The Cyberfraud Economy: 1 in 4 Consumers Tempted by ‘Refund Hacks’

Retail fraud is becoming increasingly normalized in the US and UK as ‘refund hacks’ are promoted to consumers by organized crime gangs looking to recruit both knowing and unwitting digital mules.

This positioning of fraudulent activity as a ‘refund hack’ deliberately hides its illegal nature. Combined with growing awareness of fraud techniques – both online and offline – it’s driving consumer acceptance of casual fraud. This is bad news for retailers.

Netacea’s recently released Cyberfraud in Retail 2025 report looks at the growing presence of professional fraudsters in the retail space, with many organized crime gangs expanding their operations beyond ransomware, or at the very least borrowing operational learnings from these hardened groups. This is making organized fraud operations dangerously effective and fuelling a trend where fraud is just part of the cost of doing business for big brands.

As an accompaniment to the Cyberfraud in Retail report, Netacea ran a survey of over 2,000 consumers in UK and US to see if what researchers in our Threat Intel Center are seeing in criminal forums is reflected in public sentiment.

Awareness of niche cyberfraud techniques is rising

The findings suggest that awareness of common fraud techniques is high. Only 7% of respondents were not aware of any retail fraud techniques at all. But the majority demonstrated a good understanding of some of the techniques we break down in the Cyberfraud in Retail report. Indeed, 81% are familiar with the concept of DNA (Did Not Arrive) fraud, in which the recipient claims a package was not delivered to claim a refund.

Although only around half of this number (44%) knew about returning empty or junk-filled packages to trick the refund process.

Around 73% acknowledged the use of someone else’s payment card details to purchase goods as fraud. But there was a significant drop in the number (48%) of respondents aware of the use of illegitimately acquired gift cards, loyalty points, or account balances to purchase goods.

A data point even our threat experts found surprising is that around 16% of respondents were aware of the availability of third parties, known as ‘boxers’, that can be used as-a-service to commit fraud on your behalf, typically for between a 10-30% cut. This level of awareness is higher than we expected for what we consider a niche offering, but does align with the overall trend of cyberfraud techniques entering the public consciousness.

It was also interesting that awareness of boxers was significantly higher in the age 30-60 demographic, which could be due in part to the prevalence of social media across all age groups, the popularity of Gen X and Gen Y with as-a-service offerings and maybe even the greater understanding of risk that comes with age (boxers essentially take on the risk for you, hence it being a premium service).

Social media drives awareness of fraud but friends push acceptance

Social media is the key channel where consumers learn about fraud techniques, with 58% of all respondents hearing about ‘refund hacks’ or similar here.  This channel is more prevalent in the US, where 71% of consumers have heard about retail fraud via social media, compared to just 49% of UK respondents.

Almost half (46%) of all respondents say they have seen advertisements or promotions of fraud techniques or guides on social media, with Facebook being the worst offender (and very popular with Gen X), followed closely by TikTok and YouTube, then Instagram, X/Twitter, and forums like Reddit. Despite its younger user base of primarily Gen Z consumers, TikTok ranks almost as high as Facebook, showing how fraud awareness spreads across different demographic groups on various platforms.

News articles and TV closely follow at 53% as sources of information about fraud techniques. These traditional media sources are more heavily weighted toward the 54-70 age group. Social media, however, drives awareness across all age groups.

But it’s not the social media ads that are the main proponents of cyber fraud – this is more commonly discussed among friends. Of the 34% of respondents who have had ‘refund hacks’ or fraud recommended as a source of additional income, the main instigator is not social media influencers but friends, especially for those in the 26-60 age bracket. 

Furthermore, personal conversations with friends, family or colleagues drive awareness of fraud techniques in 50% of all respondents, highlighting the relationship between general awareness of fraud techniques and potential interest in getting involved in casual or organized criminality.

1 in 4 believe some level of fraud is acceptable

In support of the anecdotal evidence, promotional activity normalizing fraud seems to be working. Of those respondents who had seen ads or promotions for ‘refund hacks’ or guides on social media, more than a quarter (28%) have been tempted to act.

This is a worrying discovery when considered in context that more than a quarter of total respondents (26%) believe some level of fraud is morally acceptable. Of those, 8% said ‘over $500’ was acceptable. 5% said ‘up to $500’ was acceptable.

There’s no specific definition or threshold for casual fraud. However, among respondents who believe some level of fraud is acceptable, 81% draw the line at $100 or less.

Of these, most respondents (21%) said ‘up to $20’ was an acceptable level of fraud, followed by ‘up to $50’ at 18%, ‘up to $10’ at 16%, ‘up to $100’ at 15%, and ‘up to $5’ at 11%. 

 
Nearly 1 in 5 tempted by serious fraud

When it comes to engaging in more serious fraud, the majority of respondents said there were no circumstances in which they would consider engaging in more serious activities such as insider fraud (employees exploiting their position to defraud their company) or using boxing services. But 17% of the total said they could be tempted.

For these respondents, the split was almost even between ‘if it was ‘guaranteed’ that I wouldn’t get caught’ (38%) and ‘if the financial reward was significant enough’ (37%). A further 21% would also do it if they knew others were doing it without consequence.

Insider fraud threatens retailers and fulfilment services

Somewhat surprisingly, 18% of total respondents claim to personally know someone who has participated in insider fraud. The majority (12%), of these individuals work at the retailer itself, with the remaining 6% working in fulfilment, where they have access to logistics and delivery processes.

Nearly half of respondents (46%) would be ‘very likely to report’ if they were aware of insider fraud activity in their workplace. A further 28% would be ‘somewhat likely’ to report. But 14% would be unlikely to take action, unless the activity somehow directly affected them, and a further 7% would keep quiet out of fear of retaliation.

 
Most consumers have been affected by fraud

We didn’t outright ask our respondents if they had committed cyberfraud for fear of driving participants away (even though the survey itself was anonymous), but 5% of total respondents thought that either they personally or someone they know has been a digital mule and participated in a more organized cyberfraud scheme. While 19% of total respondents say they or someone they know had been invited to be a digital mule but had declined the offer.

Again, the issue seems to be more prevalent in the US. Almost one in five (19%) of US consumers have been approached to be a digital mule compared to just 2% in the UK.

But the vast majority (80%) of respondents believe they may have unwittingly been a digital mule or somehow otherwise involved in a fraud initiative, perhaps only as a victim. Similar numbers – all around a fifth – of respondents have experienced unauthorized transactions, received notifications of orders not made, or been contacted by a retailer or bank about suspicious activity on their account.
Fewer respondents – less than 11% – have had accounts created in their name (Fake Account Creation) or received items in the post that they did not order.

 
In terms of negative experiences related to fraud that would discourage consumers from shopping with a specific retailer, the main one was not receiving products paid for (76%), as is commonly the case with brand impersonation websites. This was followed closely by having an account or services used without permission – typical with ATO attacks – or receiving counterfeit goods – also typical of brand impersonation – both at 70%.

Interestingly, the least off-putting outcome of being flagged for potential fraud is the suspension of an account, checked by only 37% of respondents.

 
Consumers believe retailers should absorb fraud costs

Contrary to the anecdotal claim that fraud is largely seen as a victimless crime, 77% of total respondents do not believe this to be the case and largely understand that it harms both businesses and consumers.
But 20% do see fraud as a victimless crime, and most believe big retailers should just absorb the cost.

 Indeed, 58% of all respondents think retailers should be able to absorb some level of fraud costs without affecting prices. Most (20%) think fraud costs of up to 5% of revenues should be absorbed, with a further 12% who think that number should be closer to 10% of revenues. 

Criminality of fraud is a deterrent, but morality is a sliding scale

Given the level of awareness around the repercussions of cyberfraud for both brands and retailers, it’s unsurprising that 82% of respondents are concerned about the potential legal consequences of being involved in cyberfraud, either knowingly or unwittingly, and 46% are very concerned.

 
However, the immorality of various fraud activities is perceived on a sliding scale, supporting the evidence above that some people would commit fraud if they thought it was low risk.

When considering the immorality of certain actions, most respondents (~88%) acknowledged the use of stolen, lost, or stored-on-account payment details to make a purchase as ‘very immoral’. Closely followed (80%) using illegitimately acquired gift cards, loyalty points, or account balances.

But there was a significant drop in the perceived immorality of actions, with falsely claiming an item did not arrive in order to receive a refund and falsely disputing a transaction with your bank in order to receive a refund, acknowledged as ‘very immoral’ by 64% and 65% of respondents respectively.

The acts perceived as least immoral are the sharing of ‘refund hack’ or fraud methodologies or guides with friends or on social media, only seen as immoral by between 55-57% of respondents.

Only 42% of respondents felt that watching or reading a guide on ‘refund hacks’ or fraud for the purposes of personal gain is immoral.