First-Party Fraud Guide: Friendly Fraud to Bust-Out

First-party fraud is committed by the genuine customer, under their own identity, which is why controls built to catch impostors rarely see it. It covers customers who dispute purchases they made, report losses that did not happen, borrow with no intention of repaying, misstate facts on applications, or lend their accounts to move criminal money. In the UK, Cifas recorded 106,497 misuse of facility cases in 2025, up 43% on the year, and "falsely reporting a loss" on bank accounts rose 189%. This guide sets out a working taxonomy, how first-party fraud differs from third-party fraud in detection, evidence and treatment, the controls and signals that work, dispute defence for merchants, a rollout plan and metrics. It is written for fraud strategy, credit risk, disputes and payments teams in banks, lenders, fintechs and e-commerce.

Key takeaways

The identity is real, so identity checks pass. Detection has to rely on behaviour, history and evidence of intent, not on whether the person is who they say they are.
Classify by who initiated the payment. The US Federal Reserve FraudClassifier model starts with that question; getting it right separates first-party fraud from account takeover, scams and genuine errors.
Treatment is different. There is no innocent account holder to reimburse; the options are decline, recover, close, report to a shared fraud database or refer to law enforcement, each with a higher evidence bar than a credit loss.
Merchants can now win more disputes with history. Visa Compelling Evidence 3.0 lets a merchant answer a fraud dispute under reason code 10.4 with two prior undisputed transactions that share device, IP or account data.
Protect genuine customers' rights. Consumer protection rules such as US Regulation E set dispute timelines and provisional credit duties; suspicion of first-party fraud does not suspend them.

What counts as first-party fraud

Definitions vary by sector, so agree one internally before measuring. A practical taxonomy:

Type	What happens	Typical sector	Often mislabelled as
Friendly fraud or chargeback abuse	Customer disputes a legitimate purchase they made or authorised	E-commerce, digital goods, subscriptions	Third-party card fraud
False loss or non-receipt claims	Customer reports goods, a card or funds as lost, stolen or not received when they were not	Retail, banking	Delivery failure, account takeover
Misuse of facility	Account holder uses an account for fraud, for example payment evasion, cheque or direct debit abuse, or receiving criminal funds	Banking, telecoms, lending	Bad debt
Money mule activity	Account holder lets their account be used to receive and move proceeds of crime	Banking, fintech	Scam victim
False or misleading application	Real person misstates income, employment, address history or other facts to obtain a product	Lending, insurance, telecoms	Credit risk
Bust-out	Customer builds a good history, maximises credit across products, then stops paying	Credit cards, buy now pay later	Credit loss
False scam claims	Customer claims to have been scammed to obtain reimbursement for a payment they made knowingly	Banking	Authorised push payment fraud
Refund and returns abuse	Customer keeps goods and obtains a refund under a false claim	Retail	Customer service cost

Cifas's Fraudscape 2026 report shows the scale in UK filings to the National Fraud Database for the 12 months to December 2025: 444,993 cases in total, a record; misuse of facility was the second largest category behind identity fraud, with bank accounts making up 82% of those filings; more than 22,000 cases were filed under the new "Funds received - money muling" category; and false applications fell 24% to 16,431, with undisclosed adverse addresses the most common reason. For refund abuse in depth see the Refund and Returns Fraud Guide.

How first-party differs from third-party fraud

Dimension	Third-party fraud	First-party fraud
Who acts	An impostor using a stolen or synthetic identity, or a hijacked account	The genuine customer, sometimes recruited or coached by others
What fails	Identity verification and authentication	Intent and honesty, which identity controls cannot test
Key detection data	Device, location, credential and identity document signals	Customer history, behaviour over time, linked accounts, claim patterns
Victim	The account holder and the institution	The institution, plus other customers through higher prices and friction
Treatment	Reimburse the victim, block the impostor	Decline, recover, close, file to a shared database, refer
Evidence bar	Show the customer did not act	Show the customer did act, and acted dishonestly

The hardest cases sit on the boundary. A "fraud" dispute may be a real account takeover, a family member using a stored card, or a customer who simply does not recognise a billing descriptor. Stripe's guidance on friendly fraud lists forgetfulness, misunderstanding of terms, use by someone the customer knows and buyer's remorse as common causes. Classify carefully before treating a customer as a fraudster: the Account Takeover Prevention Guide and the Synthetic Identity Fraud Guide cover the third-party cases that most often look like first-party fraud.

Detection signals

Commerce and payments

Dispute history: repeated fraud disputes from the same customer, card, device or address, especially after successful use of the goods or service (logins, downloads, delivery scans).
Usage after purchase: account activity, content consumption or support contacts after the date the customer claims the purchase was unauthorised.
Matching data with past good orders: the disputed order shares IP address, device fingerprint, shipping address or account ID with earlier undisputed orders.
Skipped refund route: a dispute raised with the card issuer without any prior contact or refund request to the merchant.

Banking and lending

Behaviour shift: a sudden change in payment patterns, many new credit lines in a short period, utilisation spiking to limits, or payments made with cheques or direct debits that later fail, a common sign of bust-out.
Mule patterns: inbound transfers from many unrelated payers quickly moved out, account use inconsistent with stated occupation or age, and changes of device or login location just before activity.
Application inconsistencies: income that does not match open banking data, address history gaps and data that conflicts with earlier applications.
Claim patterns: loss or scam claims shortly after large payments, story details that do not match payment data, and repeated claims across institutions where data sharing shows them.

Most of these signals are only visible across time and across products, so the detection layer must join payments, credit, digital and claims data at customer level. See the Transaction Monitoring and Behavioural Biometrics Guide.

Prevention and dispute defence

Reduce the opportunity

Recognisable billing: use a billing descriptor customers recognise and send order confirmations with date, time and amount, which removes many "I do not recognise this" disputes.
Easy refunds and cancellation: a customer who can cancel or get a refund quickly is less likely to go to the issuer.
Strong customer authentication: 3-D Secure, MFA and transaction signing produce evidence that the customer acted. See the PSD2/PSD3 Strong Customer Authentication Guide.
Affordability and application checks: verify income and address through trusted data sources, and limit early credit line increases for thin-file customers.

Answer disputes with evidence

Visa Compelling Evidence 3.0 is the clearest example of using customer history. According to Stripe's integration documentation, a Visa dispute qualifies when it has network reason code 10.4 and there are at least two earlier paid, undisputed transactions on the same payment method, made 120 to 364 days before the disputed one and not validation charges. The disputed and earlier transactions must match on two main evidence elements, or one main and one secondary element:

Main evidence elements	Secondary evidence elements
Customer purchase IP address	Shipping address
Customer device fingerprint or device ID (not both as a pair)	Customer email address
	Customer account ID

The practical lesson is to capture and keep these data elements for every transaction now, so they are available when a dispute arrives months later. Card scheme dispute rules change regularly; confirm current criteria with your acquirer.

Respect consumer protection

For US electronic fund transfers, Regulation E section 1005.11 gives consumers 60 days from the statement to report an error, and requires the institution to investigate within 10 business days, or within 45 days if it provisionally credits the account within 10 business days. Fraud suspicion changes the outcome of the investigation, not the duty to run it within those time limits. Other jurisdictions have equivalent rules; build them into the dispute workflow.

Treatment decisions

Treatment is where first-party fraud programmes succeed or cause harm. Each outcome below needs a written evidence threshold, an owner and a route for the customer to challenge the decision, reviewed by legal, conduct and complaints teams before it goes live.

Customer service case: confusion, forgotten purchases or family use. Explain, refund where fair, and fix the cause (descriptor, communication).
Policy abuse: repeated borderline claims without clear dishonesty. Restrict refunds or features, warn, and monitor.
Confirmed first-party fraud: clear evidence of dishonest intent. Decline the claim, recover funds, close or restrict the account, and where your membership and the evidence allow, file to a shared fraud database.
Organised or mule activity: coordinate with law enforcement and follow suspicious activity reporting duties; treat recruited young or vulnerable mules with safeguarding in mind.
Credit loss, not fraud: where intent cannot be shown, book it as credit loss but keep the case linked so patterns can emerge.

Separate these outcomes in reporting. Booking first-party fraud as credit loss hides the problem from fraud budgets; booking genuine hardship as fraud harms customers and, where shared databases are involved, can have serious consequences for them.

Where identity fits

First-party fraud is the case where identity proofing works and still fails to protect, which makes two identity practices critical. First, link identities across products and channels so one customer's history is visible in one place. Second, record strong evidence of who acted, through authenticated sessions, device binding and signed transactions, because that evidence is what separates a dishonest claim from an account takeover. AI shopping and payment agents add a new boundary case. When an agent buys on a customer's behalf, the customer may later say "I did not authorise that", and without a record of the mandate the customer gave, the limits set and the agent identity that acted, the merchant cannot tell a genuine agent error from a dishonest dispute. Keep signed mandates, per-agent credentials and transaction-level logs for agent-initiated payments. See the Agent Payments Protocols Guide. Mule networks also rely on account sharing and remote control of customer accounts, so new devices and remote access patterns on established accounts deserve scrutiny. See the Identity Fraud Prevention Guide.

Decision guidance

Fight or accept a dispute: fight when you hold qualifying evidence (CE 3.0 data, delivery proof, usage logs); accept low-value disputes without evidence and focus on preventing the next one.
Friction or monitoring: friction at origination (affordability checks, credit limits for new customers) prevents bust-out; monitoring catches mules and abuse after onboarding. Most programmes need both.
Small versus large organisations: a small merchant should focus on descriptors, refunds, authentication and keeping dispute evidence. A bank or lender needs customer-level analytics across products, a classification standard, data sharing membership and a treatment policy reviewed by legal and conduct teams.

How to implement

Agree definitions: adopt a classification scheme that starts with who initiated the payment, and add first-party categories that fit your products.
Relabel history: sample 12 months of fraud losses, disputes and early defaults and relabel them; expect some third-party fraud to be first-party and some credit loss to be bust-out.
Capture evidence data: make sure IP address, device ID, shipping address, account ID and authentication results are stored for every transaction for at least the dispute window.
Build signals in shadow mode: score customers and claims for several weeks without action, then check precision on confirmed cases and impact on genuine customers.
Introduce treatments in steps: start with automated dispute evidence and refund-route nudges, then add restrictions, then account closure and data sharing, each with documented evidence thresholds.
Review and roll back: track complaints, ombudsman or regulator referrals and reversed decisions; loosen thresholds where genuine customers are being harmed.

Detection and measurement

Metric	Why it matters
First-party share of fraud and dispute losses	Shows whether classification is working and where to invest
Dispute win rate, with and without CE 3.0 evidence	Measures evidence capture and representment quality
Repeat disputers or claimants	Shows whether treatment deters repeat behaviour
Bust-out loss as a share of early defaults	Separates fraud from credit risk in lending
Mule accounts identified before outbound payment	Measures how early mule detection acts
Overturned decisions and complaints	Guards against treating genuine customers as fraudsters

The Fraud Metrics and KPIs Guide covers how to set baselines and targets.

Framework mapping

Activity	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Fraud risk in enterprise risk management	GV.RM-03	Not applicable
Customer-level behaviour analysis	DE.AE-02, DE.AE-03	SI-4 System Monitoring; AU-6 Audit Record Review, Analysis, and Reporting
Evidence of who acted (authentication records)	PR.AA	AU-10 Non-repudiation
Alerts to investigators	DE.AE-06	IR-4 Incident Handling

Common failure patterns

Everything labelled third-party: when every dispute is booked as card fraud, the controls bought (stronger identity checks) do nothing for the real problem.
Evidence discarded: device, IP and account data not retained long enough, so qualifying disputes cannot be answered months later.
Bust-out booked as bad debt: losses go to credit risk, nobody looks for linked accounts, and the same pattern repeats.
Mules treated only as victims or only as criminals: some are coerced or exploited, others are complicit; a single treatment fails both groups.
Consumer rules ignored under suspicion: delaying investigation or provisional credit because a claim "looks like" first-party fraud creates regulatory breaches.
Friction for everyone: blanket restrictions on refunds or disputes punish the honest majority while organised abusers adapt.

Practitioner checklist

Adopt a fraud classification standard that separates first-party, third-party, scam and error cases.
Relabel a year of losses and disputes to size first-party fraud properly.
Store IP, device, address, account and authentication data for every transaction through the dispute window.
Use Visa CE 3.0 and equivalent scheme evidence routes for qualifying disputes.
Join payments, credit, digital and claims data at customer level for detection.
Document evidence thresholds for each treatment, including shared database filing.
Build consumer protection deadlines into the dispute workflow.
Track overturned decisions and complaints alongside fraud losses.

First-Party Fraud Guide: Detect, Evidence and Treat Customer-Committed Fraud