Insider Threat Matrix™Insider Threat Matrix™

Fraudulent Refund Issuance

A subject abuses authorized access to create, approve, increase, duplicate, or redirect a refund without a legitimate business basis or required authorization.

 

The subject may issue the refund to themselves, a friend, family member, associate, colluding customer, or another external party. This may involve refunding a transaction that did not occur, issuing a refund where the goods or services remain valid, refunding more than the original amount, processing the same refund multiple times, or redirecting the proceeds to a payment method or account controlled by an unauthorized recipient.

 

The subject may conceal the infringement by creating fictitious customer complaints, manipulating return or cancellation records, using unrelated customer accounts, bypassing approval thresholds, dividing the value across multiple refunds, or recording false reasons for the transaction.