What is first party fraud? Definition, types & prevention

First party fraud is a growing risk that has more than doubled in a single year. According to the LexisNexis Risk Solutions Cybercrime Report, first party fraud now accounts for 36% of all fraud globally, up from 15% the year before. 

First party fraud is particularly difficult to stop because it involves consumers acting in a fraudulent manner using their own identities. While some fraudsters are deterred from committing first party fraud because it’s under their own identity, some are not. 

Despite these unique challenges, there are several ways companies can limit first party fraud. In this article, we’ll cover different types of first party fraud and what companies can do to prevent them. 

What is first party fraud? 

First party fraud is when a person uses their own identity, not a stolen or synthetic one, to intentionally behave in a fraudulent manner by deceiving a financial institution, lender, or merchant for personal gain. Common examples include chargeback fraud, bust out fraud, and falsely claiming a product was never delivered. Because the perpetrator is a real customer using genuine credentials, it’s harder to detect—the fraudster passes standard identity checks almost every time.

Types of first party fraud

Preventing first party fraud starts with understanding what it looks like. 

Ghost funding

Ghost funding is when a user funds an account via ACH, spends the balance before funds settle, and then the transfer subsequently fails due to insufficient funds (either because the source bank account was never sufficiently funded, or the user moves funds out of the source account prior to ACH settlement), getting goods or services for free.  Many platforms make ACH-funded balances available instantly to reduce friction, a vulnerability that bad actors exploit. 

Chargeback fraud

Chargeback fraud, or friendly fraud, is when a consumer disputes a legitimate transaction with their card issuer, claiming it was unauthorized, to receive a refund while keeping the goods. Distinguishing intentional abuse from a genuine dispute requires behavioral data that most standard fraud tools don’t capture. 

ACH return fraud

ACH return fraud is when a person fraudulently disputes an ACH payment as unauthorized, even though the person did in fact authorize the payment, triggering a return code that reverses the payment. This type of fraud is nearly invisible until patterns emerge across accounts.

Plaid Signal helps reduce ACH returns by scoring payment risk before a transaction settles, flagging accounts with elevated return likelihood so companies can act before funds move.

Goods lost in transit (GLIT)

Goods lost in transit fraud is when a customer falsely claims an item was never delivered or arrived damaged to receive a refund or replacement. Carriers may provide proof of delivery, but rarely photo evidence that the item was undamaged, giving fraudsters plausible deniability that's nearly impossible to disprove.

Bust out fraud

Bust out fraud is when a borrower systematically builds a positive credit history and suddenly maxes out all available credit with no intention of repaying. It's hard to catch because the customer looks like a prime borrower right up until the moment of bust-out.

Loan stacking

Loan stacking is when an individual applies for multiple loans or credit lines from different lenders simultaneously, exploiting the lag in credit bureau reporting to obtain more credit than any single lender would approve. 

Never pay and serial default

Never pay fraud is when a borrower applies for credit or a BNPL installment, receives funds or goods, and never makes a single payment. Serial defaulters repeat this across multiple platforms in rapid succession. Because the applicant passes KYC and their identity is legitimate, nothing in a standard onboarding flow flags the intent.

Reg E dispute abuse

Reg E, or dispute abuse, is when a consumer exploits the electronic funds transfer protections of Regulation E by filing fraudulent disputes to receive provisional credits they're not entitled to. Under Reg E, financial institutions must issue provisional credit within 10 business days if they have not completed investigation of the dispute. Many institutions close disputes in the customer's favor rather than absorb investigation costs. This is among the hardest forms of first party fraud to detect because the customer's identity is real, and disputing transactions is a legally guaranteed right.

De-shopping

De-shopping is when a consumer purchases an item with the deliberate intention of using it temporarily and returning it for a full refund. Because the return itself is within policy, merchants struggle to distinguish intentional abuse from legitimate remorse.

Mortgage and asset verification fraud

Mortgage and asset verification fraud is when a borrower submits falsified documentation, such as inflated income statements, borrowed asset records, or rented property claimed as owned, to secure a larger loan or better terms than they'd qualify for. Because lenders have historically relied on self-reported documents that can be manipulated, this is hard to catch without direct account-level data.

Plaid’s mortgage solutions address this by giving lenders real-time, permissioned access to verified balances and transactions directly from the source.

Government and benefits program abuse

Government and benefits program abuse is when an individual misrepresents income, household composition, or employment status on benefit applications to claim subsidies or payments they're not entitled to. Overpayments accumulate before audits catch the discrepancy since government programs often rely on self-certification with limited real-time data verification.

First party fraud vs second party fraud vs third party fraud: What are the differences?

The difference between first, second, and third party fraud comes down to who commits the fraud and whose identity details they use. 

First party fraud vs second party fraud 

In first party fraud, a person uses their own identity details when committing fraud. For example, submitting false documentation when applying for a mortgage in their own name. Second party fraud occurs when someone knowingly provides their identity details to another party to commit fraud—a practice commonly seen in money-laundering schemes. For example, they could accept a deposit from a criminal organization and then move it to a third party account. 

First party fraud vs third party fraud

Third-party fraud occurs when a third party uses someone else's identity or information to commit fraud with malicious intent. This type of fraud includes identity theft or moving funds between accounts without the consent or knowledge of the identity owner. In first party fraud, the person committing the fraud is using their own, legitimate identity documents.

Which industries are most at risk from first party fraud?

First party fraud affects every sector that provides credit, processes payments, or fulfills orders. However, some industries face disproportionate exposure.

Banking

First party fraud in banking is most commonly expressed as Reg E dispute abuse, fraudulent ACH returns, and check kiting. The 10-day provisional credit window under Reg E creates vulnerabilities that are difficult to close without behavioral analytics layered on top of identity.

Buy now, pay later 

BNPL fraud is a rapidly growing category driven by loan stacking and never pay fraud. Because BNPL approvals happen in seconds with minimal underwriting, fraudsters can stack simultaneous applications across multiple providers before any single bureau file reflects the new obligations. 

Gaming

First party fraud in online gaming often involves dispute abuse on losing bets—players reverse legitimate charges after unfavorable outcomes. 

E-commerce

E-commerce platforms are hit hardest by GLIT claims and de-shopping. High-return-rate customers often look like suitable, active shoppers right up until pattern analysis reveals systematic return abuse. 

Insurance

In insurance, first party fraud includes staged claims, inflated loss reports, and misrepresentation at the policy application stage, such as understating risk factors to lower premiums. Because insurance claims payments are processed on the claimant's own account, the identity layer offers no protection against intentional misrepresentation.

Property technology

Property technology platforms face mortgage fraud through income and asset misrepresentation, rental fraud using falsified income documentation to secure leases, and property management disputes. The move to digital verification has made it easier for borrowers and renters to submit doctored documents.

How first party fraud impacts your business, and why it’s so difficult to detect

According to the LexisNexis 2025 True Cost of Fraud Study, financial institutions lose more than $5 for every $1 of fraud when factoring in investigation costs, regulatory fees, and customer replacement costs. Left unchecked, first party fraud also damages merchant and partner relationships and erodes trust in your product.

First party fraud detection is difficult because the identity is real, and the fraud often begins after onboarding. Specifically:

• The real identity passes KYC, ID verification, and credit checks with no flags

• Fraudulent intent often forms after account opening, making onboarding signals insufficient

• Abuse is invisible across lenders–no single institution can see stacking or bust out patterns without network intelligence

• Legacy rules-based tools can’t detect behavioral intent

How to detect and prevent first party fraud

Because the identity is real in first party fraud, the goal is to understand intent through financial behavior, payment signals, and lifecycle data. 

1. ACH risk scoring and return prediction 

ACH is one of the payment rails most exposed to ghost funding and fraudulent returns. Scoring each ACH payment for return risk before it settles allows companies to hold, limit, or decline high-risk transactions without disrupting legitimate transactions. Plaid Signal uses machine learning to provide risk scores and 0+ attributes to predict the likelihood of an ACH return. 

2. Transaction-based insights

Insights from past transactions can dramatically improve detection for bust-out fraud rings, repeat ACH returners, and serial default. Plaid Protect surfaces transaction based insights in real-time to find indicators of first party fraud.

3. Real-time behavioral monitoring post-onboarding

First party fraud intent frequently emerges after a clean account opening. Monitoring for abnormal behavior, such as newly opened accounts with sudden large transactions, unexpected information changes, or spending inconsistent with account history, creates a second line of defense. Plaid Protect continuously monitors post-onboarding behavior, flagging anomalies before money moves.

4. Digital asset and income verification for lending

Mortgage and lending fraud depend on lenders accepting self-reported or document-based income and asset claims. Direct, permissioned access to bank account data reduces the risk of document forgery. Plaid Assets gives lenders real-time access to account balances, transaction history, and assets directly from financial institutions.

5. Bank account transaction history

Transaction history is one of the strongest intent signals available. Rapid money cycling through high-risk merchant categories, unusual P2P patterns, or ATM withdrawal sequences following deposits are behavioral tells that rules engines miss but machine learning catches. 

In one case surfaced through Plaid Protect, repeated P2P deposits followed by ATM withdrawals and a pattern of $499.99 electronics purchases were flagged before significant losses occurred.

6. Network graph analysis

Fraud rings operating first party schemes often share subtle infrastructure: lightly reused bank account numbers, overlapping device identifiers, or common IP addresses across seemingly unrelated accounts. These connections are invisible at the individual-account level but visible in a network graph. Plaid Protect uses graph analysis to surface these hidden connections.

7. AI and ML-powered risk scoring beyond static rules

Static rules are necessary, but first party fraud evolves faster than rule-sets can be updated. Plaid's machine learning models are continuously trained on network data, adapting to emerging patterns and reducing both false positives and false negatives.

How Plaid can help you fight first party fraud

Plaid takes a layered approach to first party fraud prevention, understanding intent through financial behavior, payment signals, and lifecycle data. At onboarding, we move beyond standard identity checks to expose risk at signup. When money starts moving, ACH risk scoring catches ghost funding and return fraud before funds settle. Post-onboarding, behavioral monitoring and real-time cross-network graph analysis help uncover fraud rings that are invisible at the individual level but impossible to hide once connected. 

Together, Plaid’s fraud and risk solutions give financial institutions and fintechs a complete picture of first party fraud risk across the customer lifecycle.