What is third-party fraud?

Third-party fraud can begin with a stolen document and lead to unauthorized access to someone’s finances. In September 2026, two women were sentenced after using personal documents stolen from victims’ mail to open credit lines, activate cards, and access online bank accounts. They also transferred money from victims’ accounts and redirected their financial records.

Today, applications, account changes, and payments can all be handled online without the customer ever meeting the organization face to face. This can make impersonation harder to detect. A fraudster may use a stolen password or genuine identity document to pass as the legitimate customer.

Online document generators, template farms, and generative AI make it easier for fraudsters to create or alter documents that support an impersonation attempt. Templates provide ready-made layouts, while editing and generation tools can change details or produce new content without specialist design skills.

Let’s look at how third-party fraud works, the forms it takes, and how organizations can reduce the risk with AI.

What is third-party fraud?

Third-party fraud occurs when someone uses another person’s or organization’s identity, account, credentials, or payment information without authority to deceive an organization and obtain a benefit. They may seek approval for a loan, access to an account, goods, or a payout.

By contrast, first-party fraud occurs when a genuine applicant or account holder deliberately misleads an organization using their own identity.

Someone committing third-party fraud may support the impersonation with fabricated or altered documents, or with genuine documents they have no authority to use. The fraud may target an existing account or involve opening a new one.

For example, a fraudster could use someone else’s identity details to apply for a loan. If the lender approves the application, the fraudster receives the funds. The victim may later discover an account they never opened and have to dispute it. A business can also be the victim. A fraudster might impersonate a company to apply for credit or place an order in its name.

Fraudsters may obtain this information through identity theft, phishing, social engineering, data breaches, or other means. Identity theft is the unauthorized use of someone’s personal or financial information. In some cases, fraudsters may instead combine real and fabricated details to create a synthetic identity.

Identity theft can go undetected for months or longer, particularly when someone opens an account in the victim’s name.

Third-party fraud may come to light through unusual transactions, unexpected account changes, or discrepancies in identity information, such as a date of birth that differs from the one on file. ⁠Some victims may only discover unfamiliar accounts when reviewing their credit reports, hearing from a debt collector, or after their real accounts get frozen.

How third-party fraud works

Third-party fraud can occur during an application, through an existing account, or when someone requests a transaction or payout. The details vary by scheme, but most attempts follow a similar pattern:

1. Gather information. A fraudster obtains someone else’s identity details, login credentials, payment information, or company records through theft, phishing, data breaches, or public sources.
   
   
2. Pose as the victim. The fraudster submits an application, signs in to an account, or contacts the organization while claiming to be the person or business whose information they hold.
   
   
3. Support the impersonation. To pass verification, they may provide stolen genuine documents, altered or fabricated documents, or details that match the victim’s records.
   
   
4. Obtain the benefit. If the checks succeed, the fraudster directs the funds, goods, credit, or payout to an account or address they control.

In an account takeover, for example, this could mean using stolen login details to sign in and transferring funds to another account. Other schemes may involve opening a new account, using stolen payment details, applying for a loan, or submitting a claim in someone else’s name.

Why is third-party fraud important?

Third-party fraud is a major category of reported fraud, though organizations may record it under related labels such as identity fraud. Identity fraud alone accounted for 59% of fraud-risk cases recorded in the UK National Fraud Database in the first half of 2026.

These cases can leave organizations facing financial losses and investigations while victims work to regain access or correct their records. Even after fraud is detected, its effects can extend well beyond the initial act:

• Financial losses. A lender may advance money it cannot recover, or a merchant may fulfill an order made with stolen payment details. Who bears the loss depends on the circumstances and applicable rules.
  
  
• Victim recovery. A victim may need to close affected accounts, place fraud alerts, file reports, or provide documentation to remove fraudulent debts from their credit report. ⁠
  
  
• Wider criminal use. Stolen information can be used against multiple organizations. A compromised account may also expose additional personal information or be used to transfer funds, creating opportunities for further fraud.
  
  
• Operational costs. Investigations and fraud recovery take time, money, and resources. Teams may need to review applications and transactions, contact customers, preserve evidence, and handle disputes.
  
  
• Regulatory exposure. Organizations may also face anti-money laundering (AML), know your customer (KYC), data-protection, and payment-services obligations that affect how they detect, investigate, and respond to fraud. These obligations vary by sector and jurisdiction. For example, certain US banks with covered accounts must maintain a written identity-theft prevention program.
  
  
• Customer trust and reputation. A fraud incident can undermine confidence in an organization’s ability to protect customers. Poorly handled investigations or account recovery can add to that damage and make customers less likely to continue using the service.

Individual losses can be small, but repeated fraud can add up. Early detection gives organizations more opportunity to limit losses and support victims. At the same time, treating every discrepancy as fraud can delay or block genuine customers. Organizations need checks that protect against fraud without unnecessarily disrupting legitimate activity.

Types of third-party fraud

A fraudster may target a customer’s account, a company’s identity, or a payment credential. Each creates a different point of exposure, from account access to credit decisions. Understanding these patterns, including how different types of document fraud can support impersonation, helps organizations identify where to focus their checks:

Application fraud

In third-party application fraud, a fraudster uses another person’s identity details to apply for a product or service.

Real-world example: In one US case, a business consultant submitted hundreds of fraudulent financing applications to dozens of lenders under his business customers’ identities, with the funds payable to bank accounts he controlled. He was sentenced to 87 months in prison and ordered to pay more than $8.7 million in restitution to 57 victims.

Account takeover fraud

Account takeover fraud (ATO) occurs when someone gains unauthorized access to an existing account. Fraudsters may obtain login credentials through phishing or malware, or test credentials exposed in a data breach across multiple accounts. Once inside, they may change account details, make purchases, or transfer funds.

Real-world example: A US SIM-swapping scheme saw fraudsters hack victims’ email accounts and hijack their phone numbers to access their cryptocurrency accounts. They stole nearly $1 million from dozens of victims.

In the first half of 2026, Cifas members recorded 39,878 account-takeover cases, up 5% from the same period in 2025. ⁠⁠

Payment credential fraud

A fraudster uses someone else’s credit card, debit card, or other payment credentials without authorization. They may use stolen details for a single purchase or test them across multiple merchants and transactions.

Real-world example: In Florida, a man used stolen credit card numbers belonging to 36 victims to purchase theme park and hotel packages worth approximately $62,300.

Business impersonation

A fraudster uses a legitimate company’s identity without authority to obtain a benefit. Business registration details, officer names, and addresses may be publicly available, but that does not mean someone is authorized to apply for credit or open an account on the company’s behalf.

Real-world example: In one Virginia case, two men pretended to be the corporate representatives for legitimate manufacturing and trucking businesses and opened multiple fraudulent bank accounts in the names of the companies. They used the accounts to divert funds, including checks intended for the real businesses.

Fraudulent claims or payouts

Someone uses another person’s identity to submit a fraudulent insurance claim or seek a payout. The fraud can occur during a policy application, a claim, or a request to change payment details.

Real-world example: A New Jersey man admitted to a scheme where conspirators used stolen personal information to open new cellular telephone and insurance accounts, then filed fraudulent insurance and warranty claims for replacement phones. The replacement devices were shipped to mail receiving or virtual office locations the group maintained.

Synthetic identity fraud

In synthetic identity fraud, someone builds a new identity by combining real personal information, such as a genuine Social Security number (SSN), with fabricated details like a different name, date of birth, or address. The resulting identity doesn’t belong to any one person, but it can still pass checks that only confirm the data exists. When the real details belong to someone else, that person becomes a victim of third-party fraud.

Real-world example: A Florida-based fraudster used hundreds of different synthetic identities to obtain fraudulent credit cards and loans from financial institutions. To make the identities appear real, his scheme submitted over 100 false voter registrations in their names. In September 2026, he was sentenced to six years in prison and ordered to pay $458,839.69 in restitution.

What does third-party fraud look like in your industry?

The information a fraudster uses may be similar across industries, but the decisions they try to influence differ. A bank may need to assess an access request, while an insurer must decide whether to pay a claim.

What is third-party fraud in banking?

Third-party fraud in banking can occur when opening accounts, processing transfers, or responding to requests to change customer details. KYC and ongoing monitoring help identify suspicious activity, but fraud can occur at different points in the customer journey.

Examples include:

• Account opening. A fraudster uses stolen identity details to open a bank account in someone else’s name.
  
  
• Unauthorized transfers. Someone accesses a customer’s online account and transfers funds without permission.
  
  
• Customer impersonation. An impersonator contacts the bank, posing as a customer to change the account’s contact details.
  
  
• Business impersonation. Someone uses a company’s information to open a business account while falsely claiming to represent it.

What is third-party fraud in lending?

Fraudsters can undermine underwriting by submitting someone else’s identity details alongside stolen or fraudulent documents. This can lead a lender to assess the victim’s credit history and financial information when deciding whether to approve the loan and at what interest rate. If successful, the lender may be left with a loan it cannot recover, while the victim may need to dispute an account they did not open.

Examples include:

• Personal loan fraud. A fraudster uses someone else’s identity details to pass lending KYC checks, obtain a loan, and direct the funds to an account they control.
  
  
• Auto financing fraud. Someone uses stolen identity details to finance a vehicle without the victim’s knowledge.
  
  
• Business loan fraud. An impersonator applies for financing using a company’s information and falsely claims to represent it.
  
  
• Credit line takeover. A fraudster accesses an existing credit account and draws funds without the account holder’s permission.
  

What is third-party fraud in insurance?

In insurance fraud, impersonators can exploit policy applications, claims, and payout processes. An insurer may need to establish who is making a claim and whether that person is entitled to the benefit.

Examples include:

• Auto insurance fraud. A fraudster uses someone else’s identity or policy to seek payment for a vehicle claim. In one California case, investigators alleged that a woman bought a policy using stolen identity details and claimed that a vehicle had been damaged after hitting a pothole.
  
  
• Medical claims fraud. Someone uses a patient’s information to submit a claim for services the patient never received, potentially creating inaccurate medical records for the victim. ⁠
  
  
• Life insurance fraud. A fraudster poses as a beneficiary to seek a payout from a deceased person’s policy. ⁠
  
  
• Policy account takeover. Someone gains access to a policyholder’s account and changes payout details to redirect a payment.

What is third-party fraud in payments?

A fraudulent payment can pass through the same process as a legitimate one. Fraudsters use stolen card details or compromised accounts to buy goods and move money, leaving account holders, merchants, and payment providers to deal with disputes and potential losses.

Examples include:

• Online card fraud. A fraudster uses stolen card details to buy goods from an online merchant.
  
  
• Counterfeit card fraud. Someone copies card data onto a counterfeit card and uses it to make purchases in person.
  
  
• Digital wallet takeover. A fraudster accesses someone’s digital wallet and uses its stored payment methods to make purchases.
  
  
• ACH fraud. A fraudster uses stolen bank account and routing details to initiate an unauthorized Automated Clearing House (ACH) debit from the victim’s account. ACH is a US payment network. ⁠

Some scams also trick customers into authorizing payments themselves, as in authorized push payment (APP) fraud. Others use fake payment screenshots and confirmations to convince someone that money has been sent when it hasn’t, on platforms like Cash App, Revolut, Venmo, and Zelle. These schemes are distinct from the unauthorized transactions described above, though all involve fraud.

What is third-party fraud in marketplaces?

Fraudsters can exploit both sides of a marketplace. They may impersonate a business to open a seller account or take over an existing account to make purchases, post listings, or redirect payouts. A fraudulent seller can gain access to buyers and payment systems before the impersonation is discovered. ⁠

Examples include:

• Seller impersonation. A fraudster uses a legitimate company’s details to open a seller account, then lists goods and collects payment without delivering them.
  
  
• Seller account takeover. Someone gains access to an existing seller account and changes the payout details to divert sales revenue.
  
  
• Buyer account takeover. A fraudster accesses a customer’s account and orders goods using a stored payment method.
  
  
• Triangulation fraud. A fraudster sells an item to a buyer, then uses stolen payment details to purchase it from a legitimate retailer and have it shipped to the buyer. The cardholder may later dispute the unauthorized charge.

Best practices for preventing third-party fraud

Fraud prevention processes vary by industry, but the following best practices can generally help organizations streamline operations, strengthen compliance, and reduce their exposure to third-party fraud.

• Apply checks in proportion to risk. Depending on risk appetite, give higher-risk applications and transactions closer scrutiny while reducing unnecessary friction for legitimate customers.
  
  
• Verify identity and authority. Check identities at onboarding and authenticate sensitive requests. For businesses, verify the company, check its know your business (KYB) documents, and assess the applicant’s authority to act for it.
  
  
• Secure access and recovery. Use multi-factor authentication to reduce the risk of access with a stolen password. For account recovery, avoid relying solely on personal details a fraudster may already possess.
  
  
• Check supporting documents. Use document verification to examine evidence for alteration, fabrication, or reuse. When possible, corroborate key details independently.
  
  
• Monitor activity and connections. Use transaction monitoring and risk scores to flag unusual activity, such as a payout-detail change followed by an unusual transfer. Look for shared documents, devices, or payment details across accounts that may point to a wider scheme.
  
  
• Investigate and resolve discrepancies. Request additional evidence where needed, record the outcome, and give genuine customers a way to correct errors or regain access. Explain how customers can report suspected impersonation.
  
  
• Coordinate due diligence and reporting. Share evidence with authorized teams, apply enhanced due diligence where appropriate, and report suspicious activity when required. These obligations vary by sector and jurisdiction. ⁠
  
  
• Test and tune controls. Review missed fraud and false positives, and adjust rules, models, and review thresholds as risks change.

Detect third-party fraud with AI

A fraudster may support an impersonation attempt with stolen or convincing fake documents. As submission volumes grow, manual review leaves teams with less time to investigate cases that need closer attention. Here’s how AI can help lighten the load for reviewers:

• Examining documents. AI-powered document verification can analyze file structure and visual features across document types for signs of editing or AI generation, without a separate template for each issuer. Explainable indicators show reviewers what triggered a flag. ⁠
  ⁠
• Connecting submissions. Comparing files across applications can uncover patterns that may be missed when cases are reviewed individually. At Payoneer, this helped identify serial fraud involving recycled document templates. ⁠
  
  
• Take a layered approach. Bringing document, device, and transaction signals together can help investigators assess whether separate indicators are part of the same impersonation attempt, rather than treating each signal in isolation.

Conclusion

As more applications and transactions happen remotely, fraudsters can combine stolen information with genuine or altered documents to impersonate someone else. Organizations may approve fraudulent applications or payments, while victims must recover accounts or dispute activity they did not authorize.

Resistant Documents examines document structure for signs of manipulation and identifies reused templates across submissions. Its explainable findings support the broader identity and account checks needed to investigate third-party fraud.

Bring hidden document signals to light in your fraud investigations.

Scroll down to book a demo.