First-Party Fraud: Definition, Types and How Merchants Fight It

First-party fraud is fraud committed by the real account holder, not by an outsider using stolen details. In ecommerce, it usually shows up as a chargeback on a purchase the cardholder made, received or used.

The hard part is that the buyer looks legitimate. The card, the name and often the device all match. That is why first-party fraud needs different evidence and different rules than stolen-card fraud.

{{cta}}

First-Party Fraud in Numbers

First-party fraud is now one of the biggest drivers of disputes, and both banks and card networks are reacting to it.

Sources: Mastercard first-party fraud research with Javelin and Datos Insights and the LexisNexis Risk Solutions Cybercrime Report (2024 data, published May 2025).

Mastercard says merchants and issuers traced about 20% of disputes to first-party fraud in 2025. Almost half of consumers (48%) admit they have disputed a charge that later turned out to be real. And 77% of merchants say disputing a transaction has become too easy.

What Is First-Party Fraud in Banking?

In banking, first-party fraud is when a real customer misuses their own account, credit line or consumer protections for gain. The Federal Reserve calls it authorized party fraud: fraud "committed deliberately by legitimate customers."

The customer is who they say they are. What they lie about is their intent or their actions. Common banking examples include:

• Bust-out schemes: a customer builds good credit, maxes out every line, then stops paying. Our guide to bust-out fraud covers the pattern in detail.
• False debit and P2P claims: the customer sends money or makes a debit purchase, then reports it as unauthorized under Regulation E to get a refund.
• Deposit and withdraw: the customer deposits a check or ACH transfer they know will bounce, then withdraws the funds before it returns.
• Loan stacking: the customer takes several loans at once, before lenders can see each other's credit checks, with no plan to repay.
• False card disputes: the cardholder tells the issuer a real purchase was fraud or never arrived.

That last one is where banking and ecommerce meet. When a cardholder files a false dispute, the issuer usually reverses the funds first and asks questions later. The merchant then gets a chargeback. Our explainer on what a chargeback is in banking walks through the issuer side.

First-Party Fraud vs Third-Party Fraud

The difference is who commits it. First-party fraud is done by the real account holder. Third-party fraud is done by an outsider who steals or fakes someone else's identity or card details.

That one difference changes the evidence that works. Against third-party fraud, you prove you checked the buyer. Against first-party fraud, you prove the buyer is the one who ordered, received and used the goods.

Some guides also name second-party fraud. That is when a real customer lets someone else use their identity or account, such as a money mule. For merchants, it usually looks like first-party fraud in the dispute data.

Types of First-Party Fraud Merchants See

Most first-party fraud reaches merchants as a dispute with a reason code that does not say "fraud" at all. The table maps each type to the claim, the codes it tends to use and the evidence that answers it.

1. Friendly fraud chargebacks: the cardholder claims a real purchase was unauthorized. Explore friendly fraud prevention for controls before fulfillment.
2. False "item not received" claims: the package arrived, but the buyer says it did not.
3. Refund and return abuse: wardrobing, empty-box returns and claiming a refund never posted. See refund abuse for warning signs.
4. Subscription "forgot to cancel" disputes: the customer used the service, then disputes the renewal instead of cancelling. Our guide to forgot-to-cancel chargebacks covers prevention.
5. Promo and coupon abuse: one person opens many accounts to reuse first-order discounts.
6. Organized refund schemes: paid services file false claims for buyers, also called digital shoplifting.

When a first-party claim is deliberate and repeated, it becomes chargeback fraud. Our guide on how merchants fight chargeback fraud covers blocklists and case files.

Is It Fraud or an Honest Mistake?

Not every first-party dispute is a lie. Mastercard lists three common causes: the buyer does not recognize the charge, someone else in the household made the purchase, or the buyer is unhappy with the service. Only some of those are fraud.

Use intent to decide your response, because the right fix differs for each:

• Confusion: the buyer does not recognize your billing descriptor. Fix the descriptor and send clear receipts. Fight with order details and proof of use.
• Household purchase: a family member used the card. Fight with device, account and delivery matches to past orders.
• Buyer's remorse: the customer wants a refund outside your policy. Fight with your accepted terms and proof of delivery.
• Deliberate abuse: the customer repeats the pattern or uses a refund service. Fight, keep a case file and block future orders.

The intent matters for your policy, but the evidence standard is the same. You must show that the cardholder authorized the order and got what they paid for.

How Visa and Mastercard Handle First-Party Fraud

Both networks now have rules that let merchants block false fraud claims with identity data. They work in a similar way but have different requirements.

• Visa Compelling Evidence 3.0 applies to Visa 10.4 card-absent fraud disputes. You show at least two earlier undisputed sales on the same card, made more than 120 and up to 365 days before the dispute. Two of four data points must match across all three sales: login ID, delivery address, device ID or IP address. One match must be the device or IP.
• Mastercard First-Party Trust applies to 4837 "no cardholder authorization" disputes on real purchases. You share one data point from each of three groups: device, delivery and extra identity. You can send it at authorization or during the dispute.

From October 24, 2026, Visa also lets the earlier sales come from other merchants, not only yours. That helps with first-time buyers at your store. Our Visa CE3.0 vs Mastercard First-Party Trust comparison covers the edge cases.

You can also stop some claims before they become chargebacks. Verifi Order Insight sends order details to the issuer while the cardholder is still asking about the charge. A confused buyer can drop the claim once they see what they bought.

How to Detect First-Party Fraud

You cannot catch first-party fraud at checkout the way you catch stolen cards. The buyer passes every identity check. Detection comes from patterns across orders and disputes.

One signal alone is not proof. Two or three together, on an account with past disputes, are strong grounds to fight and to review the customer.

Should You Fight a First-Party Fraud Chargeback?

Yes, in most cases, if you have the data. First-party disputes are often the most winnable, because you can prove the real cardholder placed and received the order. Fight when these are true:

• You can show the order was placed from a device, IP or account linked to the cardholder.
• You have tracking that shows delivery to the cardholder's address, or logs that show use of a digital product.
• The order value is higher than your cost to respond.
• The deadline still leaves time to build a full response.

Example (hypothetical): a $240 jacket is delivered to the buyer's home. Two weeks later, a Visa 10.4 fraud claim arrives. The order used the same device and IP as two undisputed orders from five and eight months ago. That meets the Visa CE3.0 test, so you can submit the data to block the claim.

Accepting can make sense for very low-value orders with no delivery proof, or where your own error caused the claim. A refund before the chargeback is often better than a lost dispute, since a lost dispute still counts toward your ratio.

Strong responses tie each piece of evidence to the reason code. Our guide to chargeback representment covers the process.

How to Prevent First-Party Fraud

You will not stop every false claim, but you can remove the easy ones and make the rest winnable.

• Use a clear billing descriptor: show a brand name the customer knows, plus a support URL or phone number.
• Send receipts and shipping updates: every email the buyer gets is proof they knew about the order.
• Make refunds and cancellations easy: a customer who can cancel in two clicks rarely calls the bank.
• Collect CE3.0 and First-Party Trust data: store IP, device ID, login and delivery address on every order.
• Require signature on high-value orders: it closes the "never arrived" route.
• Use pre-dispute alerts: alerts let you refund a claim before it counts as a chargeback.
• Flag repeat disputers: review or block accounts with a pattern of claims.

For a deeper look at tooling, see our guide to AI strategies for first-party fraud and the MRC webinar recap on first-party fraud.

Preguntas frecuentes

What is another name for first-party fraud?

First-party fraud is often called friendly fraud, first-party misuse or authorized party fraud. In card payments, friendly fraud usually means a cardholder disputing a real purchase. The Federal Reserve uses "authorized party fraud" for deliberate fraud by legitimate customers.

What is 1st and 3rd party fraud?

First-party fraud is fraud by the real account holder, such as disputing a purchase they made. Third-party fraud is fraud by an outsider who uses stolen or fake identity or card details. The first needs proof the cardholder ordered and received the goods, while the second needs proof you verified the buyer.

Is first-party fraud a crime?

Deliberate first-party fraud can be a crime, such as theft or fraud under state or federal law. Most cases never reach court, though. Banks and merchants usually handle them through the dispute process, account closures and blocklists. Honest mistakes, like not recognizing a charge, are not crimes.

How do banks detect first-party fraud?

Banks detect first-party fraud by looking for patterns in a customer's own history. Signals include fast credit build-up before a spending spike, deposits withdrawn before they clear, frequent disputes, and device or location data that contradicts a fraud claim. Card networks also give issuers merchant data through programs like Visa CE3.0.

What is first-party fraud on a credit card?

First-party fraud on a credit card is when the cardholder disputes a charge they really made or approved. Common claims are "I did not authorize this," "it never arrived" or "I cancelled." The issuer often credits the cardholder and sends the merchant a chargeback.

What is a common motivation for first-party fraud?

A common motivation for first-party fraud is getting a refund while keeping the goods or service. Others include avoiding a return trip, regretting a purchase, or hiding a purchase from a partner. Some cases start as honest confusion and only turn into fraud when the buyer keeps the refund.

Win First-Party Fraud Disputes With Evidence the Networks Accept

First-party fraud is a data problem. The buyer is real, so you win by proving they ordered, received and used what they paid for, in the format Visa and Mastercard accept.

Chargeflow Automation collects that evidence for every dispute, including device, IP and delivery data, and submits a response built for the reason code. You only pay when you win, and Chargeflow backs it with a 4X ROI guarantee.

{{cta}}