Triangulation Fraud
Triangulation fraud is an ecommerce scheme involving three parties: a fraudulent seller, an unwitting real shopper, and a legitimate retailer. The shopper buys from the fraudulent storefront at an attractive price and pays with their own card. The fraudster fulfills that order by buying the same item from the legitimate retailer using a stolen card, shipping it directly to the shopper.
The shopper receives what they ordered. The fraudster keeps clean money. The loss lands on the retailer when the real cardholder disputes a charge for goods they never saw.
| Parties involved | Fraudulent seller, genuine shopper, legitimate retailer, victim cardholder |
| Where the storefront sits | Marketplaces, social commerce, standalone sites |
| What the fraudster gains | Clean card payment from a real customer |
| Who takes the loss | The retailer, through chargebacks |
| Secondary harvest | The shopper’s card details, collected by the fake storefront |
| Where it is catchable | Seller onboarding — the only identity the fraudster must create |
How triangulation fraud works
The scheme runs in four moves.
The storefront appears. The fraudster lists popular goods below market price, on a marketplace or a site of their own. The margin is irrelevant to them because they never intend to pay for inventory.
A real customer buys. They pay with their own card, to a real address, from a real device. Nothing about this transaction is fraudulent from their side, and they usually never learn anything was wrong.
The fraudster fulfills with a stolen card. They place an order at a legitimate retailer for the same item, paying with stolen details drawn from fullz or a carding market, and ship it to the customer’s address. To the retailer this reads as a gift order — a billing and shipping mismatch with an otherwise ordinary profile.
The dispute arrives later. Weeks afterward, the cardholder sees a charge for goods they never ordered and disputes it. The retailer loses the item, the shipping and the chargeback fee, and has nothing to represent with, because the delivery address does not belong to the cardholder.
Many operations run a second revenue line in parallel: the fake storefront captures the shopper’s card details, which are then sold or used directly.
Why it matters for identity verification
Triangulation is unusually hard to detect because no participant behaves anomalously except the one nobody is watching.
The shopper is real, paying from their own device to their own address. The retailer sees a single order with a mismatch that is indistinguishable from the millions of legitimate gift purchases made every year. The cardholder does nothing at all until they dispute. Every fraud control in the chain is examining a party whose behavior really is normal.
The one entity that must be fabricated is the seller. A triangulation scheme cannot operate without a storefront, and a storefront requires an account — which requires an identity, at a specific moment, before any of the rest can happen. That moment is the only point in the chain where the fraudster has to present something they do not have.
Verifying sellers at onboarding — a government document, a matched live face, and business details checked against a register — does not detect triangulation. It prevents the storefront from existing, which is a materially better outcome than detecting the orders it generates. It also changes the economics: fraudulent storefronts are disposable by design, closed as soon as complaints accumulate and reopened under a new account. Making each new account expensive attacks the cycle rather than its output.
What each party sees
| Party | What they experience | What they lose |
|---|---|---|
| The shopper | A cheap purchase that arrives as promised | Usually nothing — but their card details are exposed |
| The retailer | A normal order with a shipping mismatch | The goods, the shipping and the chargeback fee |
| The cardholder | An unexplained charge for goods never received | Nothing, once the dispute succeeds |
| The marketplace | A seller with rising volume and slow-building complaints | Trust, and liability under its own guarantees |
| The fraudster | Clean payment from a real customer | Nothing, until the seller account is closed |
The table explains why the scheme persists. The only party positioned to prevent it — the marketplace or platform hosting the storefront — is not the party absorbing the loss.
What triangulation fraud detection cannot do
Order-level scoring rarely catches it. Each fulfillment order is a single purchase with a billing and shipping mismatch. Scoring that pattern aggressively declines an enormous volume of genuine gift purchases for a small number of catches.
The retailer cannot see the scheme. Triangulation is only visible across parties — a storefront, its orders, and a set of retailer transactions that no one participant observes together. A retailer sees fragments that look ordinary in isolation.
Closing storefronts does not end it. Accounts are disposable. Removing one without raising the cost of creating the next converts enforcement into an endless queue.
Refunding the cardholder does not resolve the loss. It moves it. The dispute makes the cardholder whole at the retailer’s expense, which is why triangulation shows up in merchant chargeback ratios rather than in issuer fraud statistics.
Frequently asked questions
How is triangulation fraud different from clean fraud?
Clean fraud is a stolen card used to buy goods for the fraudster. Triangulation uses a stolen card to buy goods for a real paying customer, which is what converts the stolen card into clean money and adds an innocent third party who has no idea they are involved.
Does the shopper get in trouble?
No. They made a genuine purchase and received their goods, and in most cases never find out. Their exposure is that the fake storefront captured their card details, which may surface later as unrelated fraud.
Who is liable for triangulation fraud?
Predominantly the retailer that shipped against the stolen card, through the chargeback. Marketplaces may absorb some cost under buyer or seller guarantees, and the cardholder is generally made whole.
How can a marketplace detect triangulation?
By looking across orders rather than at them individually — a seller whose fulfillments repeatedly originate from third-party retailers, persistent underpricing against the market, and rapid volume growth on a new account. Verifying the seller’s identity at onboarding is more effective than detecting the pattern afterward, because it prevents the storefront rather than flagging it.
Related reading
- Clean fraud — the stolen-card transactions that fulfill triangulation orders
- Marketplace fraud — the broader category of schemes run through platforms
- Chargeback — the mechanism that delivers the loss to the retailer
- Drop address — the delivery endpoint in schemes where no real customer is involved
