Friendly Fraud vs. First-Party Fraud

Last updated: September 2026

Friendly fraud vs. first-party fraud comes down to scope. Friendly fraud is a customer disputing a purchase they made or authorized. First-party fraud is the wider family of a legitimate customer acting fraudulently, and much of it, including bust-out, never-pay and loan stacking, involves no dispute at all. The two meet where a dispute is deliberately false, and the label a case gets decides which rules and which team handle it.

TL;DR

• Friendly fraud is a dispute of a legitimate purchase. Visa calls it first-party misuse.

• First-party fraud is any fraud by the authorized customer: bust-out, never-pay, loan stacking, application misrepresentation and dispute abuse.

• A deliberate friendly-fraud dispute is one kind of first-party fraud. Many first-party schemes never produce a dispute, and some friendly-fraud disputes are honest mistakes.

• A dispute runs on Regulation E or Regulation Z error-resolution deadlines and card network rules. First-party credit fraud is a credit and fraud-policy decision, often owned by a different team.

• Tell them apart at intake: classify the claim, read the claimant's own history, use the merchant's evidence, look across the customer's other accounts, and decide the account separately from the transaction.

The short answer: how friendly fraud and first-party fraud differ

Friendly fraud happens when a cardholder or account holder disputes a purchase they made or authorized, usually by telling the issuer it was not them. The card networks use a more neutral term: Visa's public page on the subject says "Friendly fraud, also known as first party misuse, is a long standing challenge in digital commerce."

First-party fraud is broader. It covers any fraud committed by the authorized customer under their own identity: running up credit and never paying, borrowing from several lenders at once, misstating an application, or disputing a charge they made. A fraud strategy lead at a consumer banking fintech put it simply: "First party fraud is just one name for many different activities."

The relationship runs in one direction. A deliberate friendly-fraud dispute is a form of first-party fraud. Much first-party fraud never involves a dispute, and not every friendly-fraud dispute is deliberate.

What friendly fraud is

Friendly fraud is a dispute in which the person who made the purchase claims they did not make it. A strategic risk leader at a vertical software platform with embedded payments described the plainest case: "I think it's truly just friendly fraud. You go order tires, you go back home. That wasn't me. I didn't do that."

Friendly fraud is hard to stop at the point of sale because the purchase itself was ordinary. The same risk leader said "we have a lot of customers who claim fraud, but it's friendly fraud," and explained that the disputed transactions "don't hit any red flags." The right customer, on the right device, made a normal purchase. The fraud arrives later, labeled as fraud, when the dispute is filed.

Regulation Z draws the legal line for credit cards. Under 12 CFR 1026.12(b), "unauthorized use" means use of a credit card "by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit." A purchase the cardholder made, authorized, or benefited from does not meet that definition, even when the cardholder reports it as fraud.

Not every friendly-fraud dispute is deliberate. A customer may not recognize a merchant's billing name, or a household member may have made the purchase. Intent separates a deliberate false claim from a service problem, and the response should differ accordingly.

What first-party fraud is

First-party fraud is fraud committed by the legitimate account holder, using their own true identity. The Federal Reserve's FraudClassifier model, a voluntary classification framework, sorts payments fraud first by whether an authorized or an unauthorized party initiated the payment. It has no category called first-party fraud; the closest fit is an authorized party who acted fraudulently, which covers false claims among other schemes.

Several common forms of first-party fraud never touch the dispute process:

• Bust-out. A director of fraud at a point-of-sale lender described bust-out committed entirely under the customer's real identity, not a synthetic one: the customer builds good history, busts out, and later works each creditor to have the accounts wiped.

• Loan stacking. The head of fraud at a captive auto lender described customers with fully accurate files, real identity and real income, who take out loans at several lenders at the same time and pay none of them.

• Never-pay. Credit is drawn on an account whose owner never intended to repay it.

Identity checks pass in every one of these cases because the customer is exactly who they say they are. A KYC check confirms that an identity exists and matches its documents; it does not establish intent. The signals that catch these patterns are behavioral and relational, and most appear after the account opens. Our guide to first-party fraud detection signals works through them pattern by pattern.

Friendly fraud and first-party fraud side by side

The table compares friendly fraud with the first-party fraud that involves no dispute.

Read the table as a routing guide: the same customer can appear in both columns, but each case needs one label before it can go to the right team.

Where the two overlap, and where they do not

Friendly fraud and first-party fraud overlap wherever a customer uses the dispute or claims process to take money they are not owed:

• A false dispute of a legitimate purchase. The classic friendly-fraud case.

• A false identity-theft claim after applying for credit. A director of fraud at a point-of-sale lender described customers who apply for loans and then immediately claim someone else did it. This is where dispute-shaped abuse meets credit fraud.

• Refund and promotion abuse. A head of fraud risk at an online ticket marketplace put it this way: "Outside of payment fraud, there's also abuse." Refund and promotional abuse sit beside friendly fraud as misuse by the customer.

A claim is not a finding, though. An SVP of audit and compliance at a community bank described Regulation E debit card claims "where the customer disputes transactions, sometimes they're fraud, sometimes they're not." Some claims are true third-party fraud, some are friendly fraud, and some are honest mistakes.

The labels part ways in two places. Bust-out, never-pay and loan stacking are first-party fraud with no dispute at all, so a disputes process never sees them. And an honest mistaken dispute, such as a charge the customer did not recognize, is friendly fraud in name only: it goes through the dispute process, but there is no fraud to act on.

Why the label changes the response

The label decides the rulebook. A dispute runs on regulatory error-resolution deadlines and network rules, and the institution has to follow them whatever it suspects. First-party credit fraud runs on the institution's own credit and fraud policy.

Debit cards and other electronic transfers: Regulation E. Under 12 CFR 1005.11, a notice of error must be received "no later than 60 days after the institution sends the periodic statement" on which the error first appears. The institution "shall determine whether an error occurred within 10 business days" (20 business days if the transfer was within 30 days after the account's first deposit). It may take up to 45 days if it "provisionally credits the consumer's account in the amount of the alleged error" within 10 business days, and up to 90 days in place of 45 for a point-of-sale debit card transaction, a transfer not initiated within a state, or a transfer within 30 days after the first deposit.

Credit cards: Regulation Z. Under 12 CFR 1026.13, a billing error notice must be received "no later than 60 days after the creditor transmitted the first periodic statement that reflects the alleged billing error." The creditor must acknowledge it within 30 days and resolve it "within 2 complete billing cycles (but in no event later than 90 days)." While the dispute is pending, the creditor "may not try to collect" the disputed amount and may not "make or threaten to make an adverse report" about it.

The chargeback: network rules. When the issuer passes a dispute to the merchant's side, the card network's rules take over. The reason code attached to the chargeback records the network's classification of what the cardholder asserted, and it sets what evidence can rebut the claim. Our explainer on chargeback reason codes and their time limits covers the codes themselves.

First-party credit fraud: policy. Bust-out, stacking and never-pay are credit and fraud decisions, and they often sit with a different team. An executive responsible for new-account fraud strategy at a large bank said first-party fraud is managed separately there, under credit abuse, while third-party and synthetic fraud sit with fraud strategy.

A repeat claimant turns a claim decision into a relationship decision. A fraud director responsible for card and Regulation E claims at a regional bank said that when a customer fails the bank's checks and has filed repeated fraud claims, the bank pauses the claim and talks to the customer, either about why they cannot protect their card or about whether to keep them as a customer.

How an institution tells them apart

Labeling a case after the fact is easy. A payments product manager at an online marketplace said "it's very easy to identify reactively that, okay, this is friendly fraud or this is true fraud." The work is getting the label right when the claim arrives, and the six steps below are a practical order for doing it.

1. Classify the claim at intake. Claims tend to arrive labeled unauthorized; the same product manager said "everything comes as unauthorized," and the team's job is to split account takeover and transaction fraud from friendly fraud. A senior financial-crimes investigations analyst at a digital bank described working a case in that order, account takeover, then identity theft, then first party, before deciding anything.

2. Read the claimant's own history and behavior. A fraud director responsible for card and Regulation E claims at a regional bank described checking whether the customer is a repeat claimant: "are they someone who is abusing the system? Are they a new first party fraud or a new account fraud candidate?" Device data alone rarely settles it. A VP of IT operations and engineering at a gaming payments fintech, describing a false lost-card claim, said "it's got nothing to do with device reputation. It's more about the behavior of that individual."

3. Use the merchant's evidence. The merchant often holds the proof that the cardholder made the purchase. A card program manager's disputes team said cardholders sometimes lie, and the merchant's response to the chargeback, the representment, shows the goods were delivered to the cardholder's house. Both networks now formalize this: Visa describes its Compelling Evidence 3.0 framework as one "which allows invalid chargebacks to be overturned using structured, verifiable data," and Mastercard says its First-Party Trust program "provides enhanced data-sharing, either at the time of transaction or at the time a dispute is raised."

4. Look across the customer's other accounts. A dispute on a card and a missed payment on a loan look unrelated in two systems and connected on one customer profile. Dispute history, credit behavior and links to other accounts belong in the same view when the claim is decided.

5. Decide the account and the transaction separately. The digital bank's investigator described two separate decisions: close, suspend or leave the account, and approve, reject or hold the transaction. A valid claim on an account with a pattern of abuse may still call for an account action.

6. Feed the outcome back. Record the final label, including the claims that turned out to be friendly fraud after the merchant responded. Each case's reasons should reach the analyst handling the next one, so the label at intake gets better over time.

Where Oscilar fits

Oscilar is built for the fraud decision a dispute raises and for the first-party fraud behind it, and it does not run the dispute process itself. Its first-party fraud prevention covers use cases "from simple chargeback abuse to complex bust-out schemes," with pre-built rules and ML models for scenarios "including loan stacking, chargeback fraud, and application fraud." Device intelligence, behavior biometrics and data enrichments sit alongside analysis of "cross-account linkages to uncover fraud rings," and case management gives analysts prioritized queues, a holistic user view and natural-language explanations of why each case was created. Risk teams can backtest and A/B test a rule change before it goes live.

Governance is built in: a full audit trail per decision with stored reasoning, and human-in-the-loop by design. Auto model monitoring watches for data drift, feature drift and concept drift, with outcome KPIs measured by segment, and the platform is specified for decisions in under 100 milliseconds. Evaluating dispute and chargeback management software is a separate decision with its own criteria.

Frequently asked questions

Is friendly fraud a type of first-party fraud?

Deliberate friendly fraud is a type of first-party fraud. The account holder authorized the purchase and then disputed it, which places it on the authorized-party side of the Federal Reserve's voluntary FraudClassifier model. Visa's term for it, first-party misuse, says the same thing. An honest mistaken dispute is not fraud, even when it is labeled friendly fraud.

Is friendly fraud the same as chargeback fraud?

The two terms overlap but describe different things. Chargeback fraud names the channel: a false claim that ends in a chargeback against the merchant. Friendly fraud names the claimant, the customer who made the purchase. Deliberate friendly fraud on a card usually reaches the merchant as a chargeback, so in practice the two terms cover much of the same activity from different angles.

Is every friendly-fraud dispute deliberate?

No. Some friendly-fraud disputes come from a customer who does not recognize a merchant's billing name or a purchase made by someone in the household. Regulation Z's definition of unauthorized use excludes use by someone with actual, implied or apparent authority, so a purchase by an authorized household member is not unauthorized use even when the customer disputes it in good faith. Intent decides whether the case is fraud or a service problem.

Does Regulation E or Regulation Z protect a customer who disputes their own purchase?

Both rules require the institution to investigate a timely notice on the rule's own timetable, whatever it suspects: 12 CFR 1005.11 for electronic fund transfers and 12 CFR 1026.13 for credit card billing errors. For credit cards, the definition in 12 CFR 1026.12(b) excludes use by someone with actual, implied or apparent authority, and use from which the cardholder benefits. A cardholder who made the purchase is disputing a charge that the definition does not treat as unauthorized use.

What do Visa and Mastercard call friendly fraud?

Visa's public page describes friendly fraud as "also known as first party misuse." Mastercard's October 2023 announcement of its First-Party Trust program described it as a program "to combat first-party or 'friendly' fraud." Both networks treat it as a data-sharing problem between merchant and issuer.

Friendly fraud and first-party fraud involve the same kind of customer and run on different rules. Getting the label right at intake decides whether a case runs on dispute deadlines or on credit and fraud policy, and which team owns it. To see how Oscilar supports that decision, visit our first-party fraud solution.