Triangulation Fraud

Triangulation fraud is a type of online payment fraud involving three parties: a fraudster, an unsuspecting buyer and a legitimate merchant. The fraudster advertises goods at attractive prices, often on a marketplace or a fake web shop, and collects payment from real buyers. They then buy the same goods from a genuine retailer using stolen card details and have them delivered straight to the buyers. The buyer receives the item and is satisfied, the fraudster keeps the buyer's money, and the retailer is left with a chargeback when the real cardholder notices the charge.

The scheme is a form of third-party fraud, since the cardholder whose details were stolen did not take part. It is harder to detect than ordinary card-not-present fraud because the goods go to a real person at a real address who expects them, so the usual warning signs of reshipping or drop addresses are absent.

A typical scheme follows a sequence:

1. The fraudster sets up listings on a marketplace or builds a storefront, offering popular goods such as electronics, cosmetics or branded clothing at a discount.
2. A genuine buyer places an order and pays the fraudster, usually through the marketplace's payment system or another method that the fraudster can cash out.
3. The fraudster places an order for the same item with a legitimate online retailer, entering the buyer's name and delivery address but paying with a stolen card.
4. The retailer, seeing an authorised payment, ships the goods to the buyer.
5. Weeks later the real cardholder disputes the charge as unauthorised, and the retailer loses both the goods and the payment, plus a chargeback fee.

The fraudster profits twice over in effect: they receive the buyer's money and spend nothing of their own. The structure resembles drop shipping, which is a legitimate model when the reseller pays the supplier honestly, and this similarity helps the fraud blend in.

The cardholder is usually reimbursed through the dispute process. The legitimate retailer generally bears the loss, because card-not-present transactions without strong authentication leave fraud liability with the merchant. Repeated cases raise the retailer's chargeback ratio and can push it towards scheme monitoring programmes. The buyer may also be harmed later if the marketplace or payment provider reverses their payment, or if their personal details are reused by the fraudster. The marketplace suffers reputational damage and may have to refund buyers if the scheme is exposed before delivery.

Because the goods go to a real person, merchants look for subtler signals:

• Mismatched details. The billing address, card country, IP address and delivery address do not fit together, and the email address or phone number does not match the delivery name.
• Many cards, many recipients. One device, account or IP address places orders with different cards for different delivery names and addresses.
• Unusual buying patterns. Repeated orders for the same popular items, often at full price, from accounts with no history.
• Marketplace clues. Order notes or gift messages that reference a third-party marketplace, or buyers contacting the retailer about an order they believe they placed elsewhere.

Retailers combine several controls. Address verification and CVV checks confirm that the person paying knows the cardholder's details, though stolen data often includes both. Authentication through 3-D Secure asks the real cardholder to approve the payment and, if passed, generally shifts fraud liability to the issuer. Device fingerprinting and linking analysis connect orders made from the same device or network with different identities. Machine learning fraud screening scores each order and flags patterns associated with the scheme.

Marketplaces work from the other side, monitoring sellers whose prices are far below market, whose fulfilment comes from third-party retailers and whose buyers receive packages from a different company. Cooperation between retailers, marketplaces and card issuers, including the sharing of confirmed fraud data, is often what finally exposes a triangulation ring, since each party sees only part of the picture. Some retailers also contact the delivery recipient directly when an order looks suspicious, which can reveal that the buyer paid someone else.

Triangulation fraud sits between several better-known schemes. It relies on stolen card data from breaches, phishing or card testing, it uses marketplaces in the same way as some merchant fraud, and it can involve money mules to cash out the buyers' payments. It is distinct from friendly fraud, in which the genuine cardholder makes a purchase and then disputes it.