Roughly 9% of all returns are confirmed fraudulent according to the National Retail Federation, a figure that rises well above 15% once looser abuse and policy-violation cases are counted in, and nearly one in four refund dollars is estimated to be abusive rather than genuine, per Riskified’s return-fraud analysis. Inside that bucket sits a specific, deliberate version: switch fraud. A customer buys a genuine product, keeps it, and sends back a counterfeit or a visibly inferior unit in its place. The return desk processes the refund, logs the “returned” item, and restocks or discards it without ever confirming it’s the same product that went out the door.

This is not the same failure mode as warranty fraud, and treating them as one problem is why both slip through. Warranty fraud plays out months or years after the sale, triggered by a claim, verified against a serial number a service centre pulls up when something allegedly breaks. Return fraud plays out inside the purchase window itself, days or weeks after checkout, triggered by a standard return request that a fulfilment or CX team processes fast because most of them are legitimate. Different clock, different team, different evidence trail, and largely different tooling. A brand that’s built controls for one has done nothing for the other.

Return fraud vs. warranty fraud: two different moments

The swap logic is similar in both cases: a counterfeit or degraded unit enters where a genuine one should be, and the brand eats the difference. What differs is when it happens and what a merchant has to work with when they try to catch it.

Because return fraud is processed at speed and volume, most merchants apply lighter scrutiny to it than to a warranty claim, which already has a serial number and a service ticket attached. That’s exactly the gap switch fraud exploits: it looks like an ordinary return, and ordinary returns are the ones nobody inspects closely. For a related but distinct pattern, swapped units at the warranty stage work the same trick further down the product’s life, once a serial number and a service record are already in play. Warranty fraud and return fraud are related enough to get conflated in internal reporting, but a fix built for one won’t catch the other.

See Certify in action

See how Certify’s unit-level authentication catches a counterfeit swap the moment a return hits intake.

Explore Certify

Which categories are actually exposed

Switch fraud needs two things to work: a product that’s easy to substitute convincingly, and a return process that inspects units quickly rather than closely. A handful of categories hit both conditions.

Electronics and small accessories are a common target because clone hardware that looks identical from the outside, same casing, same printed branding, same box, is cheap and widely available, and a returns clerk checking “is this the right item” rather than “is this the exact unit we sold” won’t catch the swap. Cosmetics are exposed for a related reason: repackaging is trivial, partial use is hard to police, and a counterfeit product in genuine-looking packaging can pass a visual check that stops at the label. Apparel rounds this out, particularly for higher-value branded items, where a counterfeit garment substituted for the genuine one can pass unless someone checks stitching, tags, or authentication marks that most return counters were never set up to check.

The common thread across all three isn’t the product category itself, it’s that return intake in each of them is built for speed and a visual pass, not for confirming the specific unit’s identity against what was originally sold.

Detection signals worth actually watching

Most fraud-detection guidance for returns converges on behavioural signals: return-rate spikes by customer, return-rate spikes by SKU, device fingerprinting, shared-attribute matching across accounts that look like the same abuser operating under different names. These are useful, and they answer a real question: which customers or SKUs deserve a closer look.

What they don’t answer is what actually came back. A customer flagged for an unusually high return rate might still be returning genuine, defective items every time. Behavioural signals tell you who to check. They don’t tell you whether the item in the box in front of you is the one that left the warehouse.

That second question has a more direct answer, and it’s the one most return-fraud guidance treats as a footnote rather than a primary control: does the returned unit’s serial or batch number match the one recorded at the point of sale. If a product carries a unique, verifiable identifier from the moment it ships, a returns team can check that identifier against the original sale record the moment the item comes back. A match confirms it’s the same unit. A mismatch, or an identifier that doesn’t exist in the brand’s issued range at all, is a specific, automatable red flag, not a guess based on how often this customer files returns.

Paired together, the two signals cover each other’s blind spot: behavioural flags narrow down who and what to check, and serial or batch verification confirms what actually came back. Neither one alone closes the loop.

Making unit-level verification part of return intake

The practical fix is to treat serial verification as a standard step in return intake, not an occasional spot-check. When a returned product carries a non-clonable, unit-specific code assigned at the point of sale, checking that code against the original issuance record at return intake is a scan, not an investigation. A match clears the return normally. A mismatch or an unrecognised code flags it before the refund goes out, giving the returns team something concrete to act on instead of a hunch.

This is what Certify’s product authentication is built to support: a unique digital identity assigned to every unit at the point of sale, verifiable via a quick scan rather than a manual inspection. Applied at return intake, the same identity layer that authenticates a product for a consumer also lets a merchant confirm that the unit coming back through the door is the one that went out. It’s the same underlying idea as unit-level verification at the warranty stage, just applied earlier in the product’s life, at the return counter instead of the service centre.

Return fraud and warranty fraud will keep getting treated as one problem for as long as brands rely on process speed and a visual check to catch a swap that’s specifically designed to pass both. The fix isn’t slowing every return down. It’s making sure the one check that actually proves identity, not behaviour, not appearance, happens automatically at the moment it matters.

Sources:

• National Retail Federation, cited via termsandconditionstemplate.com Return Fraud Statistics 2026
• Riskified, “1 in 4 Refund Dollars Is Abusive” analysis
• Chargeflow, Return Fraud Statistics and Trends
• Accertify, Return Fraud and Refund Abuse Detection
• Stripe, Refund Abuse vs. Chargeback Fraud
• Pitney Bowes, Retail Returns Fraud Prevention Guide

Catching counterfeit-swap returns before the refund goes out?

Book a free demo and see how Certify gives your returns team a real identity check, not just a visual pass.

Book a Free Demo

Written by

Mithileshkumar R Naik

Growth Head, Acviss

Mithileshkumar leads growth at Acviss, working every day to make sure the brands losing the most to counterfeits are the ones who find out about a fix first. He’s spent his career believing that good marketing isn’t about noise, it’s about showing up right when someone needs the answer. Off the clock, he’s usually chasing the same instinct in something entirely unrelated to work.