E-commerce refund fraud
Refund the customer. Not the scheme.
Refund-as-a-service rings sell fake refunds: "never arrived" on delivered orders, returns shipped with another order's label, money sent to a gift card that never paid. Omnareth checks every refund against the order before money moves, and recognizes the gift card or device collecting across orders.
| # | Event | Decision |
|---|---|---|
| 1 | Genuine return, scanned in, refund to the card that paid | ALLOW |
| 2 | "Never arrived" on a delivered order, refund to a gift card | DENY INR_DELIVERED · DESTINATION_MISMATCH |
| 3 | A 'return' using another order's label, same gift card ▲ Repeat offenders opened; device and gift card watched |
DENY TRACKING_MISMATCH · DESTINATION_MISMATCH · LABEL_REUSE |
| 4 | Refund on a third order to the same gift card ▲ One gift card across three orders: case opened |
DENY DESTINATION_MISMATCH · WATCHLIST_MATCH · REPEAT_OFFENDER · DESTINATION_HOPPING |
| 5 | Refund larger than the order | DENY REFUND_EXCEEDS_ORDER |
| 6 | Genuine return still in transit | FLAG RETURN_NOT_RECEIVED |
| – | Analyst confirms the gift card case ▲ Gift card blocked everywhere |
analyst · state |
| – | A support agent records the gift card as the order's payment method | analyst · state |
| 7 | The ring asks again for that order | DENY WATCHLIST_BLOCK · REPEAT_OFFENDER · DESTINATION_HOPPING |
| 8 | Genuine refund once the return is scanned in | ALLOW |
How it fits
A check before money moves
Refund abuse looks like customer service: one request at a time, each plausible. The scheme only shows across orders. Your system sends each request to Omnareth and acts only on what it allows.
The order
Who placed it, how it was paid, whether the carrier confirmed delivery, which return label was issued and whether the return arrived.
Refund requests
A refund must come from the customer who ordered, go back to the payment method that paid, use the order's own label, and not exceed the order.
One gift card, many orders
Omnareth holds the ring's device and destination responsible, and recognizes the gift card collecting refunds across orders.
Reference rules
11 rules, ready to adapt
Authorization checks fail closed, and every rule names who it holds responsible when it fires.
| Threat | What Omnareth checks | Rule code | Decision |
|---|---|---|---|
| Refund Before Return Received | Flag refunds for returns that have not reached the warehouse yet. | RETURN_NOT_RECEIVED | FLAG |
| Refund to Another Destination | Refunds go back to the payment method that paid. | DESTINATION_MISMATCH | DENY |
| Refund Exceeds Order | A refund may not exceed what is still refundable on the order. | REFUND_EXCEEDS_ORDER | DENY |
| Not Received, but Delivered | An item-not-received claim on an order the carrier confirmed delivered needs investigation. | INR_DELIVERED | DENY |
| Not the Order Owner | Only the customer who placed the order may request its refund. | NOT_ORDER_OWNER | DENY |
| Return Tracking Mismatch | A return must use the label issued for this order. | TRACKING_MISMATCH | DENY |
| Destination Across Orders | Flag a refund destination or device implicated in denied refunds on two or more other orders in the last 24 hours. | DESTINATION_HOPPING | FLAG |
| Return Label Reuse | A return tracking number belongs to one order; seen on another, the return is likely fake. | LABEL_REUSE | FLAG |
| Repeat Offender | Flag events involving an identity implicated in two or more denied events in the last 30 days. | REPEAT_OFFENDER | FLAG |
| Blocked Identity | Identities blocked on the fraud watchlist may not take part in any order event. | WATCHLIST_BLOCK | DENY |
| Watched Identity | Identities under watch may proceed only with a flag for review. | WATCHLIST_MATCH | FLAG |
The insider case
Made the payment method. Still not refunded.
After the analyst confirms the case, a support agent records the ring's gift card as the order's payment method. The next refund passes every order check. Omnareth refuses it on the watchlist, and the audit record shows the block it acted on.
Victims are not suspects
Only the identities a rule implicates are held responsible. Genuine customers named in a fraud attempt are never counted against.
Policy as rules
Your checks run on every request, with the reason and a remediation step recorded.
For auditors and regulators
Every refused request is sealed with what was known at the time, and verifiable later.
Adapt the model
The Order model, its rules and its fraud identifiers are plain JSON you can change.
Pilot program
Put e-commerce refunds fraud prevention to work in 90 days
One lane, facility or process, in shadow mode, with results measured against criteria we agree with you. Qualified companies and organizations can apply.