Guide
·
What to lock down before Black Friday: the policy settings to review, when each threat peaks, a support playbook your team can use as is, and the 10 post-purchase schemes to watch.
Chirag Vaya
Co-Founder and CPO
Send it to your work inbox to read later or share with your team.
Why fraud rises in peak season
Peak season is when post-purchase fraud is easiest to hide. Order and ticket volumes spike, ops and support teams are stretched, and fraudsters time their claims and returns to slip past policies while reviews are rushed. They also push for refunds fast, so the risk window opens in mid-November and runs through the January returns wave.
This guide covers what to do before Black Friday, the policy settings to review, when each threat peaks, a playbook your support team can use as is, and a quick reference for the 10 most common schemes.
Top actions before BFCM
Five things to finish before Black Friday (Nov 27):
Share the Support team playbook section with your agents.
Set your peak policies using the checklist below.
Validate your fraud providers: check whether your current tools cover returns, DNR claims and fake sites, or only checkout.
Search for fake versions of your store and evaluate a domain takedown service, such as Pinch’s, before ad spend peaks.
Name one owner for escalated claims during peak.
Policy levers checklist
Tighten controls for risky customers only; blanket policy changes push the cost onto good customers. Your team can set each of these today.
Area | Lever |
|---|---|
Returns | Refund on warehouse receipt, not carrier scan, for high-value returns and repeat returners |
Returns | Keep inspection on for high-value SKUs during peak; reserve instant refunds for customers with a clean history |
Claims | Hold high-value DNR claims for a carrier investigation before refund or reship |
Claims | Enforce your DNR / missing-item claim window |
Claims | Cap DNR / missing-item claims per customer before mandatory review |
Store policy | Publish your holiday return dates now |
Store policy | Confirm refund eligibility, return shipping, window and fees are stated on your site |
Where intelligence helps: these rules only see one order at a time. Repeat abusers spread activity across emails, addresses and accounts, and often across stores. Pinch links those identities across its merchant network, so you can apply the same rules to the person behind the claim as well as the order.
Peak threat calendar
Risk rises from mid-November and stays elevated through the January returns wave; claims fraud peaks first, returns fraud second.
Support team playbook
Share this section with your support team as is. Abusive claims usually arrive as tickets written to get a fast approval; use this page to spot them, reply safely, and escalate.
Escalation contact: [add your team’s contact or channel]
If a ticket matches any trigger, hold the refund and escalate. Everything else follows your normal process. Not sure which customers are high risk? Pinch can score your past claims and returns to show you.
Red flags in DNR / INR tickets
Loyalty or guilt framing: “I’ve been such a good customer”
Threats on first contact: chargeback, bad review, social post
Tracking shows delivered, but the customer insists nothing arrived
Same wording across different customers (scripted or AI-drafted)
Red flags in FTID / empty-box tickets
Pushes for a refund before the return reaches the warehouse: “it’s in transit”
Return tracking reused, tied to another shipment, or weight far below the item
Return label scanned at a different ZIP than the customer’s address
Never on first contact
Promise a refund or reship before the claim is reviewed
Refund on carrier scan alone for high-risk or high-value claims
Say why a claim is under review or which signals you check
What to say
DNR, first contact
“Thanks for letting us know. We’ve opened a delivery investigation with the carrier, which usually takes [X] business days. Please check with neighbors and your building’s mailroom in the meantime, and we’ll update you as soon as we hear back.”
Refund requested before the return is received
“Your refund is issued as soon as the return is received and checked at our warehouse, typically within [X] business days of delivery to us.”
Flagged claim, needs more detail
“To complete our review, please confirm the delivery address and send a photo of the package and its contents as received.”
The 10 threats at a glance
One line on each scheme, the red flag to watch for and the first thing to do. Each name links to its full glossary entry, with how it works, every warning sign and a longer what-to-do list.
Returns
FTID (fake tracking ID)
A refund is issued on a return label scan, but the package is empty, never sent or redirected.
Watch for: a label scanned at a ZIP far from the customer; tracking reused; a refund pushed while the return is “in transit”.
Do: refund high-risk returns on warehouse receipt; log weight at drop-off and receipt.
Empty box / partial empty
The return arrives empty, or with some items missing.
Watch for: a high-value item missing from a mixed return; repeat partial returns from one customer.
Do: record inspection results by item, not by return; photograph contents at receipt.
Item swap
A cheaper, older or counterfeit item is returned in place of the one bought.
Watch for: high-resale SKUs; customers linked to resale marketplace activity.
Do: check SKU, serial and tamper tags on high-value returns before restock.
Wardrobing
Bought to use once, returned as unworn.
Watch for: full-price purchases returned near the window end; a repeat pattern in one category.
Do: use tamper tags on high-risk categories; route repeat returners to store credit or exchange.
Serial returners
Return rates far above the norm, often across several accounts.
Watch for: multiple accounts at one address; heavy bracketing.
Do: set a return-rate threshold for review; apply limits to the person, not the email.
Claims
DNR / INR (did not receive)
A delivered package is claimed as never arrived.
Watch for: repeat DNR history; a delivery photo or GPS scan at the address; a claim right after the delivery scan.
Do: run a carrier investigation before refunding high-risk claims; require a signature above your value threshold.
Missing items
Part of a multi-item order is claimed as missing.
Watch for: the claim targets the highest-value item; shipment weight matches a full order.
Do: compare against packed weight; capture pack-out photos for high-value orders.
Damage claims (AI-generated photos)
An item is claimed as damaged, sometimes with edited or AI-generated photos.
Watch for: damage that doesn’t match the material; inconsistent lighting; the same photo across claims.
Do: require the item back for high-value claims; ask for a second photo from a different angle.
Brand protection
Fake storefronts
Cloned sites take payments in your name; customers get nothing or a counterfeit.
Watch for: heavy discounts; a domain registered in the last few weeks; a site live only while ads run.
Do: keep your letter of authorization and trademark certificates ready; route “I never got my order” tickets with no matching order to whoever handles takedowns.
Marketplace listings
Counterfeit or fake listings of your products on resale marketplaces.
Watch for: new-in-box listings of items recently returned to you empty or swapped.
Do: report listings through the marketplace’s IP or brand protection program.
How Pinch can help
Pinch covers post-purchase fraud end to end, from the return or claim to the fake site selling your products.
Area | What Pinch does |
|---|---|
Returns | Scores each return before refund using identity, order and return history; links multiple accounts to one person so limits follow the customer. |
Claims | Scores DNR, missing-item and damage claims on identity and claim history. Carrier claims recovery is coming soon. |
Brand protection | Scans for fake storefronts every 2–6 hours and files takedowns with registrars, hosts and browser blocklists within 12 hours of detection. |
Shared intelligence | Uses signals across Pinch’s merchant network, so a repeat abuser at one store is visible at the next. |
To see what peak cost you last year, get a free lookback (for qualified brands), check for fake storefronts for free, or talk to us.
We’ll send a link to your work inbox.
WRITTEN BY
Chirag Vaya
Co-Founder and CPO
I’m the co-founder and CPO. I own product and technology, which means turning the abuse patterns merchants describe into things our platform catches on its own. Before Pinch, I led product for PayPal’s Risk as a Service, after building fraud prevention at Simility. Outside work, I pull unnecessarily precise espresso shots, then try to burn off the caffeine with running and CrossFit. So far the caffeine is winning.
More guides & research
Infographic
·
Return Abuse Trends - 2025
Download the infographic highlighting key 2025 return-abuse trends from Pinch AI’s retail data, showing the widening gap between fraud and loyalty in e-commerce returns.
Video
·
Inside Return Abuse: How Shoppers are Gaming the System
Return abuse is costing retailers billions, yet most shoppers have no idea it’s happening. In this video, we dive into the growing crisis of return fraud and abuse, breaking down just how massive the problem really is, and the various methods bad actors use to exploit return policies.
Guide
·
Guide: Understanding E-commerce Return Abuse
This comprehensive guide provides an in-depth look at the various types of return abuse in e-commerce, their impact on businesses, and effective strategies for prevention. Learn how to identify and address fraudulent return activities to protect your bottom line and maintain customer satisfaction.
Free lookback · for qualified brands
See what you lost last year. Free.
01
Share 12 months of data.
Install the Shopify app or SFCC cartridge, or send order, return and claim exports.
02
Get your lookback in under two weeks.
What you lost to return and claims abuse, and who took it.
03
Qualified brands try Pinch free for three months.
Run it on live orders, then decide.