Skip to main content

Third-Party Fraud

TL;DR
  • Third-party fraud = Somebody who was never given access is using the card or identity
  • It was taken, not handed over. Stolen data, a breached account, a hijacked login
  • If the owner handed it over, however they were persuaded, that's second party instead
  • The cardholder is the victim. They didn't authorize anything
  • Different from first-party fraud, which includes friendly fraud (the cardholder lying about a charge they made)
  • Definitions vary across the industry. See why they don't match
  • Detect via device signals, address mismatches, velocity patterns
  • Prevent with 3D Secure, AVS/CVV, device fingerprinting
  • Get liability shift with 3DS. Otherwise you eat the loss

When a criminal uses someone else's stolen payment credentials at your store.

Definition​

Third-party fraud occurs when somebody who was never given access uses a card or identity. It was taken, not handed over. Stolen card data, a breached account, a hijacked login.

If the cardholder handed their details over, even after being deceived, that's second-party fraud instead. The difference is whether a handover happened at all.

Your Liability

Without 3D Secure, you bear the loss when the cardholder disputes. The card was stolen, the cardholder is innocent, and you shipped goods to a fraudster.

How Stolen Cards Reach You​

Where Fraudsters Get Card Data​

SourceWhat's Stolen
Data breachesCard numbers, CVVs, billing addresses
PhishingFull card details, passwords
SkimmingMag stripe data (card-present)
Account takeoverSaved cards in compromised accounts
Card testingValidated stolen cards
Dark web marketsBulk card data for sale

Why Your Business Is Targeted​

FactorWhy Fraudsters Like It
Digital goodsInstant delivery, no shipping address
High-value itemsElectronics, jewelry, gift cards
Easy resalePopular brands, liquid markets
Weak fraud controlsNo 3DS, no velocity limits
Fast shippingLess time for detection

Detection Signals​

High-Risk Indicators​

Use these in your risk scoring:

SignalRisk LevelWhy
Shipping ≠ billing addressMediumFraudster's address vs. victim's
AVS mismatchMedium-HighWrong billing address
CVV mismatchHighCard not physically present
New account + high-value orderHighCreated just for fraud
Device seen on prior fraudCriticalKnown fraudster device
IP location ≠ billing countryMediumGeographic mismatch
Multiple cards same deviceHighCycling through stolen cards
Rush shipping selectedMediumWants goods before detection

Velocity Red Flags​

PatternWhat It Means
Multiple orders, different cards, same addressDrop address
Multiple orders, same card, different addressesTesting before big purchase
Multiple failed transactions, then successCard testing
High-value order from new accountNew account fraud

Prevention Strategies​

1. Use 3D Secure​

This is the most important defense. 3D Secure shifts liability to the issuer for fraud disputes.

Without 3DSWith 3DS
You eat fraud lossesIssuer covers fraud losses
Win rate: 15-25%Liability shift: ~100%
Fraudsters target youFraudsters avoid you

See 3DS implementation guide for setup.

2. Verify Address and CVV​

CheckWhat to Do
AVSRequire match on street number + zip
CVVAlways require, decline on mismatch
Shipping addressFlag if different from billing

3. Device Intelligence​

Device fingerprinting catches:

  • Devices linked to prior fraud
  • VPN/proxy usage (hiding location)
  • Device age (just created = suspicious)
  • Multiple accounts same device

4. Velocity Controls​

Set limits on:

  • Orders per hour/day from same device
  • Cards used per account
  • Failed authorization attempts
  • Orders to same shipping address

High-Risk Scenarios​

Shipping to Drop Addresses​

Fraudsters use:

  • Rented mailboxes
  • Vacant homes
  • Package forwarding services
  • "Reshipping mule" addresses (recruited victims)

Detection: Address was never associated with the cardholder.

Digital Goods Fraud​

Highest risk because:

  • Instant delivery (no time to detect)
  • No shipping address to verify
  • No tracking or signature
  • Easy resale (gift cards, game codes)

Prevention: Higher 3DS trigger thresholds for digital goods.

Gift Card Fraud​

Gift cards are "as good as cash":

  • Can be resold instantly
  • Untraceable once used
  • Often targets of card testing

Prevention: Limit quantities, require 3DS, delay delivery.

Responding to Third-Party Fraud​

When You Catch It Before Shipping​

  1. Cancel the order - Don't ship
  2. Refund if captured - Avoid chargeback
  3. Blacklist device/email - Prevent retry
  4. No customer contact - Fraudster will lie

When Cardholder Disputes​

Without 3DS, your options are limited:

SituationWhat to Do
Goods not yet shippedAccept dispute, no fight
Digital goods deliveredFight with IP/device evidence (low win rate)
Physical goods deliveredFight with tracking + signature (still low win rate)
3DS was usedLiability shift: issuer covers
Key Insight

With true third-party fraud, the cardholder really IS innocent. Fighting these disputes is often futile unless you have 3DS liability shift. Focus your energy on prevention.

Fighting Third-Party Chargebacks​

If you must fight (and you have evidence):

EvidenceWhat It Proves
3DS authenticationLiability shift (fight ends)
CE 3.0 device matchSame device as prior undisputed order
Signed delivery confirmationSomeone at address received it
IP + device consistencyLegitimate usage pattern

Realistic win rates without 3DS: 15-25%

See Compelling Evidence for details.

Prevention Checklist​

  • 3D Secure enabled on all transactions (or risk-based)
  • AVS verification required
  • CVV required, decline on mismatch
  • Device fingerprinting active
  • Velocity limits configured
  • High-risk products (gift cards, electronics) have extra scrutiny
  • Digital goods have higher friction
  • Address verification flags ship ≠ bill

Next Steps​

Preventing third-party fraud?

  1. Implement 3DS - Get liability shift
  2. Add device fingerprinting - Track fraudster devices
  3. Configure velocity rules - Catch patterns

Detecting third-party fraud?

  1. Review AVS/CVV settings - Baseline protection
  2. Check risk scoring - Combine signals
  3. Set up alerts - Real-time detection

Fighting third-party chargebacks?

  1. Check 3DS liability - Were you protected?
  2. Review CE 3.0 evidence - What can you prove?
  3. Accept if true fraud - Focus on prevention
Last updated on