A method and a system for determining a return fraud at a store are described. The return fraud protection system has a video recording module, a face capture module, a face icon generator module, and an entrance video clip module. The video recording module records a video at an entrance of the store. The face capture module captures a face of a customer entering the store from the video. The face icon generator module generates a face icon comprising the face of the customer. The entrance video clip generator module generates a video clip of the customer entering the store, associates the video clip of the customer with the corresponding face icon, and provides a client device with a list of face icons with corresponding video clips.