Fraud sources and tactics are extremely dynamic and ever evolving. One must avoid thinking about fraud in flat or reductive terms. To that end, we can generally segment threat sources into one of three basic camps: first-party, second-party, and third-party fraud.

In this post, we’ll run down each of these three concepts and examine the tactics that fall under these mantles. We’ll profile the perpetrators behind these scams and explore the commonalities and differences between tactics. Finally, we’ll offer practical advice to best manage threats originating from each source.

What is Third-Party Fraud?

When people envision “fraud,” they’re usually thinking about third-party fraud. 

This can be described as any criminal activity by which the perpetrator masquerades as another individual or institution. This is done without the consent or awareness of the targeted party. Identity theft, phishing, and account takeover are all tactics used to facilitate third-party fraud.

This fraudulent activity often surfaces in the retail sector, where offenders camouflage themselves using false identities. This may involve impostors who convincingly imitate real cardholders. Due to the sharp rise in digital payments, it is increasingly difficult to identify or block culprits from committing fraud. Some scammers even go as far as to create entirely fabricated profiles, known as “new account fraud.” For example, a fraudster could adopt a false identity to create a new payment or store card account to receive new credit or debit cards.

What is Second-Party Fraud?

Second-party attacks are a bit more complex than third-party incidents, and can be very difficult to identify due to the dichotomy of its origin. Second-party fraud can emanate from error-prone rules at a financial institution that unintentionally trigger fraud notifications, but it can also be defined as a scheme by which a person willingly permits another individual to exploit their personal information or identity to pose as a legitimate user, where the purpose is to scam the merchant.  A participating card-holder or consumer is the underlying common denominator.

The most malicious type of second-party fraud falls into two categories: collusion and bandwagon. Collusion involves an individual who knowingly gives their card to another person, such as a friend or relative, with the intent  to shoplift through exploiting the chargeback system (colluding to purchase goods and services that are later refunded but not returned through filing chargebacks). Bandwagon fraud involves a person of influence—typically a celebrity or social media influencer—recommending a product or service. After their followers believe the hype and make the recommended purchase, the influencer discredits that product or service, sometimes recommending transaction disputes, leading to a slew of chargebacks on the original purchase.

Just like third-party fraud, this threat source has several illegal variations, including:

• Second-party chargeback scams
• Fake customer scams
• Money muling
• Gift card laundering

Because second-party scams involve the benefit to an authorised user, they are much harder to detect than third-party fraud. 

What is First-Party Fraud?

First-party fraud could take several forms.

It may happen when an individual makes a purchase, but has no true intent to actually pay for the goods. For example, applying for a loan with no intention of repayment, or lodging a baseless claim with the bank and requesting a chargeback. However, first-party fraud could also be accidental; for instance, a buyer sees an authorised charge on their statement, but can't recognize it, so they report it as unauthorised.

In simple terms, a first-party fraud attack denotes any deceptive practice initiated by the customer, rather than by a third-party fraudster (deliberate or accidental).

It's worth noting that first-party fraud is unique from third-party fraud because the deceit lies in the falsified allegation, rather than in the transaction itself. It’s post-transaction fraud because the transaction appears legitimate up until the point at which the perpetrator declares otherwise. Friendly fraud, refund fraud, empathy fraud and wardrobing are all examples of this.

How Each Threat Source Stacks Up

No threat source is inherently “better” than another. That said, first- and second-party fraud are generally much more difficult to spot and recover from than third-party fraud.

The reason for this is simple. You can often detect and reject a potentially fraudulent credit card transaction before it happens using conventional fraud detection tools. However, the same cannot be said for any act of post-transactional fraud. 

Criminal third-party fraud is certainly nothing to ignore. That said, merchants must be prepared to respond to second- and first-party fraud, now more than ever before. How should one go about this, though?

For retail merchants, the best solution is to develop and build out a long-term approach that accounts for all threat sources, and which is responsive to new and developing threats. This is what’s meant when we talk about “multilayer” fraud detection.

The Future of Fraud Detection is Multilayered

Even with the best strategy in the world, your business will still be susceptible to fraud. This is why you should prioritise building out a multilayer solution for fraud detection. Only by deploying multiple tools as part of a broader strategy can you hope to intercept and eliminate every first, second, and third-party threat source.

A multilayered fraud solution involves:

• Understanding the Issue: Recognizing the differences between first-party, second-party, and third-party fraud, and identifying specific threats to your business originating from each.
• Spotting Bad Transactions: Gathering evidence, restricting user access, and informing the bank promptly if fraud is confirmed.
• Implementing Solutions: Historical data analysis of disputes could help block suspicious activities and build stronger cases for revenue recovery.
• Investigate Every Chargeback: Be sure to proactively respond to every case, even if it’s to inform your bank that the chargeback occurred due to merchant error. Providing feedback establishes a reliable communication with issuing banks and helps to accurately identify new trends in friendly fraud.
• Refining Over Time: Regular evaluation of your anti-fraud solutions helps determine what works (and what doesn't work).