~/
thoughts
Jul 11, 2026
#fintech#risk

First-Party Fraud: The Fraud Your Fraud Stack Cannot See

The setup

First-party disputes span both fraud and service reason codes: a genuine cardholder disputing a transaction they themselves authorised. The routes are familiar to anyone who has read a dispute queue — "goods not delivered", "goods don't match description", or a straight "unauthorised transaction". Sometimes it's honest confusion: an unrecognisable billing descriptor, a family member's purchase, a forgotten subscription. Increasingly, the market is seeing an increase in deliberate disputes being raised.

The asymmetry does the rest. Representment demands evidence, documentation, and deadlines — so smaller merchants often don't contest at all and simply refund. The customer keeps the product and the money, and learns that the dispute button is a free-refund button.

The numbers

Nobody can measure first-party fraud accurately — and that is the critical finding. Mastercard and Javelin's research marks it at roughly one in five disputes; other firms sitting on merchant-side data estimate 60–80% of e-commerce disputes (biased due to merchant opinion). The spread exists because first-party fraud is, by definition, indistinguishable from legitimate behaviour at transaction time. Sift's index shows the trajectory: from 15% of all reported fraud in 2023 to 36% in 2024, the largest category globally.

The loss math is simpler. Global chargeback losses crossed $34 billion in 2025, and LexisNexis puts the fully-loaded cost at $4.61 for every $1 disputed. The structural problem: there is no detection for this at the gateway or the bank when the transaction happens — everything looks clean, the transaction succeeds, but the chargeback lands after the product/service is delivered and used.

Why now

Four forces converged:

– Ease of raising a dispute in today’s setup.

– Seamless checkouts often go out of the customer’s mind but these are honest mistakes.

– "Refund hack" tutorials circulate openly on social platforms by bad actors.

– The networks are tightening dispute-ratio thresholds on merchants (Visa's dropped to 0.9% in Jan'26) leading to merchant side pressure.

The inversion

Conventional fraud management is run pre-transaction: assign a risk-score to the transaction, and decide whether to allow or block the transaction. First-party fraud is post-transaction, and the "fraudster" passes every identity check. The only signals that work come from the relationship itself: the customer's own dispute history, devices using the same email/contact details and the merchant's evidence about what actually happened.

The card networks have already conceded this. Visa's Compelling Evidence 3.0 lets merchants defeat a fraud dispute by showing the same customer, device, and address transacted before without complaint. Mastercard's First-Party Trust programme shares merchant-side evidence with issuers before a dispute becomes a chargeback. This essentially shows how networks are aligning to fight first-party fraud.

That's the inversion. In third-party fraud, the customer is who you protect. In first-party fraud, the customer is what you underwrite.

The solve

A customer-side signal is necessary to detect first-party fraud. Here's my take:

A customer's dispute history can be leveraged greatly to see if they are genuine or repeat offenders. One dispute at one merchant is legit; the same customer disputing across five merchants in six months is a signature — but only visible at the customer contact/email level.

Build the customer graph. Link identifiers — device ID, card ID, UPI ID — so the same person resolves to one node across accounts and merchants. When a known serial disputer transacts, alert the merchant or put in additional checks.

Collect merchant feedback at dispute representment. When a dispute lands, ask the merchant to rate how likely this customer is fraudulent — delivery confirmed, product used, prior purchases clean. That label, fed back into the graph, is training data no pre-transaction model can generate on its own.

Then move upstream. With enough labelled history, dispute-rate scoring becomes a pre-transaction signal like any other: add friction for borderline customers, and block the ones whose dispute rates cross threshold — before the next perfect-looking transaction is approved.

The feedback loop is the product and I believe it's of utmost importance to build this in today's world.