How paid refund services work, and the signs a claim came from one

Some of the "never arrived" and "empty box" claims you get were written by someone the customer paid.

These are refund services, usually called "refunders." A customer places a normal order, receives it, and then hires a service to get the money back while keeping the item. The service handles the claim: it contacts your support team, tells a practiced story, and pushes until the refund goes through. The customer pays the service a cut.

What they charge and where they advertise

A 2025 study by researchers at the Universities of Portsmouth, Queensland University of Technology, Bristol and Surrey, Return to sender: Mapping the online economy of refund fraud, looked at these vendors in detail. They advertise on cybercrime forums and mostly do business on Telegram, with some on Discord. Typical fees were 13% to 30% of the refunded amount. Many vendors set order limits in the thousands, and some advertised limits as high as £15,000 for a single order.

They post screenshots of successful refunds as proof, and they collect reviews from past clients. One vendor's terms even threatened clients who didn't pay the fee on time.

Amazon has sued a Telegram-based group it says used fake police reports about missing packages to get refunds on more than $4 million in graphics cards, laptops and drones (reported in April 2026). That group charged its clients 15% to 30%.

What they file

The forums have their own names for each method. The ones that matter most to an online store:

• DNA ("did not arrive"), also called LIT ("lost in transit"): the package was delivered, but the claim says it never came or was stolen.
• EB and PEB ("empty box" and "partially empty box"): the claim says the box arrived empty or with items missing.
• FTID ("fake tracking ID"): a return that tracking shows as delivered to your warehouse but never really arrives. There's more on this in FTID return fraud.
• Damaged or faulty item claims, and returns of a different, cheaper item.

Vendors also coach their clients on which payment methods and accounts to use and what to say to support agents. The researchers redacted those specifics from the report, which is fair enough.

What it looks like from your side

You won't see the Telegram chat. What you see is the claim, and refunder claims share some habits. None of these proves anything alone. Several together are worth a closer look.

The story is unusually polished. Real customers who lost a package tend to be vague, a bit annoyed, and missing details. A refunder's message often reads like it was written to a checklist: it names the right policy, uses the right terms, and preempts your questions.

The claim arrives fast and escalates fast. There's little interest in checking with neighbors or waiting a day, and a quick turn to "I'll dispute this with my bank."

The wording repeats. The same phrasing, or the same structure, shows up on claims from customers who have nothing to do with each other.

The orders are worth stealing. High-value, easy to resell, often one or two items near the top of what your policy allows.

Addresses repeat. Different names and emails, but the same shipping address, building, or forwarding service across several claims.

A police report shows up before you asked for one, or its number doesn't check out with the department. Some services file reports or reuse old case numbers to make a claim look solid. Keep asking for reports, and confirm each one with the department that issued it. Ask for a police report on stolen-package claims, and check that it's real explains how.

What actually helps

These services do best against stores that decide refunds case by case, in a support inbox, with nobody looking across claims. So the most useful thing you can do is keep claims in one place and look for repeats: addresses, emails, phone numbers, wording.

After that, make your checks consistent. If high-value claims always get the same review, with carrier evidence first, then a written statement and a police report from the customer when it's unclear, a coached story has less room to work. A refunder is paid when the refund goes through. A process that takes a week, asks for specifics, and checks the police report with the department makes your store a worse target than the next one.