Return fraud: how AI video + POS checks can catch it

What return fraud is

Return fraud is using the returns process to get money or credit the store doesn't owe. It can be done by a customer, by a member of staff, or by both together, and it can happen wherever a register takes returns: the returns desk of a fashion store, a boutique counter, a souvenir shop or bookshop register — and at restaurant and café counters, as a refund for an order. It takes five forms.

Returns without a receipt

Many stores accept returns without a receipt, for a refund, store credit or an exchange. Without the receipt there is no link to an original sale: the item may have been bought elsewhere, bought at a lower price, or not bought at all. For staff, a no-receipt return is also an easy entry to key in when nothing comes back — the scheme covered in our guide to void and refund fraud.

Returning stolen or never-bought goods

An item is taken from the shelf, or from another branch, and brought to the counter as a return. The item is real and does come back across the counter, so the return looks honest; the money paid out was never paid in. Sometimes a genuine receipt from an earlier purchase of the same item is used again.

Wear-and-return (wardrobing)

An item — an outfit for an event, a tool for a weekend job — is bought, used and returned as if unused, within the return window. The sale and the return are both genuine entries; the loss is in the item, which may no longer sell at full price.

Refunds to a different card

A purchase is paid one way and refunded another: paid with one card and refunded to a different one, or paid by card and refunded in cash. A customer can use this to move money off a stolen or disputed card. A cashier can refund a real earlier sale to a card they control — the staff-side variant covered in the void and refund fraud guide.

Exchanges recorded as returns

A customer brings back a jacket in the wrong size and leaves with the right one. That is an exchange: no money should change hands. If the cashier records it as a cash return instead and rings no new sale, the POS pays out the jacket's price. The customer never sees that money, and the drawer still balances because the cash leaves with the cashier.

Return fraud borders on two neighbouring problems. A refund keyed in with no customer and nothing coming back is employee theft rather than a customer return — see void and refund fraud. Discounts, price overrides and loyalty points used for someone else belong with discount, override and loyalty abuse.

Why traditional methods miss return fraud

Returns are a normal part of retail: a wrong size, a gift swapped after the holidays, a faulty item. In the transaction log an honest return and a fraudulent one look alike: a return number, a time, an amount, a tender type, an employee ID and sometimes a receipt reference.

• POS return reports give a count without context. They show how many returns, how much, at which register and by whom. They can't show whether a customer was at the counter, whether anything was placed on it, or whether an item went back out instead of money.
• Receipt checks and return policies have gaps. A receipt proves that an item was bought once, not that this is the item that was bought or that it wasn't worn. No-receipt returns, which many stores accept to keep customers, have no link to a sale at all.
• Manual CCTV review doesn't scale. Checking one return means finding the right camera and the right minute and watching what came across the counter. Across every register and every store, that review happens only after a loss is already suspected — if at all.
• Classic object detection sees objects, not actions. A detector can say that a person is at the counter or that a bag is on it. It can't say whether anything was handed back when the refund was entered — and it doesn't know what the POS just recorded.

Return reports are good at telling you where to look. What happened is in the video at the returns counter, at the moment the return was keyed in.

How vision-language models make it solvable

Primarch builds on and enhances vision-language models (VLMs): models that read video and language together. Instead of detecting objects frame by frame, the model reads the scene at the returns counter the way an experienced loss-prevention auditor would — at every register, every hour.

• It understands the action, not just the objects. A VLM reads a window of time, not a single frame, so it can recognize whether a customer was at the counter when a refund was entered and whether anything was placed on the counter for it.
• It joins the video moment with the POS line. Each return in the transaction log is matched with what the camera at that register shows in the same second. An exchange recorded as a return is checked the same way as any other refund.
• It writes the finding in plain language, with a clip. The result is a sentence a manager can read — what happened, at which register, and why it doesn't match the log — with a time-stamped evidence clip and the matching return line.
• It chains repeated events into patterns. Events are linked by store, register, cashier and hour into 30-day patterns: single events are alerted for review, and the pattern shows what repeats.

It matters just as much to say what a check at the register does not show. It doesn't show where an item was before it reached the counter, so goods taken from the shelf and brought to the returns desk look there like any other return. Whether a returned item was worn is a judgement for the person taking the return, under the store's return policy. A camera + POS check at the counter is one layer of return-fraud control, alongside receipt rules, return windows and stock checks.

For every return the questions are: was a customer at the counter, and did anything come back across it? Both answers are in the video at the moment the POS entry was made. For an exchange recorded as a return, the clip of that moment shows what crossed the counter.

What to look for in a solution

Whichever vendor you talk to, these are fair questions to ask about a system meant to catch return fraud:

• Works on your existing cameras. Can it connect to the IP cameras you already have, including the one over the returns desk if returns are taken at a separate position?
• Integrates with your POS transaction log. Returns, exchanges and tender types live in the log; a camera-only system can't tell an honest return from a false one. Ask which POS exports it can read and how the integration is validated.
• Produces evidence usable in HR processes. A time-stamped clip together with the matching return line, so a finding can be reviewed and discussed fairly — not a bare alert.
• Respects privacy. Is there an on-premise option where footage never leaves the site? Is anonymization applied, is analysis limited to the checkout zone, and does it meet GDPR and other data-protection requirements?
• Can be piloted on your own footage. Your returns desk, camera angles and POS — not a demo video.
• Handles false alarms openly. Stores take many honest returns. Ask how findings are reviewed by a person, and how single events are separated from repeating patterns.
• Gets alerts to the right role. An instant alert to the store manager, a digest for loss prevention, a dashboard for area and head-office teams.

Example use cases

The walk-throughs below are illustrative examples of how a finding is built. They are not customer cases and contain no performance figures.

Example 1: a card refund for a coat that never reached the counter

1. 01

   Moment

   The returns desk of a fashion store, 17:05 on a Saturday.

2. 02

   What the camera shows

   A person comes to the desk empty-handed, talks briefly with the cashier and presents a card at the terminal. No bag or item is placed on the counter and nothing is handed across it.

3. 03

   What the POS log shows

   A no-receipt return for one coat at 17:05, refunded to a card.

4. 04

   The finding + evidence clip

   "A card refund for one coat was entered at the returns desk at 17:05. A person was at the counter, but nothing was placed on it." The clip and the return line are attached.

5. 05

   Who is alerted

   The store manager, instantly; loss prevention in the weekly digest. A refund to someone at the counter with nothing returned may point to an accomplice, so the review covers both sides of the desk.

6. 06

   What the 30-day pattern shows

   Chained by register, cashier and hour, the flagged refunds at the returns desk show whether they fall on one cashier's shifts or are spread across the team; each comes with its clip for review.

Example 2: an exchange recorded as a cash return

1. 01

   Moment

   A shoe store register, 11:20 on a weekday.

2. 02

   What the camera shows

   A customer places a shoebox on the counter. The cashier takes it to the back, returns with another box, and the customer takes it and leaves. No cash is handed to the customer.

3. 03

   What the POS log shows

   A return for one pair with a cash tender at 11:20, and no new sale line for the replacement.

4. 04

   The finding + evidence clip

   "A cash return was entered at 11:20, but the customer left with a replacement box and no cash was handed over." The clip and the return line are attached.

5. 05

   Who is alerted

   The store manager, instantly; the area manager in the weekly digest.

6. 06

   What the 30-day pattern shows

   Whether exchanges recorded as cash returns repeat on the same cashier's shifts or at the same hour — or stay a one-off keying mistake.

Example 3: a refund to a different card at a boutique

1. 01

   Moment

   A luxury boutique, 15:30.

2. 02

   What the camera shows

   A customer at the counter places a handbag on it; the cashier checks it, and the customer presents a card at the terminal.

3. 03

   What the POS log shows

   A return for the handbag at 15:30, refunded to a card; the original sale it references was paid with a different card.

4. 04

   The finding + evidence clip

   "The 15:30 refund went to a card other than the one used for the original sale." The clip, the return line and the original sale line are attached.

5. 05

   Who is alerted

   Loss prevention, for a review against the store's refund rules.

6. 06

   What the 30-day pattern shows

   Whether refunds to a different tender repeat at the same register or on the same cashier's shifts.

How Primarch's Retail Fraud Expert helps

This section is about our product. The Retail Fraud Expert is the Primarch expert module for the checkout. It recognizes actions at the register — scan, skip, void and refund — and cross-checks each one against the POS record in the same second. For return fraud it:

• Flags a return entered with nothing on the counter — the merchandise-free refund.
• Checks whether a customer is at the counter when a refund is entered.
• Checks exchanges recorded as returns like any other refund, matching the return line with the camera at that register in the same second.
• Recognizes a customer leaving with a replacement item while the POS records a cash return.
• Compares the refund tender with the tender of the original sale and flags refunds to a different card.
• Chains events by store, register, cashier and hour into 30-day patterns: single events are alerted for review, and the 30-day patterns show what repeats, so a single event isn't treated as a verdict.
• Produces an evidence file for each finding: a time-stamped clip plus the POS record, usable in HR processes.

It works at returns desks and registers in any store with a register — fashion and luxury boutiques, souvenir shops, bookshops — and at restaurant and café counters, where a refund for an order is checked the same way, wherever a camera covers the counter. For the staff-side schemes, see void and refund fraud. For a sector view, see retail store loss prevention and restaurant and café loss prevention.

Putting it to work

1. 01

   Connect

   Connect your existing RTSP cameras and the POS transaction log export; no new cameras or special hardware. It is designed to work with any common POS system that can export transaction logs; the integration is validated together during the pilot.

2. 02

   Pilot on your own footage

   Run it on your own registers and returns desk, camera angles and POS data, and review the findings together.

3. 03

   Roll out

   Extend to more registers and stores, with central monitoring across the chain.

• Alerts, digests and dashboards. Instant notifications, periodic digests and role-based dashboards, so each finding reaches the person who acts on it.
• Ask the past in plain language. Findings are written into a queryable event memory: "Which returns were flagged at the returns desk last week?"
• Evidence for HR. Every finding carries its time-stamped clip and the matching transaction line.
• Privacy by design. With on-premise deployment, footage never leaves the facility. Analysis focuses on the checkout zone with privacy-compliant anonymization; the goal is action–transaction consistency, not tracking people.