What Are Refunding Services?

What Are Refunding Services?

Refunding services offer a complete solution for individuals seeking fraudulent refunds. Typically, customers submit requests via Google Forms, providing details like login information for the brand they wish to defraud. The service then handles everything — from generating manipulated return labels to social engineering customer service reps. Once the refund has been granted, the service charges a fee, typically between 10% and 20% of the refund amount.

Signs Your Brand is Being Targeted by a Refunding Service

Refunding services conduct 90% of their fraud through FTID Fraud, due to it’s ability to fly under the radar of retailers and minimize the amount of work for the fraudster. Here are some signs your brand is being targeted by FTID.

1. Empty Bubble Mailers with Edited Labels

A clear sign of FTID fraud is receiving empty bubble mailers with altered return labels—failed attempts where the carrier corrected the label and delivered it to the proper address. However, this is rare, and the absence of this indicator doesn't mean FTID fraud isn't occurring. For example, one client reported over $800,000 in FTID losses last year, with only three cases of empty mailers.

2. Surge in High-Value Orders that are Subsequently Returned

A sudden increase in high-value orders, followed by return requests, is a strong indicator of potential FTID fraud. To avoid detection, fraudsters often divide returns into multiple smaller shipments. If a customer returns all items from an order in separate shipments, this pattern should be closely monitored.

3. Repeated Orders from New Emails and Jigged Addresses

A common tactic in FTID fraud involves creating new emails and slightly altering shipping addresses, known as "jigging," to bypass fraud detection systems. If you notice a pattern of orders and returns from the same individual using variations of their email or address, it strongly suggests FTID fraud. This is particularly challenging to combat, as each new email and jigged address can evade the filters set by your operations team.