Reviewing Return Fraud Scores by Hand: What an Analyst Checks Before a Denial
Direct answer: A fraud score should route returns into review, never straight into denial. A defensible manual review checks, in order: whether the account signals are actually the same person or just a shared address, whether the item history shows a pattern or a single expensive anomaly, the warehouse inspection record and photos for the disputed return, and whether the customer has a plausible innocent explanation the data cannot rule out. Denials that skip the inspection record collapse on the first appeal or chargeback. The score starts the file. A person has to finish it.
The score said 92. The analyst denied the refund in eleven seconds, because the queue was long and 92 feels like certainty. Three weeks later the chargeback arrived with a photo of a correctly returned item, timestamped, that had been sitting in our own warehouse record the whole time.
That story, with different numbers, is running in most operations that let a model grade and a human rubber stamp. Manual review is not a courtesy step. Done properly, it is the step that makes the denial survivable.
Identity signals lie in specific, known ways
Shared addresses are the classic false positive: apartment buildings, dorms, offices, and multi family houses all produce clusters that look like one actor with many accounts. Device and payment overlaps are stronger signals, but even they have innocent versions in families sharing cards and computers. An analyst earns their pay by asking which innocent explanation fits this cluster before treating it as a network.
Velocity is the other trap. A burst of returns in December looks like abuse in a raw count and like Christmas in context. Weight recent behavior against the customers own baseline and the calendar before you weight it against the population. The population did not buy four gifts in a week. This customer did.
Item history separates patterns from anecdotes
Abuse has a shape: the same high resale value categories, sizes or shades consistently missing from returned boxes, a rhythm of buy, use signal, return. A single expensive return from a long clean history is an anecdote, and denying on an anecdote teaches a good customer to dispute the charge instead of shopping again, which converts a maybe loss into a certain one plus a fee.
Look at what was kept, not only what came back. Customers who keep most of what they buy and return in one category are usually telling you a fit or quality story. Customers who keep almost nothing, across every category, are telling a different one. Keep rate is the most underused column in most review queues.
Open the warehouse record before you decide anything
The inspection notes and photos are the only evidence in the file that describes this specific return, and they are the first thing a payment dispute will ask for. If the photos are missing, blurry, or contradict the denial reason, the correct analyst action is to reverse the denial and flag the inspection process, not to defend a record you cannot show anyone.
That discipline protects the program, not just the customer. A fraud operation with a 90 percent defensible denial rate survives scrutiny, audits, and processor reviews. One that denies on scores alone eventually gets its evidence requested in bulk, and bulk is where weak files go to become expensive.
Write the denial like it will be read by a stranger
Because it will be: by the customer, by their bank, possibly by a regulator. State the factual basis in plain terms, the policy clause it rests on, and the appeal path with a real response window. Vague denials citing policy violations invite disputes because the customer cannot tell a considered decision from a coin flip, and banks tend to agree with them.
Then feed the outcome back. Every overturned denial is training data about which signals mislead your model, and queues that never record reversals keep making the same confident mistake at scale. Review the reviewers monthly. The score is not the only thing in the system that drifts.
Related reading
Related reading: Return Warehouse Triage: Sorting Fast Without Grading Sloppy, Return Reason Codes: Building a Taxonomy Your Data Can Actually Use, and Returns Data Cleanup: Fixing Reason Codes and Records Before They Mislead You.
Frequently asked questions
Should a high fraud score automatically deny a refund?
No. Scores sort and prioritize; they should not decide. Shared addresses, family accounts, and seasonal buying all produce high scores for innocent customers. A human should check identity context, item history, and the warehouse inspection record before any denial, because that record is what an appeal or chargeback will be judged on.
What is the most common false positive in return fraud review?
Shared addresses and shared payment methods in households, dorms, and apartment buildings are the most common, followed by seasonal return bursts from legitimate gift buying. Both look like organized abuse in raw counts. Checking whether the cluster has an innocent structural explanation is the first step of a competent review.
What evidence should support a refund denial?
The specific inspection record for that return, including photos and condition notes, the account history showing a pattern rather than a single event, and the policy clause the decision rests on. If the inspection record is missing or contradicts the denial, the defensible move is to reverse and fix the inspection process.
How should a denial notice be written?
Factually and specifically: what was found, which policy clause applies, and how to appeal, with a real timeframe for a response. Avoid accusing language you cannot prove. Denial letters get read by banks during disputes, and a calm, evidence based letter survives that reading far better than a form warning.