Nearly every fraud tool you own is built around one question: is the person placing this order the cardholder, or an imposter? Second-party fraud makes that question kinda unanswerable, though.
After all, the cardholder is real. The billing address matches. The account has eighteen months of clean purchase history and three prior orders that shipped without incident. Everything checks out, because there is nothing to check. The credentials weren’t stolen.
They were handed over willingly.
Sometimes it happens because the cardholder agrees to take a cut of the proceeds. Sometimes it happens because the account holder answered a job listing that turned out to be a recruitment pitch. Sometimes it happens because a criminal found someone in a bad enough spot to say “yes.”
The exact motivation doesn’t really matter. From where you sit, all those scenarios look identical. And, all three produce the same outcome: a clean transaction, a shipped product, and a chargeback filed weeks later under a criminal fraud reason code. It’s a claim that nobody in the payment chain can really disprove.
The bank can’t prove the cardholder was involved. You can’t prove it either. So the loss settles where it always settles when nobody can prove anything… which is with you.
This guide covers what second-party fraud actually is and how merchants keep misclassifying it, the schemes you’re most likely to encounter, and the signals that give it away in your own order data. I’ll outline what the losses really cost once you count the ratio damage, which prevention tools work against it and which ones only look like they do, and what your options are once a dispute has already landed.
[noun]/sek • ənd • pär • dē • frôd/
Second-party fraud refers to any fraud scheme in which a criminal commits fraud using another person’s identity, credentials, or account, with that person’s cooperation. Cooperation ranges from willing collusion to participation obtained through deception or coercion.
That word “cooperation” is doing a lot of work. It covers a wide range of activities that could all be classed as second-party fraud.
At one end of the spectrum sits a cardholder who hands over their card number knowing exactly what comes next; they’re a willing collaborator in a scheme. At the other end sits someone who might’ve responded to a work-from-home ad. He was told he’d be “processing payments,” and has no idea at all that he’s involved in committing a crime. Then, there are a lot of people in between, in the broad gray area.
Here’s the part that matters for you: from inside your order data, all those people are indistinguishable. You cannot determine intent from a transaction record, and for most merchant decisions you don’t need to. The operational question isn’t whether this customer is a criminal. It’s whether this account is being used by someone other than the person it belongs to.
Second-party fraud and friendly fraud are NOT the same.
Some sources use the terms interchangeably, including a few major payment providers. That’s not accurate. Friendly fraud falls under the first-party umbrella, because the cardholder acts alone. Second-party fraud requires a second person. The distinction changes which prevention tools work and how a dispute should be fought, which is why we spend a full chapter on it.
So, we’ve got first-, second-, and third-party fraud. They’re all distinct from one another. But what exactly distinguishes them?
We can sort fraud tactics into one of these three groupings by asking a few simple questions:
| First-Party | Second-Party | Third-Party | |
| Who commits the act? | The account holder | A criminal, using borrowed credentials | A criminal, using stolen credentials |
| Did the account holder consent? | Yes, the cardholder is the fraudster | Yes, in some form | No |
| Is there a consumer victim | No | Debatable, depending on how the surrogate was recruited | Yes, the account holder |
| How it reaches you | A dispute, usually claiming non-receipt or dissatisfaction | A dispute, usually claiming unauthorized use | A dispute claiming unauthorized use, or a fraud alert |
| Your best defense | Transaction records and delivery evidence | Device and relationship signals | Credential verification and authentication |
The fraudster is an authorized account or cardholder, working on their own to defraud a merchant.
First-party fraud is the account holder defrauding you directly. They made the purchase, received the goods, and then lied about it to get their money back. Nobody else is involved.
The account holder either commits fraud through a second party, or a secondary entity uses the account holder’s information for fraudulent activity.
Second-party fraud is a criminal using an account holder’s credentials with that person’s cooperation. Two people, one identity, and the cooperation is what distinguishes it from theft.
Fraud is committed by an outside party unaffiliated with the victim, using stolen personal information without the target’s knowledge.
Third-party fraud is a criminal using stolen credentials with no cooperation at all. The account holder is a genuine victim who had no idea until the statement arrived.
This is the mix-up worth addressing head-on, because it appears in material published by payment processors, fraud vendors, and glossaries that merchants reasonably trust. At least one major processor’s educational content states outright that second-party fraud is “sometimes referred to as friendly fraud.”
It isn’t. There’s a major difference between the two.
Friendly fraud describes a cardholder who files a dispute over a transaction they authorized. Maybe they forgot the purchase. Maybe a family member used the card. Maybe they decided a dispute was faster than a return. The defining feature is that the cardholder is the one who placed the order, which puts friendly fraud squarely inside the “first party” category.
Second-party fraud requires a second person who actually commits the fraudulent act. The account holder’s role is to provide access and, usually, to file the dispute. They are not the buyer. The distinction is relevant because it dictates how you can protect yourself:
With friendly fraud, your evidence tends to point at the cardholder. Matching device fingerprints, delivery to a verified address on file, account login records, prior undisputed orders from the same profile. In second-party cases, that same evidence works against you because the order genuinely did come from somewhere else. Building a friendly fraud rebuttal around evidence that contradicts your own position is a reliable way to lose.
Friendly fraud responds to clear billing descriptors, accessible customer service, straightforward returns, and order confirmation records. None of that helps against second-party fraud, where the cardholder knows exactly what the charge is and intends to dispute it regardless.
A friendly fraud customer may be a good customer having a bad month, and many merchants reasonably choose to absorb the loss and keep the relationship. A second-party surrogate’s account is compromised in a way that tends to repeat, and treating it as a one-off usually means seeing it again.
With third-party fraud, credentials were stolen. Maybe through a data breach, a phishing campaign, or an account takeover. The account holder is a victim with no involvement and no benefit. In second-party fraud, credentials were given. No theft occurred, and the account holder benefits.
You usually can’t tell them apart with certainty at the transaction level. The patterns differ a bit in aggregate, though.
Third-party fraud tends to cluster: a stolen card batch gets worked through quickly, often across many merchants in a compressed window, frequently preceded by small test transactions. Second-party fraud tends to be slower and more isolated, with a single order on an otherwise quiet account and no testing activity beforehand.
Repeat behavior is the other distinguishing signal. A genuine third-party victim closes the compromised account, gets a new card, and the problem ends. An account used for second-party fraud often resurfaces, sometimes with a new card number but the same name, address, or device cluster.
The taxonomy is a useful model; not a law of nature. Some situations don’t always sort cleanly into one camp or another. For example:
A child uses a parent’s stored card for in-app purchases, or on a gaming platform like Steam. There’s no criminal intent anywhere, but there is technically a “second party” in the fraud sense, even if the parent was unaware at the time of purchase. The dispute arrives under a fraud reason code all the same.
Household accounts with multiple legitimate users produce device and location variance that looks exactly like a second-party signal. This is a meaningful source of false positives, and any detection rule built on device mismatch needs to account for it.
A surrogate who cooperated at first, then panicked and reported the transaction as fraud for real. Technically second-party, but the dispute is now being reported as sincere third-party fraud.
These edge cases are a decent argument for not over-investing in classification at the individual transaction level. The categories are most useful in aggregate, for choosing which tools to deploy and where to focus. For any one dispute, your evidence matters more than your label.
Exposure varies a lot. Three factors will basically determine your level of exposure: how quickly value can be extracted, how easily the product converts to cash, and how much promotional budget is available to abuse.
Merchants with specific product categories and business models tend to be at much higher risk than others:
Every second-party fraud scheme needs two people: the criminal who plans it, and the account holder whose identity makes it possible. That separation is the entire point, because it means the fraudster never touches a stolen credential and the account holder never appears to do anything unusual. By the time the loss surfaces, there is no stolen card to trace and no imposter to identify.
This chapter breaks down the two roles, follows how the money and merchandise actually move, and explains the specific reason this structure walks through conventional fraud screening untouched.
Read MoreSecond-party fraud isn’t a single scheme. It’s a structure that several different tactics share, and the ones you encounter depend heavily on what you sell.
Some tactics target you directly through the chargeback process. In others, your store is a step in a laundering chain, where the product is incidental and the transaction itself is the goal. This chapter catalogs what merchants actually run into, including the schemes where you’re the target and the ones where you’re just the vehicle.
Read MoreNo single transaction in a second-party fraud scheme looks wrong, which is precisely the difficulty. The signals live in the relationships between data points, rather than in any one of them. It could be a device that doesn’t match the account’s history, a shipping address that keeps turning up across unrelated customers, or a buying pattern that changes overnight.
This chapter covers what to watch at the order level, the account level, and across your whole customer base. It’s also honest about which signals are reliable and which will cost you good orders.
Read MoreWho pays for second-party fraud? The short answer is “you.”
Second-party fraud reaches you as a chargeback filed under a fraud reason code, and because the cardholder’s own identity checks out cleanly, nobody in the payment chain has the evidence to push the loss anywhere else. The cost runs well past the transaction value once you add the merchandise, the fee, the labor, and a fraud-coded dispute that counts against your fraud-to-transaction ratio.
This chapter traces where the money goes, and explains why the one tool most merchants count on for liability protection doesn’t reliably protect them here.
Read MoreSecond-party fraud chargebacks arrive coded as criminal fraud, which is the hardest category to win. Hard is not the same as hopeless, though. Whether to fight comes down to what your evidence can actually establish about who was holding the device.
This chapter covers what compelling evidence looks like in these specific cases, where representment realistically succeeds, when accepting the loss is the better business decision, and what to do about the account afterward regardless of how the dispute lands.
Read MoreSecond-party fraud chargebacks arrive coded as criminal fraud, which is the hardest category to win. Hard is not the same as hopeless, though. Whether to fight comes down to what your evidence can actually establish about who was holding the device.
This chapter covers what compelling evidence looks like in these specific cases, where representment realistically succeeds, when accepting the loss is the better business decision, and what to do about the account afterward regardless of how the dispute lands.
Read MoreSecond-party fraud is any scheme in which a criminal uses another person’s identity, credentials, or account to commit fraud, with that person’s cooperation. The account holder may be a willing accomplice splitting the proceeds, or may have been recruited under false pretenses. Either way, the transaction uses real credentials belonging to a real person, which is what makes it so difficult to detect.
No, though the terms are frequently confused. Friendly fraud is committed by the cardholder acting alone, which places it under first-party fraud. Second-party fraud requires two people: the criminal who commits the fraud and the account holder who provided access. The distinction matters because the two call for different prevention tools and different dispute strategies.
The main difference between first-party and second-party fraud is the number of people involved. First-party fraud is the account holder acting alone. Second-party fraud requires a second person who commits the fraudulent act using the account holder’s credentials with their cooperation.
A common version works like this. A cardholder provides their card details to a fraudster, who places an order from a device and location unconnected to the cardholder. The merchandise ships to the fraudster. The cardholder then contacts their bank, reports the transaction as unauthorized, and receives a refund. The two split the proceeds, and the merchant absorbs both the lost product and the chargeback.
The merchant is responsible in almost all cases. These disputes arrive under fraud reason codes, and because the cardholder’s identity and account history are legitimate, there is rarely evidence that would shift liability to the issuer. Even 3-D Secure offers limited protection, since a cooperating cardholder can complete the authentication challenge themselves.
Sometimes, but not through conventional credential checks. AVS, CVV, and billing verification all pass, because the credentials are real. Detection depends instead on device and behavioral signals, and on link analysis that connects accounts sharing devices, addresses, or payment instruments. Those methods catch some attempts, but not all.
Technically speaking, yes. Knowingly allowing another person to use your identity, credentials, or bank account to commit fraud is a crime in the United States, and prosecutions of money mules are common. People recruited through fake job offers are sometimes treated as victims, but that is a prosecutorial decision; not a guarantee. “I didn’t know it was illegal” is not a reliable defense.
At minimum two: the fraudster who commits the act and the account holder whose credentials make it possible. Organized schemes involve more, including recruiters who source surrogates and intermediaries who handle merchandise or move funds.
The second-party chargeback scam, where a cardholder provides their details to a fraudster and then disputes the resulting transaction as unauthorized. It’s the most common because it converts directly to cash and is extremely difficult for merchants to rebut.
Promotional abuse, referral fraud, free trial cycling, and collusive returns are all common, too. But, these schemes often get misclassified as marketing or returns problems rather than fraud.
A device and location that don’t match an established account’s history, on an order that also departs from that account’s normal buying pattern. Neither element alone is reliable; together, on an account with consistent prior behavior, they’re meaningful.
Score signals rather than gating on them, act only when several independent flags converge on the same order, scale scrutiny to order value, and prefer step-up authentication over outright decline. Then measure which flagged orders actually became disputes, and retune accordingly.
The merchant, in nearly all cases. The dispute arrives as an unauthorized-use claim with legitimate credentials behind it, which gives the issuer no basis to absorb the loss and gives the merchant no evidence to shift it.
