- Статьи
- Society
- From a kind of fraud: how the return of goods turned into a scheme to deceive sellers
From a kind of fraud: how the return of goods turned into a scheme to deceive sellers
Dozens of Telegram channels train Russians to pick up goods for free, simulating delivery problems, forgery, or inconsistency with the description. Businessmen who sell on popular marketplaces and even flower and grocery delivery services are at risk. Cybersecurity experts told Izvestia the details.
What is a "refand"?
In the last two years, a community of so—called "referrers" (from the English refund) has formed on the Network, which use consumer protection mechanisms to receive goods for free or at a big discount, and then resell them. As a result, sellers of various goods and services incur multimillion-dollar losses.
Initially, a "refand" is a standard procedure for refunding money for an item that does not match the description, turned out to be a fake, or was not delivered. However, today a whole sphere of criminal business is being formed, where it is not even about abuse of law, but about deliberate actions to alienate goods and funds.
The "black refand" has spread to e-commerce, technical devices, clothing, and even the flower business. Resources where they teach how to deceive merchants are very popular among marginalized youth.
A bouquet for you
The editorial staff found a fragment of correspondence from a closed channel, the author of which appears to be a practicing "refander". He describes in detail the methods of deception of the flower delivery service.
In his instructions, the "specialist" describes two methods of unfair earnings. The first is a partial return of flowers: 2-3 bouquets are bought with a request to assemble into one. The buyer removes some of the flowers, photographs the "shortage" and demands compensation. The author claims that the seller most often pays for a "mistake." There is also a full refund scheme. The order is placed at a random address. After the seller has photographed the delivery, a taxi is called to pick up the bouquet. Then the owner tells tech support that he did not receive anything. However, the author himself warns that the scenario may lead to problems with justice.
Representatives of the flower business are aware of the problem and say that most delivery services have now fixed the vulnerability that allowed such tricks.
MotleyGrass expert Natalia Kanunnikova stated that the described fraudulent scheme has recently ceased to exist and does not work on modern marketplaces.
— This method of fraud with self—export no longer works, because if a customer wants to pick up a bouquet on their own, the seller must write to support in such a situation, - says Kanunnikova. — And support is already changing the delivery method to pickup. Thus, the whole process takes place through the official channel of the site, and not through a call to the courier from the left SIM card.
Kanunnikova emphasizes that the store does not have the right to place an order without a special confirmation code, which is generated only in the application.
"The platform does not recommend sellers to independently make a decision about changing the delivery for the customer, and even more so to communicate with the buyer in third—party messengers," the expert adds. — This is done specifically to prevent such situations. No normal courier will give a bouquet to a person without confirmation in the system.
In 2025, a worker from Yakutia was found guilty of fraud with orders worth almost 100 thousand rubles. The girl ordered clothes and other goods in her own name, and then made a refund — she imitated sending a parcel, using her official position. Her actions were qualified under the article "embezzlement or embezzlement" (160 of the Criminal Code of the Russian Federation)
A law enforcement officer commented on the legality of such manipulations specifically for Izvestia.
— When an attacker intentionally specifies the "left" address, redirects the courier (the so-called "reroute". — Izvestia), and then declares in support that he did not receive the order, we are dealing with a classic theft of property by deception," explained a source in the Moscow police. — Actions qualify as fraud. The scheme, described as a "partial refand" (removing some of the flowers for the photo), is also criminalized, albeit with less damage. The author is lying, claiming that couriers do not suffer, as losses fall on the seller and the platform. As a result, the end user suffers — the cost of the product increases, as does the amount of the delivery fee.
"Refand" on marketplaces
Popular Chinese marketplaces in Russia are subject to the greatest attacks by "black referrers". Information on deception of foreign retailers has been collected in various Telegram channels, including paid ones. They scrupulously describe the tricks that allow you to open a dispute with sellers and unreasonably benefit. For example, text authors teach you how to find products with a logo. The buyer can only complain that the logo does not match the declared one or is missing. This is how you can get a bonus from the seller.
Combinators also teach you how to "get to the bottom" of a product's inconsistency with the description. For example, there are only "red" pants in the product name, but there is a choice of colors. The buyer takes the blue ones and demands an 80% refund, citing misleading information. Another mechanism is fake tracks. They order an expensive item from China (for example, a speaker or a video card), then they open a dispute due to the fact that the manufacturer is incorrectly specified or there is no certificate for sale, and they demand a refund. Instead of honestly sending the goods, the combinators give the system a fake track number (sold on thematic sites). Then the dispute is closed in favor of the buyer, since formally everyone remained at his own place. But the seller will never wait for his item back, although the system will see that he received the parcel under signature.
As for domestic marketplaces, it's not that simple for fans of freeloading.
— Firstly, this is our jurisdiction, and small-time crooks are afraid of being prosecuted, — says a source in the cyber police. — Secondly, large sites have a fairly serious security service, they quickly monitor weaknesses and vulnerabilities.
The scale of the threat
But smaller players are at risk. The massive "refand" is becoming a new challenge for e-commerce and the law enforcement system, lawyer Ekaterina Krasnova believes.
— What is presented online as a "life hack" or "savings" is actually a fraud system. While the channel authors earn money by selling manuals (starting from several thousand rubles for a "limited account"), their subscribers risk getting a criminal case for a bouquet of flowers or a powerbank.
However, she notes that a law enforcement officer may have difficulty proving intent.
— The difficulty is that this kind of conflict lies on the edge of criminal law and civil law relations, fraudsters take advantage of this.
A serious group of referrers was identified in Saratov in 2022. The attackers purchased expensive equipment from large networks — computers, premium smartphones and other gadgets. The accomplices intentionally damaged the goods, imitating a factory defect. After that, the scammers sent claims to the sellers, attaching fake expert opinions. Lawyers acting under proxy powers filed lawsuits in the courts. When the demands were met, the money was transferred to special accounts. In some cases, the accomplices resold the repaired equipment via the Internet. The total damage exceeded 5 million rubles.
Переведено сервисом «Яндекс Переводчик»
