How can a small business owner or their accountant tell whether an employee is using the card terminal, POS or payment dashboard to send refunds to their own debit or credit card, or a friend's, and how do you stop it?

What should I check, step by step?

1. In your POS or payment account, find out who can issue refunds and who can issue refunds that aren't linked to a sale (Square calls this the issue unlinked refunds permission). Turn the unlinked kind off for everyone who doesn't need it, and set a refund limit.

2. Give each employee their own login or passcode, so every refund shows who did it. A shared code makes this whole check impossible.
3. Require a second person to approve refunds over a set amount and every refund not linked to a sale. The approval should name the original sale and the card the money is going to, not just the amount.
4. Each week, export all refunds with the original payment, the card last four digits and the employee. Flag refunds with no original sale, refunds to a different card than the sale, and the same card last four showing up on refunds for different customers.
5. Look for refunds just under the approval limit, refunds in round amounts, sales and refunds on the same day, and refunds clustered on one person, shift or till close.
6. Compare refunds with returned stock. A refund with no goods coming back into inventory is the gap to explain.
7. Call a few customers who were refunded to confirm they asked for it and got it.
8. Keep a dated copy of each week's refund report outside the POS, somewhere the staff who issue refunds can't edit.
9. If you find refunds going to an employee's card, talk to your accountant or a lawyer before confronting anyone, and keep the processor reports as they are.

Can a card refund go to a different card than the one that paid, and what are unlinked refunds?

Stripe's refund documentation says refunds can only be sent back to the original payment method used in a charge, not to a different destination such as another card or bank account. Square's RefundPayment reference says that for refunds linked to Square payments the destination is usually left out and the money goes back to the original payment source, though a refund can be sent to a gift card instead.

• Square also offers unlinked refunds: refunds not linked to an earlier payment, meant for customers without a receipt or for payments taken through another processor. You can refund items or a custom amount back to a card, cash or a gift card. Square's help page warns that refunding a transaction you have no record of presents risk of loss, and that by enabling unlinked refunds it is your obligation to prevent employee misuse and you accept the risks, including employee misconduct. It lets you set unlinked refund limits per mode, and its dashboard shows the refund reason, amount, date, time and the cashier who processed it.
• So the refund to watch hardest is the one with no sale behind it, or one sent somewhere other than the card that paid. A Journal of Accountancy fraud quiz lists that as a specific test: identify sales posted to one credit card with related refunds posted to another card.

What do prosecuted cases show about employees refunding sales to their own cards?

A pharmacy technician at Wegmans used the prescription system to process about 350 credit card refund requests in customers' names with made-up amounts between 2014 and February 2023. According to the U.S. Attorney's Office for the Western District of New York, she based the amounts on what customers had received before, tricked the pharmacist on duty into authorizing them, then paid the refunds to herself by swiping her own debit card at the point of sale: USD 568,021.69 in all. She was sentenced to a year in prison and ordered to pay USD 578,943.86 in restitution. The approval existed; it just didn't cover where the money went.

• At a Louisiana Nissan dealership, the office manager, who handled the daily cash, card transactions and salary payments, caused the business to issue refunds to her own credit cards more than 72 times between July 2009 and July 2011, for USD 57,894, according to the U.S. Attorney's Office for the Western District of Louisiana.
• At GameStop's head office, an employee responsible for refunding customers' bank cards used the company's merchant account numbers to make refunds that paid her own card debts and those of acquaintances, for USD 153,899.45 in 2004 and 2005. At Home Depot, an employee who handled charge disputes and refund requests initiated fraudulent customer and business refunds in 2019 and moved the money to accounts she controlled. In both cases the person had refunds as part of their normal job.

What tests do auditors use to find fake refunds to employee cards?

The Fraud Examiners Manual, quoted in the ACFE's Fraud Risk Exposures guide, describes the fictitious refund: an employee processes a return that never happened and takes the money, and because the return is recorded, the books show stock coming back that never did. It also notes that where refunds below a set amount skip management review, employees simply process many refunds small enough to avoid it.

• The Journal of Accountancy quiz lists the matching tests: look for many refunds just below the review amount, sales and related refunds on the same day, inventory adjustments compared with refunds by employee, sales on one card refunded to another, everyone who can post both refunds and inventory adjustments, and random calls to customers who returned goods.
• In the ACFE's fraud tree, false refunds sit under register disbursement schemes. Occupational Fraud 2026 recorded 62 register disbursement cases (3%), with a median loss of USD 14,000 and a median duration of 12 months; they were 3% of cases at organizations with fewer than 100 employees against 2% at larger ones. Refunds made from a back office or payment dashboard can run far larger, as the cases above show.