First-party fraud: when the real customer is the fraudster
First-party fraud is fraud committed by the genuine account or card holder rather than a criminal using stolen details. Common forms are friendly fraud chargebacks, refund abuse, promotion abuse and applications with false information. It is hard to catch because identity checks pass; the signal is in behaviour and history.
Updated · RiskCogs team
Key facts
- In third-party fraud the victim is the cardholder; in first-party fraud the merchant or lender is the victim.
- Friendly fraud, a chargeback on a purchase the cardholder made, is the most common form in e-commerce.
- Identity and card checks usually pass, because the person is who they say they are.
- Evidence such as delivery confirmation, logins and usage logs matters most in disputes.
First-party versus third-party fraud
Third-party fraud uses someone else’s identity or card, so the warning signs are mismatches: new device, foreign IP, unfamiliar card. First-party fraud comes from a real customer on a familiar device, so those checks stay quiet. Detection has to look at patterns over time, such as repeated disputes, refunds or new accounts linked to the same person.
Signals of first-party fraud
- Several disputes or refund claims from one customer.
- New accounts linked by device, address or payment method.
- Promotions or bonuses claimed repeatedly through linked accounts.
- Usage or delivery evidence that contradicts a dispute reason.
- Large first orders followed quickly by a chargeback.
How to reduce it
- Use a clear billing descriptor so customers recognise the charge.
- Keep delivery, login and usage evidence for every order.
- Link accounts by device and payment method to catch multi-accounting.
- Score refund and promotion requests, not only payments.
- Respond to disputes with evidence and track repeat disputers.
How RiskCogs helps with first-party fraud
RiskCogs links events by device, account, card BIN and IP, so repeat disputers and linked accounts show up in the score and its reasons. Rules can flag customers with prior chargebacks or many linked accounts for review.
RiskCogs is a risk scoring layer next to your payment provider and does not process payments or handle disputes; it helps you decide which orders, refunds and bonuses deserve a closer look.
See what you would have blocked — free shadow modeFrequently asked questions
What is an example of first-party fraud?
A customer buys a product, receives it, and then tells their bank they never authorised the payment to get the money back. Other examples are claiming a parcel never arrived when it did, opening several accounts to collect a welcome bonus more than once, or lying on a credit application.
Is friendly fraud the same as first-party fraud?
Friendly fraud is one type of first-party fraud. It refers to chargebacks on purchases the cardholder actually made, sometimes deliberate and sometimes due to confusion. First-party fraud is the wider category and also includes refund abuse, promotion abuse and application fraud.
Why is first-party fraud hard to detect?
Because the person is genuine. Their card, device and address match, so identity-focused checks pass. Detection relies on history and links between accounts, such as repeated disputes, many accounts on one device, or delivery evidence that contradicts what the customer claims.
Sources and related reading
- Visa, Visa Core Rules and Visa Product and Service Rules (public edition).
- Mastercard, Chargeback Guide (public edition).
Measure first. Enforce when ready.
Run RiskCogs in shadow mode next to your existing payment setup and review the decisions before they affect a single customer.