How Does Second-Party Fraud Work?Two People, One Identity, and a Transaction You Can't Flag
In a Nutshell
Second-party fraud works by splitting a single crime across two people, so that neither one individually looks like a criminal. The account holder supplies legitimate credentials and never places an order; the fraudster places the order and never touches a stolen card. This chapter walks through the roles, the money flow, and the structural reason conventional fraud tools can't catch it.
How Does Second-Party Fraud Work? There’s a Two-Role Structure to it.
Every second-party fraud scheme has an instigator and a surrogate.
The instigator is the criminal. They plan the scheme, place the orders, receive the merchandise or the funds, and move on to the next account holder when this one is used up. They never provide their own identity to anyone.
The surrogate is the account holder. They supply a real name, a real address, a real payment credential, and sometimes a real bank account. In the pure version of the scheme, they never place an order at all. Their only actions are providing access at the start and, often, filing a dispute at the end.
Second-Party Fraud
Second-party fraud hides a criminal behind a real cardholder’s identity. Learn how the schemes work, what they cost you, and how to spot them in your data.
Segmentation is the Whole Point
Because signals like device, shipping address, purchase history, etc., do not match the cardholder, second-party fraud is much more difficult to prove than first-party fraud.
Neither the instigator or the surrogate generate the kind of signals that fraud systems are built to pick up on. The former presents credentials that are genuine, so they pass every verification check. The latter appears to be a victim of unauthorized use, from the bank’s perspective.
This is what separates second-party fraud from an ordinary stolen-card transaction. In a stolen-card case, there’s a real victim whose account was compromised, and that compromise usually leaves traces: a credential appearing on a card testing run, a shipping address that doesn’t match anything in the account history, a purchase that doesn’t make sense given the customer’s past transactions. In second-party fraud, there was no compromise. Nothing was breached because nothing needed to be.
Consider what happens when one person tries to run this scheme alone. They buy something with their own card, keep the product, and file a dispute claiming they never authorized it. That’s friendly fraud, and while it’s hard to pick up on, it at least leaves fingerprints. The order came from the buyer’s usual device. It shipped to their usual address. Their purchase history shows a pattern that looks nothing like a criminal’s. A merchant with decent records has a reasonable chance of winning that dispute at representment.
Now split the roles. The order comes from a device the cardholder has never used, in a city they’ve never visited, shipped to an address with no connection to them. Every piece of evidence a merchant would normally use to prove the cardholder made the purchase now proves the opposite.
The fraud requires more forethought and planning, because the scammer has to recruit a partner. But it’s dramatically harder to disprove.
Example of a Typical Second-Party Fraud Workflow
The specific mechanics vary by scheme, but the underlying flow is consistent. Something of value leaves your business and ends up with the instigator, while the surrogate gets reimbursed by their bank and keeps a cut.
In the most common merchant-facing version, it runs in four steps.
The surrogate acts only twice: at the start and at the end.
- Step 1The surrogate provides their card details, or in some cases their full account login, to the instigator.
- Step 2The instigator places an order from their own device and network, shipping to an address they control. A drop address, a vacant property, a reshipping service, or in the case of digital goods, nowhere at all.
- Step 3You fulfill the order. Everything about it looked normal, because by every measure available to you, it was.
- Step 4Days or weeks later, the surrogate contacts their bank and reports the charge as unauthorized. The bank issues a provisional credit and files a chargeback. The surrogate has their money back. The instigator has the product. The merchant has neither.
- SurrogateHas their money back
- InstigatorHas the product
- YouHave neither
The split happens offline, in whatever proportion the two parties agreed to. You never see it and neither does the bank.
For digital goods and services, the cycle compresses considerably. There’s no shipping address to arrange and no delivery window to wait through, which is why subscription services, gaming platforms, digital gift cards, and software licenses see disproportionate exposure. The instigator can extract value within minutes of getting the credentials.
Why Conventional Fraud Prevention Tools Can’t Detect Second-Party Fraud
Conventional antifraud tools like AVS, CVV verification, velocity limits, etc., have no impact on second-party fraud. Device intelligence is the only conventional tool that may help.
Most fraud prevention tools are built to answer one question: do these credentials belong to the person using them?
Second-party fraud makes that question meaningless, because the answer is yes, and it's still fraud. Let’s run through what a typical screening stack actually checks:
- Address Verification Service: AVS compares the billing address on the order to the address the issuer has on file. In a second-party scheme, those match, because the surrogate supplied their real billing address.
- CVV Verification: This confirms the person placing the order is holding the physical card or has its full details. The surrogate gave those details over willingly.
- Email & Phone Verification: Both confirm the contact details belong to a real person with history. They do, meaning there’s no fraud signal.
- Purchase History: Checking for thin, brand-new profiles that signal a throwaway account won’t do anything. The surrogate's account may be years old with a clean record of legitimate purchases.
- Velocity Limits: These rules flag unusual bursts of activity. A single order on an established account doesn’t trip them.
Device intelligence is the exception. The instigator is using their own hardware. Their own browser, operating system, WiFi, typing cadence and mouse behavior.
If you know what device your customer has historically ordered from, a sudden switch to an unfamiliar device, in an unfamiliar location, on an account that has been consistent for months, is a genuine anomaly. It’s not conclusive on its own. People buy new phones. They travel, and they place orders from work computers. But, device intelligence is one of the only “red flags” you’re going to get.
How Do Second-Party Fraud Instigators Find Surrogates?
Organized second-party fraud operations run through fraud rings that recruit at scale and cycle through surrogates systematically, abandoning each one before the pattern becomes obvious to their bank. Related activity shows up in straw purchasing and in the overlap between fraud and money laundering, which the industry calls FRAML.
But, how do scammers recruit surrogates to work with in the first place? There are a few tactics they can use here:
