Triangulation fraud is a scheme that involves three parties: an unsuspecting buyer, a fraudulent seller, and a legitimate merchant who never learns anything was wrong until a chargeback arrives. The fraudster profits by using stolen payment details to fulfill real orders through a real store, leaving the legitimate merchant to absorb the loss weeks later.
What is triangulation fraud?
In triangulation fraud, a fraudster either sets up a fake online store or uses a seller account on a legitimate marketplace, often listing popular products at attractive prices with stolen images and descriptions copied from real retailers. A genuine buyer, unaware that anything is wrong, buys and pays for the item through the fake storefront.
The fraudster then takes the buyer’s order details and uses a different set of stolen payment credentials to place a matching order with a real, legitimate merchant, and ships the item directly to the original buyer. From the buyer’s perspective, they received exactly what they ordered, often at a good price. From the legitimate merchant’s perspective, they fulfilled what looked like an ordinary order using a card that appeared to be valid at the time of purchase.
The fraud surfaces only when the actual cardholder, whose stolen payment details were used for the second purchase, notices the unauthorized charge and disputes it. The chargeback lands on the legitimate merchant, who has already shipped the product and now loses both their merchandise and the payment.
Why triangulation fraud is difficult to detect
Triangulation fraud is built to look identical to a legitimate transaction at every point a merchant can normally check. Both the shipping address is real and belongs to an actual person, and the order value and product category look pretty normal. Standard fraud checks like address verification can pass cleanly, since the fraudster isn’t shipping the item to their own address, but instead directly to the unwitting buyer.
This is a noticeable change from most card-not-present fraud, where a stolen card is used to ship goods to an address controlled by the fraudster, a pattern that address mismatch and shipping velocity checks are built to catch. Because items get shipped directly to the buy, triangulation fraud sidesteps that defense completely which is part of why it can occur even at merchants with more mature fraud programs.
How big of a problem is triangulation fraud?
Triangulation fraud is estimated to cost somewhere in the tens of billions of dollars annually, though the exact estimate varies between sources. Merchant Risk Council survey data cited in recent industry analysis found that more than 40% of member merchants reported being hit by a triangulation attack within the past year, suggesting the scheme has moved well beyond a niche concern for online sellers.
The broader card-not-present fraud environment that triangulation schemes exploit continues to grow. UK Finance reported that remote purchase fraud cases rose 22% in 2024, reaching nearly 2.6 million incidents with losses climbing 11% to just under 400 million pounds, a trend consistent with the growth in sophisticated schemes that mimic ordinary commerce instead of relying on obviously fraudulent patterns.
Merchants also face a secondary cost beyond the immediate chargeback. Card network dispute-monitoring programs penalize merchants whose chargeback ratios exceed defined thresholds, and a wave of triangulation-driven disputes can push a merchant into those penalty tiers even when the merchant itself did nothing wrong at the point of sale.
How triangulation fraud differs from other fraud methods
Triangulation fraud is sometimes confused with simple dropshipping fraud, but the distinction matters for detection. Ordinary dropshipping is a legitimate business model in which a seller fulfills orders directly from a supplier without holding inventory, using their own valid payment method. Triangulation fraud copies that structure but substitutes stolen payment credentials for the second transaction, turning an otherwise legal and ordinary fulfillment pattern into a mechanism for laundering stolen card data.
It is also different from account takeover, where a fraudster gains control of an existing account. In triangulation fraud, the buyer’s transaction with the fake storefront is genuine on the buyer’s end; it is the second transaction, where the fraudster places it with another person’s stolen card details at a different merchant, that constitutes the theft.
What effective detection looks like
Because triangulation fraud passes all of the fraud checks at the point of sale, catching it requires signals that go beyond a single transaction’s surface details.
Cross-merchant pattern recognition helps identify when stolen card credentials are being used across multiple, seemingly unrelated merchants in ways that share a common fulfillment pattern, such as identical shipping addresses appearing alongside different cardholder names.
Behavioral and velocity signals can flag an order that, while individually unremarkable, fits a pattern consistent with a card testing or resale operation feeding orders into legitimate storefronts.
Device and network intelligence can surface links between a fraudulent storefront and the transactions it generates at other merchants, even when those merchants have no direct relationship or shared data pipeline.
Sift’s Payment Protection draws on signals across a broad merchant network, so a stolen card pattern identified at one business can help flag related activity elsewhere in the Fraud Economy before it reaches a merchant that would otherwise see nothing unusual about the order.
What merchants can do beyond automated detection
Marketplaces hosting third-party sellers carry a particular responsibility, since a fake storefront is often the origin point of a triangulation scheme. Reviewing new seller accounts for signs of copied product listings, unusually aggressive pricing on popular items, and thin account history can catch the fraudulent storefront before it generates a wave of downstream chargebacks. Sift’s Content Integrity capabilities help marketplaces evaluate listings and seller behavior for exactly these patterns, reducing the odds that a fraudulent storefront operates long enough to victimize both a buyer and a legitimate merchant.
If your team has been facing triangulation fraud, then Sift might be a perfect choice for solving it. To learn more about how Sift can help you, read more here.
Frequently asked questions
Who is the victim in a triangulation fraud scheme?
There are two victims in triangulation fraud: the merchant that unknowingly ships goods paid for with a stolen card and later absorbs the chargeback, and the cardholder whose payment details were stolen and used without their knowledge.
Does the buyer who ordered from the fake storefront know they are involved in fraud?
Typically not. The buyer places what looks like an ordinary order with a storefront that appears legitimate, pays through that storefront, and receives the product they ordered, so from their end, there isn’t any reason to believe that the fraudster fulfilled it with any wrongdoing.
Can address verification systems catch triangulation fraud?
Rarely on their own. Since the fraudster ships to the real buyer’s real address rather than an address they control, standard address verification and shipping mismatch checks that catch other forms of card fraud typically pass without raising a flag. Because of this, catching triangulation fraud usually requires using special signals that go further beyond surface details.
