Know Your Enemy: A Practitioner's Guide to Fraud Typologies

Financial institutions today face a fraud landscape that has grown both in scale and sophistication. Two distinct but equally corrosive threats sit at the heart of this challenge: first-party fraud, perpetrated by the customer themselves, and third-party fraud, where an external actor exploits a customer's identity or account without their knowledge. Addressing only one while ignoring the other leaves a critical gap that bad actors readily exploit.

First-party fraud occurs when a genuine customer deliberately misrepresents information for financial gain. This includes application fraud (falsifying income, employment, or identity details to obtain credit), bust-out fraud (building up credit lines only to exhaust and default on them), and friendly fraud (disputing legitimate transactions). What makes this category particularly insidious is its invisibility: these customers pass standard identity checks because they are who they claim to be. The fraud is in the intent, not the identity.

Synthetic identity fraud: the gray zone

Synthetic identity fraud occupies a gray zone between first and third-party fraud. Fraudsters combine real and fabricated personal data — a genuine Social Security number with a fictitious name and address, for instance — to create a wholly new persona. These synthetic identities can remain dormant for months, sometimes years, building creditworthiness and establishing a seemingly legitimate financial footprint before executing a bust-out. This makes them one of the costliest typologies in lending, and one of the hardest to catch at origination because the identity itself appears internally consistent.

Key first-party signals

Third-party fraud targets a genuine and unsuspecting customer. The perpetrator is an external actor — not the account holder — using stolen, fabricated, or socially engineered access to exploit either the institution or the customer directly.

Account takeover (ATO), where criminals gain control of an existing account through credential theft or social engineering, has accelerated sharply with the proliferation of phishing campaigns and data breaches. Once inside a genuine account, the attacker benefits from the customer's established history — bypassing controls designed to catch new or anomalous behavior.

New account fraud using stolen identities follows a similar logic applied at origination: the fraudster presents a real person's identity documents and data, passes verification, and then exploits the newly opened account before the institution detects the disconnect between the account holder and the actual operator.

Authorized push payment (APP) scams represent a distinct and rapidly growing third-party typology. The customer is manipulated — through impersonation of trusted institutions, investment scams, or romance fraud — into voluntarily transferring funds to a fraudster-controlled account. Critically, the customer authorizes the transaction. The institution may bear reputational and regulatory consequence even where no technical system failure occurred.

The operational response to first-party and third-party fraud differs significantly. First-party fraud requires controls at origination — stronger application validation, identity verification, and behavioral monitoring in the early lifecycle of a product. Third-party fraud requires strong authentication, anomaly detection on existing accounts, and customer-facing friction at moments of high risk (large payments, credential changes, new device access).

But the distinction breaks down at the detection layer. A customer flagged for suspicious deposit behavior — high-velocity inbound credits, rapid internal transfers, unusual outbound payments — may be a first-party fraud actor structuring proceeds. Or they may be a third-party fraud victim whose account has been compromised and is being used as a mule. The behavioral signal is substantially the same. The intervention, the customer communication, and the SAR filing decision will differ — but the upstream detection logic does not.

The case for a unified detection framework — one that operates across both fraud types simultaneously rather than maintaining parallel, siloed controls — rests on three arguments.

First, signal overlap. As described above, many behavioral signals are diagnostic of both fraud types. A unified framework evaluates the full signal set and determines the most likely scenario, rather than routing the customer through separate rule sets that may reach contradictory conclusions.

Second, organized fraud complexity. Sophisticated fraud operations deliberately blend first and third-party typologies. A fraud ring may use synthetic identities (first-party characteristics) to open accounts that are subsequently exploited by third-party operators, with genuine mule customers (third-party victims) used as intermediaries. Siloed detection frameworks cannot surface this network structure. Only a unified view — capable of linking accounts, devices, behaviors, and identities across typologies — can detect the ring rather than individual transactions.

Third, operational efficiency. Maintaining separate investigation workflows, alert queues, and case management systems for first and third-party fraud creates duplication, increases false positive rates, and fragments institutional intelligence. A single framework with typology-specific response logic is both more accurate and more operationally sustainable.