Chargebacks and refunds have traditionally been treated as separate fraud and operational issues, but repeated payment reversals can reveal patterns that extend beyond individual merchant losses and potentially point to wider financial crime.
ZIGRAM, a RegTech provider focused on anti-money laundering (AML) and financial crime risk, is warning that institutions could be missing these signals by keeping fraud and AML monitoring in separate silos. The company is calling for a unified FRAML approach that brings payment fraud, transaction monitoring and wider financial crime analysis together.
A single disputed payment or refund may not raise significant concerns. The picture changes when a customer repeatedly makes purchases, requests refunds through different channels, disputes transactions with their bank and moves the resulting funds between accounts, cards or wallets.
Chargeback fraud generally involves a customer disputing a legitimate card transaction in an attempt to recover money or goods they are not entitled to. Refund fraud takes place through a merchant’s own returns and refund processes.
The methods can vary considerably. Fraudsters may claim that an order never arrived, return an empty package, submit counterfeit receipts, return a different item or obtain a refund while keeping the original goods.
Friendly fraud creates another challenge. This involves customers disputing legitimate transactions, whether deliberately or because they do not recognise a payment, forget a subscription renewal or dispute a purchase they actually made.
The issue is already significant for merchants. Return fraud cost retailers more than $101bn in 2023, while around 14% of returns were estimated to be fraudulent. Businesses also lose an average of $13.70 for every $100 of merchandise returned.
However, the financial impact is not limited to retailers. Refunds and chargebacks create financial transactions that can generate useful signals for fraud and AML monitoring systems.
Fraud teams may focus on whether an individual transaction, refund or dispute appears suspicious, while AML investigators are more concerned with broader patterns of money movement, customer behaviour and links between accounts and entities.
When those datasets remain separate, activity spread across multiple merchants, payment instruments or customer profiles can be difficult to connect. A series of apparently unrelated refunds, for example, could become more significant if the funds are consistently directed into the same account or prepaid card.
ZIGRAM argues that this is where FRAML can play a role, allowing institutions to connect fraud and AML data so patterns that may not be visible to either function individually can be identified.
Potential warning signs include high-frequency refunds from different merchants flowing into the same account, refunds being directed to a payment instrument other than the one used for the original purchase, and customers suddenly making high-value purchases that are quickly reversed.
Cross-border activity can add another layer of complexity, particularly when refunds are directed towards foreign cards, wallets or accounts in higher-risk jurisdictions.
The movement of refunded money can also provide an important signal. Rapid transfers to cryptocurrency exchanges, third-party accounts or international destinations may indicate that the refund is being used as part of a wider movement of funds.
The company also points to organised refund-as-a-service operations operating through platforms such as Telegram and Discord. These groups can coordinate large numbers of “did not arrive” or similar claims across multiple accounts, with shared devices, addresses and other identifiers potentially linking seemingly unrelated customers.
Not every case of refund abuse amounts to money laundering. The distinction comes from the wider pattern and what happens to the money afterwards.
Fraudulent purchases can provide a means of placing illicit value into the financial system. Refunds, chargebacks and transfers can then be used to move that value between accounts, cards or wallets, before the proceeds are potentially converted into other assets, resold or transferred elsewhere.
The source analysis highlights a US case involving more than $111m in transactions where sham companies and manipulated chargeback ratios were used to keep acquiring accounts active while fraudulent activity continued.
For financial institutions, refund and chargeback data can therefore become more valuable when assessed alongside other customer and transaction information.
ZIGRAM recommends looking beyond individual events and identifying clusters of activity. Potential warning signs include large numbers of refunds from different merchants reaching the same account, multiple customer profiles sharing devices or delivery locations, refunds being directed to different payment instruments, and rapid movement of refunded funds to crypto exchanges or external accounts.
Other indicators include customers with historically low spending suddenly making high-value purchases followed by refunds, repeated disputes involving the same merchants or product categories, multiple cards or customer identities directing funds towards the same beneficiary, and account takeover signals followed by large purchases and refund requests.
These signals can become more useful when combined with broader customer risk information, including previous fraud activity, sanctions exposure, politically exposed person status and adverse media.
A unified approach begins with consolidating information from transactions, refunds, chargebacks, customer accounts and behavioural activity. Institutions can then establish baselines for normal behaviour across different customer groups, merchants, geographies and product categories.
Velocity analysis can identify unusual increases in refunds or disputes, while entity resolution can connect customers, devices, cards, bank accounts and merchants that might otherwise appear unrelated.
Institutions can then combine rules and machine learning models to identify potentially suspicious behaviour. Alerts can initially be handled by fraud teams before being escalated to AML investigators when wider financial crime indicators emerge.
Investigation outcomes can also feed back into detection models and rules, allowing institutions to refine their approach as new fraud techniques emerge.
Traditional AML monitoring was largely designed around suspicious money movements, transaction structuring and other established financial crime patterns. Refund and chargeback activity has not always been incorporated into those systems.
ZIGRAM’s technology includes Transact Comply, which incorporates chargeback and refund activity into transaction monitoring. Entity Hero provides network analysis across customers, merchants and payment instruments, while Dragnet Alpha adds adverse media intelligence to investigations.
PreScreening.io and DueDiliger support screening and due diligence before high-risk merchants and counterparties are onboarded. The broader objective is to give fraud and compliance teams a shared view of activity rather than treating each payment event as an isolated case.
The responsibility does not sit solely with banks and FinTechs. Merchants can strengthen return policies, introduce additional checks for high-value refunds and maintain detailed delivery records. Address and CVV verification can also provide additional controls around card transactions.
Refund activity should be monitored at merchant level, including refunds initiated by employees. Businesses can also look for customers repeatedly exploiting the same return processes or patterns involving multiple accounts.
Closer data sharing between merchants, payment service providers and financial institutions can further strengthen detection by allowing signals from different parts of the payment chain to be connected.
The growing overlap between refund abuse, payment fraud and money laundering is putting pressure on institutions to rethink how financial crime data is managed. For fraud teams, a refund may represent a loss of merchandise or revenue, while for AML teams, a series of refunds connected to unusual money movements could represent something much broader.
As digital payments and refund channels become increasingly interconnected, ZIGRAM argues that connecting fraud and AML capabilities through a FRAML approach can help banks, payment firms and FinTechs identify financial crime risks that may otherwise remain hidden across separate systems.
Copyright © 2026 FinTech Global
