Skip to main content
Commerce Security Authority
Category: Fraud Typologies

First-Party Misuse

Also known as: Friendly Fraud, First-Party Fraud
Simply put

First-party misuse occurs when a legitimate cardholder or account holder disputes a charge or manipulates their own account to gain money or goods, rather than a criminal using a stolen identity. A common example is a customer who received a product or service but files a chargeback claiming otherwise. This behavior is often described as 'friendly fraud' because it comes from the account's rightful owner rather than an outside attacker.

Formal definition

First-party misuse refers to disputes or chargebacks initiated by the genuine cardholder or account holder based on false or erroneous claims, or to the manipulation of one's own identity or account for personal or financial gain, as distinct from third-party fraud involving compromised credentials or stolen identities. According to the Merchant Risk Council, first-party misuse can account for a substantial share of fraud-related chargebacks for some merchants, though exact figures depend on source, period, and methodology. Because these disputes originate from the legitimate account holder, they are difficult to detect with controls designed for unauthorized-use fraud, and their handling is governed by card brand and network dispute and chargeback rules, which vary by region and change over time. Note that some sources use the term more broadly to include misconduct originating from within an organization; practitioners should confirm the intended scope in any given context.

Why it matters

First-party misuse is difficult to address because the person initiating the dispute is the legitimate account holder rather than an outside attacker using stolen credentials. Controls designed to detect unauthorized-use fraud, such as device fingerprinting, credential-compromise signals, or checks for stolen identity data, are largely ineffective here because the transaction was genuinely authorized by the rightful cardholder. This means merchants can face financial loss and operational cost even when their upstream fraud defenses are working as intended.

The scale of the problem can be significant for some merchants. According to the Merchant Risk Council, first-party misuse can account for a substantial share of fraud-related chargebacks for some merchant members, though exact figures depend on source, period, and methodology and should not be assumed to apply uniformly across businesses or regions. Because these disputes are resolved under card brand and network dispute and chargeback rules, which vary by region and change over time, the remedies and evidence requirements available to a merchant are not fixed and must be confirmed against current network rules.

Practitioners should also note terminology ambiguity: some sources use "first-party fraud" or "first-party misuse" more broadly to include misconduct originating from within an organization, rather than only cardholder-initiated chargeback abuse. Confirming the intended scope in any given context helps avoid misclassifying the problem and applying the wrong controls or metrics.

Who it's relevant to

Merchant Risk and Fraud Teams
First-party misuse can represent a large portion of fraud-related chargebacks for some merchants, and it evades controls built for unauthorized-use fraud. These teams need to separate first-party disputes from third-party fraud in their analysis, since the two require different detection approaches and mitigations.
Chargeback and Dispute Management Staff
Because first-party misuse involves chargebacks based on false or erroneous claims, dispute teams must gather and present transaction and delivery evidence under the applicable card brand and network rules. Those rules govern timelines and evidence standards, vary by region, and change over time, so processes should be confirmed against current requirements.
Issuers and Acquirers
Issuing banks are expected to evaluate disputes carefully before initiating a chargeback, and acquirers relay representment evidence from merchants. Both operate within network dispute and chargeback rules, making accurate classification of first-party versus third-party claims important to fair resolution.
Compliance and Terminology Owners
Some sources define first-party misuse narrowly as cardholder-initiated chargeback abuse, while others extend it to misconduct originating from within an organization. Those responsible for policy and reporting should confirm the intended scope in each context to avoid misclassifying incidents or metrics.

Inside First-Party Misuse

First-Party Misuse (Friendly Fraud)
A dispute or chargeback initiated by the legitimate cardholder (or someone with authorized access to the account) for a transaction they in fact authorized, often described as friendly fraud or first-party fraud to distinguish it from third-party fraud where an unauthorized party uses the card.
Legitimate Authorization
The defining characteristic is that the original transaction was genuinely authorized by the account holder, which separates first-party misuse from account takeover or stolen-card fraud where a different party initiates the purchase.
Dispute and Chargeback Process
The mechanism through which first-party misuse is exercised, governed by card brand and network rules that vary by region and change over time, including reason codes, evidence requirements, and representment timelines. Practitioners should confirm current rules against the applicable network's published documentation.
Intent Spectrum
First-party misuse ranges from deliberate abuse (knowingly disputing a valid purchase to obtain goods and a refund) to non-malicious causes such as unrecognized descriptors, forgotten subscriptions, family member purchases, or buyer's remorse, which affects how disputes should be triaged.
Distinction from Chargeback Fraud
First-party misuse overlaps with chargeback fraud but is framed from the cardholder-relationship perspective; both involve a cardholder-initiated dispute of an authorized transaction, while third-party fraud, account takeover, and synthetic identity fraud involve unauthorized actors and are categorized separately.
Evidence and Compelling Evidence
Documentation a merchant may submit during representment to demonstrate the cardholder received the goods or services and authorized the transaction; specific compelling-evidence criteria are defined by individual card networks and differ between programs and versions.

Common questions

Answers to the questions practitioners most commonly ask about First-Party Misuse.

Is first-party misuse the same as third-party fraud where a stranger uses stolen card data?
No. First-party misuse (often called friendly or first-party fraud) involves the legitimate cardholder or someone authorized on the account disputing or repudiating a transaction they actually made or benefited from, rather than a third party using compromised credentials. Because the genuine account holder is involved, many controls designed to detect unauthorized third-party use, such as credential or device anomaly checks, may not flag the activity. Distinguishing the two matters because the investigative evidence, dispute handling, and applicable card brand and network rules differ. Note that terminology and dispute categorization vary by card brand and region, so confirm classifications against the current network rules.
Can strong authentication controls like 3-D Secure or multi-factor authentication stop first-party misuse?
Not reliably. Authentication controls such as EMV chip authentication, 3-D Secure, strong customer authentication, and multi-factor authentication are intended to confirm that the person transacting is the legitimate cardholder. In first-party misuse the legitimate cardholder is the one transacting and later disputing, so successfully authenticating the transaction does not address the behavior. These controls may help produce evidence that the genuine cardholder participated, which can be relevant in a dispute, but they are not designed to prevent a cardholder from later repudiating a transaction. No single control eliminates this risk.
What evidence is useful when contesting a suspected first-party misuse dispute?
Useful evidence typically includes records that tie the genuine cardholder to the transaction and the goods or services received, such as authentication outcomes, delivery or access logs, account or login history, communications, and prior transaction patterns on the account. The specific evidence that a network will accept, and the formats and deadlines for submitting it, are defined by card brand and network dispute rules, which change and vary by region. Confirm the current representment or dispute-response requirements with your acquirer or the applicable network before relying on any particular evidence type.
How should detection logic for first-party misuse differ from unauthorized-use fraud detection?
Detection for unauthorized third-party use tends to focus on signals that a different person or device is involved, such as credential anomalies, geolocation mismatches, or velocity spikes. First-party misuse detection instead looks for patterns consistent with the genuine account holder later repudiating legitimate activity, such as repeated dispute history on an account, disputes filed after goods are received or consumed, or inconsistencies between claimed and observed account behavior. Any such logic carries false-positive and false-negative trade-offs: aggressive rules may flag legitimate disputes from genuinely wronged cardholders, while lenient rules may miss repeat behavior.
Does handling first-party misuse expand or change PCI DSS scope?
PCI DSS scope is driven by where account data, including cardholder data and sensitive authentication data, is stored, processed, or transmitted, not by the fraud category being investigated. Building evidence for a first-party misuse dispute can involve retaining transaction and account records, so teams should ensure any retained data respects the distinction between cardholder data, which may be stored under defined controls, and sensitive authentication data, which must not be stored after authorization even when encrypted. Confirm applicable requirements against the current published PCI DSS, since requirement numbering and wording differ between versions.
How can a merchant reduce exposure to first-party misuse operationally?
Practical measures that may help reduce exposure include maintaining clear records of delivery, service access, and cardholder interaction; keeping accurate merchant descriptors so cardholders recognize charges on statements; documenting terms and confirmations at the point of sale; and tracking dispute history to identify repeat patterns. These steps are intended to lower the likelihood of misattributed or opportunistic disputes and to support representment, but none guarantees a favorable outcome, and dispute eligibility and liability are ultimately governed by card brand and network rules that vary by region and change over time.

Common misconceptions

First-party misuse is the same as third-party fraud and can be stopped with stronger authentication controls like EMV, 3-D Secure, or multi-factor authentication.
Those controls address unauthorized use by a different party. In first-party misuse the legitimate cardholder authorized the transaction, so authentication controls may not prevent the subsequent dispute and can even strengthen the merchant's evidence rather than block the misuse itself.
All first-party disputes are deliberate fraud by the cardholder.
Many disputes stem from non-malicious causes such as unrecognized billing descriptors, forgotten recurring charges, or purchases by family members. Treating every case as intentional fraud can increase false positives and harm legitimate customer relationships; disputes should be triaged rather than assumed.
Winning representment or applying network compelling-evidence rules guarantees recovery and eliminates first-party misuse.
Chargeback and representment outcomes are governed by card brand and network rules that vary by region and change over time. Evidence helps improve the likelihood of a favorable outcome but does not guarantee it, and no single control eliminates first-party misuse.

Best practices

Triage disputes by likely cause, separating deliberate abuse from non-malicious triggers such as unrecognized descriptors, forgotten subscriptions, or authorized family purchases, before deciding whether to represent or refund.
Use clear, recognizable billing descriptors and proactive purchase and renewal notifications to reduce disputes caused by confusion rather than intent.
Retain order, delivery, authentication, and usage records that may serve as compelling evidence, aligning documentation with the current published requirements of the applicable card networks.
Confirm reason codes, evidence standards, and representment timelines against current card brand and network rules for each relevant region, since these vary and change over time.
Monitor first-party dispute rates and representment outcomes to tune response strategies, recognizing the trade-off between challenging disputes and preserving legitimate customer relationships.
Coordinate fraud, disputes, and customer support functions so that first-party misuse is analyzed distinctly from account takeover, stolen-card, and synthetic identity fraud, which require different mitigations.