When the fraudster is your own customer: the true cost of first-party fraud

Lorenzo Cossari, Associate Consultant at KAE, explores the rise of first-party fraud, its true cost, and what merchants can do today.

A shopper orders a dress in four sizes, keeps the one that fits, and returns the rest under a no-questions-asked policy. Nothing about that transaction looks like fraud, because on paper, none of it is. Now add a customer who disputes a payment they made themselves, or a borrower who takes out credit with no intention of ever repaying it. Multiply that instinct by millions of transactions a year, and you are looking at one of payments’ fastest-growing and least-visible loss categories: first-party fraud. It rarely announces itself as fraud in the accounts. Instead, it hides inside returns, chargebacks, and credit write-offs, which is exactly why so few businesses have a proper handle on it.

A different kind of fraud

Fraud in commerce has moved through predictable stages we’re all aware of. Think stolen card details, account takeover using stolen credentials, and synthetic identities built patiently over months. But first-party fraud is the newest stage, and in some ways the strangest, because there is no external attacker to catch. The account holder and the perpetrator are the same person, using entirely legitimate credentials. Cifas defines it simply as misrepresenting who you are, or what happened, to obtain something you are not entitled to.

That distinction changes everything about how you defend against it. Third-party fraud has an identifiable victim, so identity and authentication controls are the front line. Second-party fraud, where a customer knowingly lends their identity to someone else still involves a form of complicity you can trace. First-party fraud has neither. The deception happens after the transaction has already been approved, namely in the dispute, the refund claim or the loan application. It takes many shapes, from disputing a legitimate card payment (commonly called friendly fraud) and returns abuse, ranging from false non-delivery claims to ‘wardrobing’, to inflated income on a credit application, borrowing with no intention to repay, or simply claiming to have been scammed when you were not. In every case, the original transaction looked entirely legitimate, and the fraud only becomes visible in what the customer does next.

Why it’s accelerating now

Three things are converging, and together they explain why first-party fraud has moved from a manageable cost of doing business to a genuine strategic concern.

1. The behaviour has become normal

The first driver is cultural, and it should concern every business that sells online. Cifas’s most recent research found that half of UK adults now consider it reasonable to commit first-party fraud in some form, rising to a third of 25–34-year-olds who admit to having done it. Falsely claiming an item never arrived is the single most common tactic, cited by nearly one in five. What stands out is not just the scale but the confusion underneath it. A lot of people genuinely don’t see this as a crime, and behaviour that isn’t understood as criminal is very hard to deter like one.

2. We built the frictionless experience that makes it easy

The second driver is one the industry should be honest about, because we built it. Frictionless returns and instant refunds were designed to remove friction from genuine purchases, and they did exactly that. But they also removed the friction from abuse. Visa processed 106 million disputes globally in 2025, 35% more than in 2019, and estimates friendly fraud now accounts for roughly a fifth of fraudulent disputes worldwide. The processes that made online shopping effortless made claiming against it effortless too. I’m sure we all know somebody who has ordered a dress in every colour because no store holds the full range and then returned what they don’t keep. You may have even done it yourself…

3. And it’s professionalising fast

The third is the most concerning, in my opinion, because this opportunistic behaviour is fast becoming organised crime. Research from the University of Portsmouth, funded by Cifas, analysed nearly 500,000 posts across cybercrime forums, Telegram and Discord, and uncovered a functioning ‘refund-as-a-service’ economy. These are vendors charging up to 30% of the refund value, complete with customer support, and an average offender age of just 19. Cifas recorded over 106,000 misuse-of-facility cases in 2025, up 43% year on year; within that, payment fraud specifically rose by 239%.

The cost is bigger than it looks

Refund fraud alone may be costing UK online retailers up to GBP 5.76 billion a year, according to the University of Portsmouth’s research, and unlike most fraud it is a double loss in that the goods are gone and the money has already been returned. But the direct loss is often the smaller problem.

The bigger issue is visibility. Because first-party fraud shows up in the accounts as ordinary returns, chargebacks, or credit losses, most businesses cannot separate it from legitimate activity, and you cannot build the case to invest against a cost you cannot isolate. It also has a habit of triggering scheme monitoring as disputes count towards chargeback and fraud ratios whether or not the underlying claim was genuine, and breaching those thresholds brings remediation costs and fines on top of the original loss.

The natural instinct to tighten the rules, decline more, make returns harder is usually the most expensive response of all, because it punishes loyal customers alongside the small minority abusing the system. Catching genuine abuse without adding friction that costs you good customers is hard to get right than it sounds, and as many businesses will tell you, over-correction is generally the costlier mistake.

Where is this going next?

Two forces will shape how first-party fraud develops from here, and one of them is only just beginning.

1. Liability keeps shifting and incentives shift with it

Reimbursement regimes are moving loss from consumers towards the firms that process payments, and the usual objection is moral hazard – will guaranteed reimbursement simply invite more false claims? The UK’s authorised push payment reimbursement rules are an early real-world test, and so far the evidence doesn’t support that fear.

In the eighteen months to March 2026, 88% of in-scope losses were reimbursed, and only around 3% of claims were rejected for insufficient consumer caution. Authorised push payment losses did rise 19% in 2025, but that was driven by scams, not false claims. It’s not the full story, though. Card chargebacks followed a similar arc decades ago, with false claims emerging gradually as customers grew familiar with the process, and there is little reason to think this pattern won’t repeat.

2. Agentic commerce is about to complicate everything

The bigger shift is AI. Visa reported AI-driven traffic to US retail sites surging by more than 4,700% in a single year, and has launched a Trusted Agent Protocol specifically to help merchants distinguish real purchasing agents from bots. As AI agents start buying on consumers’ behalf, merchants face a question they’ve never had to answer before: not just who authorised this purchase, but whether the agent that made it was trustworthy in the first place.

How strong customer authentication under PSD2, and the incoming PSD3, applies to an agent-initiated purchase is still undefined, and the industry’s experience with 3D Secure is a useful warning in that unfamiliar authentication journeys reduce conversion long before the experience catches up.

This will create an entirely new category of dispute. ‘I didn’t authorise that, my assistant did’ will sometimes be true, sometimes a genuine mistake, and sometimes a convenient lie, and almost no merchant today holds the evidence to tell the three apart. Proof of consent, and of exactly what scope a customer granted their AI agent, is about to matter as much as delivery confirmation does now.

What to do about it

None of this is a reason to panic, but it is a reason to act.

• Measure it separately. You cannot manage a cost you cannot see. Build a loss taxonomy that separates first-party from third-party fraud across payments, credit and returns, and read approval, conversion and authorisation rates together rather than in isolation.
• Match the response to the behaviour. The right remedy for policy abuse is targeted friction, not a blanket block – requiring an in-store return instead of an online one, for example. That removes the opportunity without severing a relationship that might otherwise be valuable.
• Capture evidence at the point of sale, not after the dispute. Tools like Visa’s Compelling Evidence 3.0 and Mastercard’s First Party Trust let merchants use prior transaction history to rebut a claim, but only if device identifiers, delivery confirmation, and login data were captured when the sale happened, not pieced together afterwards.
• Score the relationship, not the transaction. A single transaction can look completely legitimate even when it isn’t. Repeat-claim rates, refund-to-purchase ratios, and claim clustering across a customer’s history are what actually reveal the pattern.
• Share what you see across the sector. Offenders rarely stick to one merchant. Databases like Cifas’s National Fraud Database make repeat behaviour visible, and an attack pattern spotted at one merchant can be blocked across a network before it reaches the next.

The real takeaway

First-party fraud is, at its core, a customer behaviour problem that happens to show up in your payments data. That means the businesses that get ahead of it won’t be the ones with the tightest fraud rules. Rather, they’ll be the ones that genuinely understand how their customers behave, where trust is being tested, and where friction helps rather than harms.

References

Cifas. (2026a, May 12). Fraud acceptance hits tipping point as half (50%) of UK adults say first party fraud is ‘reasonable’. cifas.org.uk/newsroom/fraudbehaviours2025

Cifas. (2026b). Fraudscape 2026. fraudscape.co.uk

Cifas. (2026c, March 12). Fraudscape 2026: Fraud cases hit record highs as criminals adapt and scale. cifas.org.uk/newsroom/fraudscape2026

Payment Systems Regulator. (2026, July 30). APP scams reimbursement dashboard for Q1 2026. psr.org.uk

Sabah, S. (Host). (2026). From stolen cards to synthetic identities: The evolution of fraud w/ Nikhita Hyett (Signifyd) [Video podcast episode]. In The people making payments podcast. YouTube. youtube.com/watch?v=7gQiqtxUsv4

UK Finance. (2026). Annual fraud report 2026. ukfinance.org.uk

University of Portsmouth. (2026). Mapping the online economy of refund fraud. Cifas. cifas.org.uk/newsroom/portsmouth-uni-retail-refund-report-26

Visa. (2023, March). Compelling Evidence 3.0 merchant readiness. usa.visa.com

Visa. (2025, October 14). Visa introduces Trusted Agent Protocol: An ecosystem-led framework for AI commerce. usa.visa.com

Visa. (2026, April 1). Visa unveils new services to modernise dispute resolution process. usa.visa.com

Visa. (2026). Friendly fraud explained: Prevention and solutions. Retrieved September 1, 2026, from corporate.visa.com

About the author

Lorenzo is a consultant at KAE, working across financial services and technology. A strong researcher with a talent for turning complexity into clear, client-ready insight, he supports clients with recommendations grounded in rigorous analysis. He holds an MSc in Management from the University of Exeter.

About KAE