Ecommerce fraud spikes in Q4: How to combat bracketing & wardrobing

According to the NRF, nine percent of this year’s returns will be fraudulent, worth roughly $76.5 billion industry-wide. None of that shows up during Q4’s biggest sales weeks. It shows up weeks later, once Q5, the returns wave that follows right behind it, starts landing, and by then it’s too late to build the defenses that would have caught it.

Most of that fraud isn’t a coordinated ring working your checkout page. NRF’s own data backs this up: close to two-thirds of consumers admit to participating in at least one costly returns behavior, bracketing, wardrobing, sending back the wrong item or an empty box, and 45% say “bending the truth” during a return is acceptable if they’re unhappy with the purchase. These aren’t hardened criminals. They’re shoppers who’ve decided your flexible return policy has no real cost to testing it.

The good part: this behavior is specific and recognizable, which means it’s also stoppable, if the defenses are built during Q4, before the volume hits.

Bracketing, wardrobing, and returning items that don’t qualify

Bracketing: order five, keep one, return four.

A shopper buys five swimsuits to try on for a beach trip, keeps one, returns four. You’re left with returned merchandise you likely can’t resell at full price, multiplied across every shopper doing the same thing with every order.

Wardrobing: worn, tagged, and returned as new.

An item gets purchased, worn, tags carefully left on, and returned as new, even though it clearly isn’t. Without a real inspection process, you’re issuing refunds on inventory you can’t actually restock.

Returning ineligible items: final sale, damaged, or out of window.

Some of these are easy to catch manually. At Q5 volume, without a system built for it, most of them aren’t. One caveat worth knowing before you lean on automation here: Shopify’s Final Sale tag overrides Loop’s fraud workflow entirely, a flagged high-risk return tagged Final Sale still won’t get caught by the workflow. If final-sale abuse is a real pattern for your brand, that’s a gap to handle separately.

NRF’s merchant data adds specifics worth knowing: retailers tracking these incidents report rising rates of overstated return quantities (71%), “box of rocks” empty-box returns (65%), and decoy returns using counterfeit items (64%). This isn’t a hypothetical risk, it’s already showing up in the data at scale.

Four moves to build fraud defenses before Q5 hits

Loop’s fraud model has flagged $250M before it left merchants’ businesses

At Loop’s network scale, the fraud model has flagged $250M in refund value before it left merchants’ businesses, identified 394K+ high-risk customers through repeated identity and behavior patterns, and found that 28% of returns over $800 contain fraud signals, fraudsters target your highest-value returns, not your lowest. Shaping New Tomorrow, a Scandinavian apparel brand, has seen the model catch $0.87 of every $1 in confirmed fraudulent transactions on their own account specifically.

The earlier this runs in Q4, the more of Q5’s volume it actually covers. A model configured after the returns start arriving is a model that missed the window it was built for.

Charge refunds a fee. Leave exchanges alone.

If your brand runs free shipping and free returns with nothing at stake, you’ve built the exact conditions bracketing and wardrobing thrive in. The fix isn’t a blanket fee on every outcome, it’s charging the outcome that actually costs you and leaving the one you want more of alone: add a fee on refunds, and keep exchanges fee-free. That asymmetry does more to curb bracketing than a flat fee applied everywhere, since it only adds friction to the behavior you’re trying to reduce. Checkout+ lets shoppers offset that refund-side cost upfront with a small fee at checkout, funding the coverage instead of absorbing it as a pure loss.

Fraud tools flag the return. Trust tier protects the customer.

Certain product categories carry more abuse risk than others, swimwear with a removed hygiene strip is the obvious example. Loop’s Workflows tool lets you route specific categories or specific repeat-return customers into a required inspection step before a refund issues, without adding friction for the shoppers who aren’t the problem.

The flip side of that same signal is Shopper Trust Tier: a shopper flagged Trusted across the Loop network gets fast-tracked instead of reviewed, the opposite lens on the exact same risk data. Fraud tools act on the individual risky return; Trust Tier protects the customer who returns things occasionally but has never given you a reason to doubt them. Most of your customers are the second kind, and the network already knows it. That’s not just a Loop pattern, either, Appriss Retail’s 2026 benchmark research found that high-value customers return less than the average shopper across the industry, even though blanket return policies tend to treat them like the risk.

One more distinction worth keeping straight: a customer who returns constantly but stays inside your stated policy isn’t a fraud problem, it’s a policy one. Fees by outcome, Keep Item, routing rules, the return window itself, those are the levers for serial-but-legitimate returners. Save the fraud workflow for the individual flagged transaction, not as a blanket response to anyone who returns a lot.

Mockingbird built exactly this before their fraud problem became unmanageable. Their 30-day try-at-home policy made them a target for dark web fraud rings and counterfeit-product returns, and manual fraud monitoring was costing 20 to 30 hours a week. After automating detection: 93.84% fraud detection accuracy, an 81% true positive rate, $26K in fraud losses prevented, and manual review time cut to under 10 hours a week, without tightening the generous policy that made them a target in the first place.

See the item’s condition before you approve the refund

Even a well-designed fraud model is only as good as what you can see once the item is back in your warehouse. Loop’s Two Boxes integration gives real-time access to item grading and disposition data on returned inventory, so you’re rejecting return requests based on actual condition evidence, not guesswork. This isn’t a fraud-detection tool on its own, it’s the visibility layer that makes your inspection decisions defensible once a return is flagged.

Prepare in Q4. Q5 is when it gets tested.

Nothing above matters if it’s configured after the returns start arriving. The brands that come out of Q5 with their margins intact aren’t the ones reacting fastest in January, they’re the ones who had the fraud model live, the fees in place, and the workflows built back in Q4, before the volume gave them a reason to scramble.

Covered through Q5?

Peak earns the revenue. Q5 decides how much of it you keep.

See how it works