Payment And Returns Fraud: Signals, Controls, Costs

Every anti fraud control you deploy will block some honest customers. That is not a bug in the implementation, it is the nature of the trade. The question is never whether a control produces false positives. It is whether the fraud it stops is worth more than the good customers it turns away, and whether you are even measuring the second number.

Most brands are not. They measure fraud caught, celebrate it, and never look at the cancelled orders from customers who did nothing wrong and will not come back. Here are the five patterns that actually cost Indian D2C brands money, the signal that detects each one, the control that works, and the price of getting the control wrong.

Friendly fraud and item not received abuse

A real customer, on a real card, receives a real parcel, then tells their bank the item never arrived. Sometimes it is deliberate. Often it is a customer who could not find your support desk, waited four days for a reply, and took the faster route. The industry calls it friendly fraud, which flatters it.

The signal. A dispute raised on an order with a clean delivery scan, no prior support contact, and a delivery address that matches billing and prior order history. If they never emailed you before going to the bank, that is the tell.

The control. Two layers. First, make yourself impossible to avoid: visible support contact on the order confirmation, on the tracking page and in the delivery notification, with a genuine same day response. A customer who can reach you rarely reaches their bank. Second, capture delivery evidence properly. Delivery photographs and OTP confirmation, retained for longer than the dispute window, turn this from an argument into a document.

The false positive cost. Low, because these controls do not block anyone. This is the rare case where the fix is pure upside, which is why it should be first.

Wardrobing and serial returners

The customer orders, uses the product once, and returns it as unworn. In apparel and footwear it is endemic. In electronics it looks like buying, extracting the value, and returning the box.

The signal. Return rate at the customer level, not the SKU level. Look for customers whose lifetime return rate sits far above your category norm across multiple orders, particularly with a pattern of ordering multiple sizes or colours and keeping none. Cross reference on phone number and delivery address, not just account ID, because serial returners open new accounts.

The control. Graduated, not binary. Start with quality control at the returns dock, with photographs at inbound so a used item can be evidenced. Then tighten by tier: for flagged customers, prepaid only, no free reverse pickup, or manual review before dispatch. Reserve outright blocking for extreme, documented cases.

The false positive cost. High and easily underestimated. Apparel has a legitimately high return rate. Your best customer by revenue is very often also a high returner, because she buys three sizes and keeps one, and she is profitable anyway. Always check lifetime contribution before you restrict someone. Restricting a profitable high returner is a self inflicted wound.

COD refusal cycling

Specific to the Indian market and expensive. Orders are placed on cash on delivery and refused at the door, repeatedly, from the same phone number, address cluster or pincode. You pay forward freight, reverse freight and handling on every one, and the stock comes back aged.

The signal. RTO rate segmented by phone number, address, pincode and, importantly, by order behaviour. Repeat refusals from one identity are obvious. The subtler signal is a first time COD order with mismatched address quality, an unreachable phone number at the verification step, or a pincode with a historically severe RTO rate for your category.

The control. Layer it. Address quality validation at checkout. Phone verification through OTP before a COD order is confirmed. Automated confirmation on WhatsApp with a one tap confirm, which is the highest return control most Indian brands can deploy for the effort. Then a rules engine that forces prepaid for identities with prior refusals, and offers a small prepaid discount that makes the safer path also the cheaper one for the customer.

The false positive cost. Substantial, because COD is still how a large share of India shops, particularly outside the metros and in first purchases from an unfamiliar brand. Switch a whole pincode to prepaid only and you will not see the orders you lost, you will only see the RTO rate improve. Measure gross orders and revenue by pincode before and after, or you will congratulate yourself on shrinking the business.

Promo and coupon stacking abuse

Codes intended for first time buyers used repeatedly through new accounts. Codes meant for one channel leaking to coupon aggregator sites. Multiple offers combining in ways the promotion was never modelled for, producing orders below cost.

The signal. Redemption rate far above forecast, a single code appearing across many accounts sharing a device fingerprint or address, discount percentage per order breaching your floor, and traffic arriving from coupon aggregator domains you never partnered with.

The control. Design the promotion properly instead of policing it afterwards. Unique single use codes rather than public generic ones. A hard stacking rule in the cart. A discount floor that rejects any combination breaching contribution margin. Bind first purchase offers to a verified phone number, not an email address, because emails are free and phone numbers are not.

The false positive cost. Moderate and mostly reputational. A legitimate customer whose valid code is rejected at checkout abandons the cart and tells people. Fail open with a clear message and a support route rather than a blunt error.

Reseller and bulk buying abuse

A buyer clears your promotional stock and resells it, often on a marketplace, undercutting your own listings and destroying the price architecture you spent a year building. It is not fraud in the criminal sense, but it damages the brand and distorts your demand signal.

The signal. Order quantity outliers on discounted SKUs, repeat purchases of the same SKU in volume, GST numbers or business addresses on consumer orders, and your product appearing on marketplaces you do not sell on at a price below your own.

The control. Quantity caps per SKU per customer during promotions, which is a promotion design decision rather than a fraud one. Batch code traceability so you can identify which channel a diverted unit came from. Marketplace monitoring and enforcement through brand registry tools where you hold the rights.

The false positive cost. Real, because genuine bulk buyers exist: corporate gifting, small retailers, families stocking up during festive periods. Blocking them costs revenue and insults good customers. Better to route large orders to a B2B flow with its own pricing than to reject them.

Build the stack in the right order

Sequence matters. Start with controls that have no false positive cost at all: better delivery evidence, visible support, OTP confirmation on COD, promotion design that cannot be stacked. These are free wins and most brands have not finished them.

Only then move to controls that block. When you do, set an explicit tolerance. Decide in advance what false positive rate you will accept, instrument it, and review it monthly alongside fraud caught. Every rule you add should have a named owner, a review date and a measured impact on both sides of the ledger.

And keep one number visible to the whole team: orders declined or restricted by control, per week. If nobody is watching that number, your fraud programme is only being graded on half its results.