. 

Empty box returns are challenging to intercept and respond to because they take place after the transaction was completed, and therefore are not identified by most fraud detection tools. Instead of being carried out by fraudsters using stolen credentials, empty box returns are committed by people who appear to be regular, sometimes even loyal, account-holding customers.

Senders often get refunded immediately after issuing a return online (this is how Amazon does it), and by the time the box is received, opened, and registered into the store’s systems, the damage is done. And although merchants can go back and correctly register the scam, they can easily find themselves under heaps of storage, logistics, and return fees.

Throughout and mostly after the holidays, merchants inevitably see an uptick in returns due to the overall increase in shopping. During the 2020 holiday season, about 30% of all purchases were returned. The 2021 holidays are expected to cost merchants even more, with about a 59% increase from last year.  

But there’s also an entire industry of fraudsters who specialize in return fraud, fake tracking IDs (FITDs), and empty boxing methods and services. At this point, they’ve become so prevalent and commonplace that some fraudsters have even started to complain about the lengthy processing times of their fraudulent returns. 

Screen Shot 2021 12 27 at 14.37.35

Telegram was buzzing with fraudsters this holiday season, sharing tips and tricks on how to take advantage of store policies, as well as hopes that merchants would stay lenient with their return policies. 

The nightmare before, during, and after Christmas 

Empty box returns cause merchants plenty of grief, especially during the busiest time of year. Here are a few ways empty box returns could be hindering the success of your business. 

They eat at your revenue

Empty box scams are causing you to bleed out money. In addition to the lost sales and cost of the goods, merchants are responsible for additional shipping expenses, as well as internal processing costs. When it comes to limited or otherwise coveted goods, the loss is even more painful, because your loyal customers cannot enjoy them. 

Your operations and customer success teams can quickly become overwhelmed

An influx of these empty box returns requires your employees to track and sort unexpected (and unwanted) returns, adding noise to an already complex replenishment process. Not only that, but the labor that goes into the reverse supply chain – to try to retrieve the purchased and “returned” product from a customer – could have been put to much better use.

They create a vicious cycle of fraud

When you approve a fraudulent refund, you send out a clear “open for business” signal to professional fraudsters and deviant customers alike. By doing so, you can expect your refund abuse problem to multiply. As professional empty box returners are becoming more and more sophisticated, the risk is evolving. When you successfully block this unwanted behavior from the get-go, you give fraudsters the signal to move on to a new, easier target.

Protect yourself this year

In order to fight policy abuse, merchants must be able to connect all of these seemingly unrelated abusive identities to the customer behind them. By implementing a data-based solution, merchants will be able to make informed decisions and set the optimal threshold needed to protect themselves from policy abuse.

Riskified’s sophisticated identity-based clustering technology enables us to analyze multiple data points and recognize any and all accounts committing policy abuse as belonging to one specific entity. Our machine learning decision engine relies on shoppers’ data enrichment tools, an unmatched global merchant network that provides billions of cross-industry transactions data, graph technology,  and more. Learn more about Policy Protect here.