BOPIS Return Fraud: The Handoff Is the Hole

The order never ships, so there is no carrier trail. It waits in a back-of-house staging area, and it ends at a car window or a pickup counter, where a busy employee hands it to someone who says the right name. That handoff is where the loss happens now. Fraud has moved from the sales floor to the fulfillment layer, and buy online, pick up in store is the seam it probes first.

The handoff is the hole

BOPIS is no longer a side channel. About 34.2 percent of US consumers, roughly 97.2 million people, use it regularly, and 87 percent of retailers offer it at checkout. A shipped order creates evidence at every step: label scans, delivery photos, carrier weights. A BOPIS order creates a handoff. If pickup identity checks are casual, an order can be collected by the wrong person, reported as never picked up, or returned in a switched state with no transport record to contradict the claim.

The return itself is often processed by whoever is free, against a receipt on a phone screen, in a store whose systems may show less order detail than the ecommerce team's dashboard. The order was never shipped, so there is no carrier trail, and the return often happens at a busy counter where speed beats scrutiny. That is the structural risk: less documentation, which makes abuse easier to hide and harder to prove.

Card-not-present does not end at the counter

The misunderstanding that costs retailers the most money is about liability. Card networks classify a transaction as card-not-present based on how it is authorized, not how it is fulfilled. If the card is never physically presented for examination at checkout, the transaction is card-not-present even when the customer collects the order in person later. Seeing the customer at pickup does nothing to change who pays for the chargeback.

Under standard Visa and Mastercard liability shift rules, a merchant that authenticates the checkout with EMV 3-D Secure generally shifts fraud liability for that transaction to the card issuer. A merchant that skips 3-D Secure on BOPIS checkouts keeps that liability even if the pickup counter caught nothing wrong, because liability is assigned at authorization, not at pickup. Run 3-D Secure on BOPIS checkouts, not only on shipped orders. The pickup ID check is a second control, not a substitute for authentication.

The three checks that matter

First, require a pickup code sent only to the customer's email or phone, confirmed at handoff. A code creates a system record, which is why it balances speed and evidence better than ID alone. For high-value orders, code plus photo ID is reasonable. The system should require the check before the order can be marked collected, rather than relying on retraining alone. Stores where the pickup log is consistently blank are telling you the policy is decorative.

Second, match the pickup ID to the cardholder name, and flag orders paid with a card added shortly before pickup. Fraudsters favor the channel because it skips the shipping address, one of the strongest fraud signals an online store has. Pickup requested within minutes of the order, an alternate pickup person added at checkout with no apparent link to the cardholder, and a collector who resists showing ID or gives the wrong order number are the red flags to screen before the handoff.

Third, keep a pickup record for every order. It should show when the handoff happened and who on your staff made it. Note the ID check result too, and add a signature or handoff photo where your policy allows one. When a customer later claims they never received the order, that record is the whole defense. Without it, the dispute is the customer's word against a gap.

The return that comes back the same day

Audit BOPIS returns as their own line in the monthly returns review. Pull the returns and look at the pickup-to-return interval. Same-day and next-day returns of occasionwear, electronics accessories, and seasonal items deserve a sample review, especially when the stated reason is vague. Grade the condition of BOPIS returns the same way warehouse returns are graded, and route high-value BOPIS returns to a second pair of eyes.

Most fixes are unglamorous: require the pickup confirmation step in the system, put the full order detail in front of the person processing the return, grade the condition the same way, and report BOPIS returns as their own line. Most gaps are process gaps, not master criminals, and they close cheaply once measured. The channel is not inherently riskier than shipping. It is less documented, and documentation is the control.

Frequently asked questions

Is BOPIS fraud a real problem?

Yes. About a third of US consumers use buy online, pick up in store regularly, and 87 percent of retailers offer it. Retailers reported an 18 percent jump in shoplifting incidents in 2024 versus 2023, and 55 percent said organized retail crime groups drove increases in digital and ecommerce fraud.

Does seeing the customer at pickup shift fraud liability?

No. An online order stays card-not-present even when the customer walks into the store, because the card was never physically presented at checkout. Liability is assigned at authorization, not at pickup. Only 3-D Secure authentication at checkout shifts liability to the issuer.

What is the best pickup identity check?

A pickup code sent to the buyer's phone or email, confirmed at handoff, balances speed and evidence better than ID alone, because it creates a system record. For high-value orders, code plus ID is reasonable. Whatever you choose, the system should require it before the order can be marked collected.

How do I audit BOPIS returns for fraud?

Pull BOPIS returns and look at the pickup-to-return interval. Same-day and next-day returns of occasionwear, electronics accessories, and seasonal items deserve a sample review. Then sample orders and confirm an identity check was logged. Stores where the log is consistently blank are telling you the policy is decorative.