Every other counterfeit risk covered so far enters through a sale, a marketplace listing, a lookalike domain, a social post promising a discount. This one enters through the opposite direction entirely. A customer buys the genuine product, swaps in a counterfeit or damaged substitute, and returns the fake for a full refund, keeping the real item for themselves. According to NRF and Happy Returns’ 2025 Retail Returns Landscape report, published in October 2025, of $849.9 billion in total US retail returns for 2025, roughly $76 billion, about 9%, was fraudulent. Among retailers tracking fraud incidents specifically, 64% reported an increase in decoy returns involving counterfeit items swapped in for the genuine product.

How the swap actually works

The mechanism is straightforward, and it targets specific categories deliberately. Designer handbags, jewelry, watches and other high per-unit-value goods that are easy to replicate convincingly enough to pass a quick visual check at a return desk are the most common targets. Four trends make this easier to pull off now than it used to be: the fakes themselves are cheaper and more convincing than they were even a few years ago, e-commerce growth means many returns never face an in-person checker at all, more generous return policies remove friction that used to slow fraud down, and new technology, including AI, is increasingly used to fabricate supporting documents like receipts.

Why this is a two-stage risk, not one

The immediate loss is straightforward: a refund issued for a product the retailer no longer actually has, replaced by something worth a fraction of the price. But the compounding risk is worse. If the counterfeit substitute isn’t caught at intake, it can be restocked and sold to a real customer as genuine, at which point a return-fraud incident quietly becomes an actual counterfeit sale under the brand’s own name, the exact failure mode this blog has already covered from a dozen other angles this year, just arriving through a completely different door.

Why this sits outside normal brand-protection monitoring entirely

Marketplace monitoring, domain monitoring and social-media monitoring all watch for a counterfeit trying to reach a customer through a sale, a listing going live, a lookalike domain registering, a post going up. This fraud pattern happens entirely inside a retailer’s own physical or logistics operation, after a sale has already closed, which means none of those monitoring types are built to see it at all. It’s not a gap in how well any of them work, it’s a category of risk sitting in a completely different part of the operation, one that needs its own verification step rather than an extension of listing or domain monitoring.

What verification at the point of return would need

The same underlying principle used elsewhere in brand protection, matching a specific unit against verified product data rather than trusting appearance alone, applies here too, just pointed at inbound returns instead of outbound listings. Serial numbers, authentication markers, or catalogue-level product verification checked at the point of intake is what catches a swap before the counterfeit re-enters inventory, rather than discovering it only when a real customer complains about receiving a fake from a retailer they trusted.

Getting started

A brand or retailer handling high-value, easy-to-replicate categories, jewelry, watches, designer goods, should treat return intake as seriously as any other counterfeit checkpoint in the business. A fraud pattern invisible to marketplace or domain monitoring can still put a counterfeit product back into circulation under the brand’s own name, and by the time it surfaces as a customer complaint, the fraud has already happened twice, once at the swap, and again at the resale.