I don't see anything wrong with either one, altho I tend toward the first one. (In fact, what I might do would be to define a populated return hash first, then modify it as necessary -- kind of like the 2nd example -- but within the if...return structure of the first example). If I had to defend this, I'd point out:

• It's simpler and perhaps more clear.
• It's probably more efficient.