Nearly 1 in 4 merchants hit by internal fraud, Chargebacks911 finds
The payments industry has spent years building walls through fraud filters, AI detection, behavioral biometrics, 3D Secure and machine learning that have all been designed to stop threats arriving from outside. New research from Chargebacks911, a global leader in dispute resolution and chargeback management, suggests many merchants have spent years defending against the wrong threat.
The 2026 Chargeback Field Report, based on proprietary survey data from more than 250 merchants, finds that nearly one in four merchants has experienced employee-initiated fraud or in-house collusion. Fewer than four in ten of those merchants actively monitor for it. More than half, 53.5%, either do not know whether the problem is being tracked within their organization or confirmed outright that it is not.
The findings arrive as retailers across global markets enter one of the busiest seasonal hiring periods of the year. Back-to-school recruitment brings large numbers of temporary employees into direct contact with payment systems, refund processes and customer data at precisely the moment internal controls are under their greatest pressure.
“The most sophisticated fraud prevention platform in the world cannot stop a threat it was never designed to recognize,” said Monica Eaton, founder and CEO of Chargebacks911. “Merchants have invested heavily in stopping fraud at the door. Very few have stopped to ask what happens when the threat already has a key.”
Internal fraud rarely looks dramatic as it does not resemble someone breaking into a system or stealing payment credentials. It looks like ordinary business continuing exactly as expected and that is precisely what makes it so difficult to detect.
In its most deliberate form, an employee with access to customer accounts directs a buyer to file a chargeback rather than request a refund through the merchant, with the resulting funds shared between them. The merchant loses the transaction, absorbs the chargeback fee and has no obvious way to trace the loss back to its source.
Sometimes there is no malicious intent at all. A refund is agreed but never processed correctly. The customer disputes the payment, the merchant absorbs the loss and the resulting chargeback appears no different from external fraud.
Both scenarios produce losses that are functionally indistinguishable from external fraud. Without visibility across the full dispute lifecycle, most merchants will never know the difference.
“The assumption behind most fraud prevention strategies is that the threat is outside the building,” said Donald Kossmann, chief technology officer at Chargebacks911. “That assumption determines which data gets monitored, which patterns get flagged and, just as importantly, which risks never get questioned. Internal fraud is effective because it operates inside the perimeter that assumption creates. It doesn’t bypass controls. Managing internal fraud isn’t a matter of suspicion but rather of architecture. Merchants need continuous visibility across dispute activity to identify unusual patterns before unexplained losses become accepted as part of doing business.”
The back-to-school period is a period in which retailers deliberately expand access to sensitive systems under accelerated timelines, with onboarding compressed by necessity and oversight stretched by volume. New employees are not inherently a risk, but process weaknesses that experienced teams have learned to work around become significantly more dangerous when large numbers of temporary staff are introduced in a short period of time.
Fewer than half of merchants surveyed monitor employee actions that result in disputes at all. Most organizations that uncover internal fraud do so retrospectively, not because their systems detected it, but because the losses eventually became too large to ignore.
Chargebacks911’s Unified Dispute Management System (UDMS) applies AI and machine learning across the full dispute lifecycle, identifying patterns consistent with internal process failures or deliberate collusion that remain invisible when cases are reviewed individually. ResolveLab provides continuous, real-time performance measurement across dispute activity, giving merchants the operational visibility to distinguish between external fraud, consumer abuse and internally generated losses.
“Most merchants discover internal fraud by accident,” said Eaton. “A pattern eventually becomes too obvious to ignore, or someone says something they shouldn’t. That is not a detection strategy. Merchants who are serious about managing this risk need to understand their own dispute activity well enough to recognise when something doesn’t add up, before the business starts explaining away losses it should have prevented.”
The complete 2026 Chargeback Field Report is available at https://chargebacks911.com/chargeback-field-report.