Third-Party Fraud

Third-party fraud is fraud carried out by a person who is not the genuine customer, cardholder or account holder, and who has no right to use the account or identity involved. The criminal uses stolen card numbers, hijacked login details, a stolen identity or a fabricated one to make payments, open accounts or take out credit. Banks, card issuers, merchants and payment firms use the term to classify losses and decide who bears them.

The category is defined by contrast. In first-party fraud the real customer is the wrongdoer, for example by lying on an application or disputing a purchase they made. In third-party fraud the customer is a victim. The distinction matters for liability, for the reason codes used in disputes and for reporting to industry bodies, and it sits alongside a growing category of scams in which the genuine customer is tricked into making the payment themselves.

Third-party fraud covers a wide range of methods. The most common in payments are:

• Card fraud. Use of stolen card details for card-not-present purchases online, or of lost, stolen or counterfeit cards in shops. Details are often bought on the dark web after a data breach.
• Account takeover. The criminal gains control of an existing bank, wallet or merchant account through phishing, malware or credential stuffing, then changes contact details and moves money out. See account takeover (ATO).
• Identity theft and new-account fraud. A real person's details are used to open accounts or obtain loans in their name. This is covered under identity theft.
• Synthetic identities. Real and invented data are combined to create a person who does not exist. Some firms classify synthetic identity fraud separately because there is no single identifiable victim.
• Unauthorised transfers. Payments sent from a victim's account without their knowledge, for example through a compromised banking session.

Industry reporting usually separates unauthorised fraud, where the account holder did not give permission, from authorised fraud, where the account holder was manipulated into sending money. Authorised push payment (APP) fraud is the main example of the second group: the victim pays a criminal directly, believing they are paying a supplier, an investment or a family member. Because the victim authorised the payment, many legal regimes treat these cases differently from classic third-party fraud, although the criminal is still an outsider. The difference shapes refund rights, since consumer protection for unauthorised transactions is generally stronger than for authorised ones.

Liability depends on the payment method and the jurisdiction. For card payments, the cardholder can usually dispute an unauthorised transaction through a chargeback, which moves the loss to the merchant or the issuer depending on the card scheme rules. Where a merchant uses strong authentication such as 3-D Secure, liability for a fraudulent online transaction generally shifts to the issuer. For bank transfers, rules in the EU and UK require payment service providers to refund unauthorised transactions promptly unless the customer acted fraudulently or with gross negligence. Lenders that open accounts or grant credit to an impostor usually absorb the loss themselves and must repair the victim's credit record.

Firms fight third-party fraud by checking that the person behind a transaction is the genuine customer. Controls include:

• Authentication. One-time passcodes, biometrics, passkeys and strong customer authentication make stolen credentials less useful.
• Device and behaviour signals. Device fingerprinting, location data and typing or navigation patterns help spot a session that does not belong to the usual user.
• Real-time scoring. Machine learning models produce a transaction risk score that decides whether to approve, decline or challenge a payment.
• Identity verification at onboarding. Document checks, liveness tests and database matching reduce the use of stolen or synthetic identities.

Fraud teams also share intelligence through industry databases and consortium data, since the same stolen identities and mule accounts are often used against several firms. A wider overview of controls is given under fraud prevention.

Banks and payment firms track third-party fraud as a separate loss line so they can measure the effect of controls and set reserves. Common measures include the value of fraud as a share of sales and the fraud loss rate. Card schemes monitor merchants and acquirers whose reported fraud exceeds set levels, and national bodies such as UK Finance publish annual figures broken down into unauthorised fraud and authorised scams. Accurate classification is important: a dispute wrongly treated as third-party fraud when the customer actually made the purchase (sometimes called friendly fraud) distorts the figures and can lead to unfair losses for merchants.