What triangulation fraud is, and why your store eats the chargeback
A dispute lands weeks after a clean delivery. AVS matched, the parcel scanned as delivered, the customer never emailed you, and the reason code says the cardholder never authorized the purchase. Nothing in your admin looks wrong, and you are still going to lose this one.
That pattern is often triangulation fraud, and you are the store at the wrong corner of the triangle.
What is triangulation fraud?
Triangulation fraud is a three-party scheme: a criminal sits between a real shopper and a real store, collecting the shopper's money while making your store pay for the goods with a stolen card.
Visa describes it plainly in its own fraud-scheme material, checked August 7, 2026: "Illegitimate online merchants take a customer's order and charge the customer's payment account. They then use an unassociated, legitimate merchant to fulfill the customer's order and pay for the goods or service using stolen payment account information."
You are the unassociated, legitimate merchant. The shopper who placed the fake order is not your customer and never was. The card that paid you belongs to a third person who has no idea their number is in circulation, and the fraudster in the middle takes a cut off each side.
The reason it survives is that every visible signal on your order is real: a genuine person wants the item, a genuine card clears the authorization, a genuine parcel reaches a genuine doorstep. The only thing wrong is what you cannot see at checkout: the person holding the card did not consent to the charge.
How does triangulation fraud work?
The mechanics are worth walking slowly, because each step looks legitimate in isolation.
A fraudster lists an in-demand product cheaply on a fake storefront, marketplace listing, or social-media shop. A real shopper hunting for a deal buys it and pays the fraudster. The fraudster then orders that same product from your store with a stolen card, shipping to the shopper's address. Your store ships real inventory to a real person, and the fraudster keeps the shopper's payment in full. Weeks later the true cardholder disputes a charge they never made, and it lands on you.
Here is where the money and the goods actually go.
| Party | Their role | What happens to their money | What happens to the goods |
|---|---|---|---|
| The fraudster | Lists goods cheaply, then reorders from you on a stolen card | Keeps the shopper's payment, pays you nothing of their own | Never touches the item |
| The unwitting shopper | Buys the deal, pays the fraudster | Pays and loses that money to the fraudster | Receives the parcel your store shipped |
| Your store | Fulfills a genuine order placed with a stolen card | Charged, then charged back weeks later, plus a fee | Ships real inventory, gone for good |
| The true cardholder | Never shopped with you | Files the dispute to reverse a charge they never made | Never receives anything |
The unwitting shopper usually never learns a crime happened, because they got what they paid for. In some versions the shopper and the cardholder are the same victim, their card skimmed on the fake store and reused at yours. Either way the store that fulfilled the order carries the loss.
How do you detect triangulation fraud?
Not from any single field. It arrives as card-not-present fraud, so the tools that catch a fumbled card number pass it clean. What you have is a set of signals that shift the odds, most of them in the gap between who paid and who received.
| Red flag | Why it points to triangulation |
|---|---|
| Billing identity does not match the shipping recipient | The cardholder and the person receiving the goods are different people, which is the whole shape of the scheme |
| Buyer email or phone does not match the recipient name | The order was placed by someone who is neither the cardholder nor the person at the door |
| Reshipper or freight-forwarder shipping address | A known method for putting distance between the stolen card and the delivered goods |
| Repeat orders of the same in-demand SKU to different addresses on different cards | One operator working a product line, not many unrelated shoppers |
| AVS and CVV pass, but behavior does not fit | A criminal holding full stolen card details clears verification the same way a real buyer does |
The trap is treating any one of these as proof. Plenty of honest orders ship to a different name: a gift, a workplace, a family member. A freight forwarder is normal for cross-border buyers. What raises the alarm is several signals stacking on one order, or the same SKU walking out to a string of unrelated addresses on unrelated cards inside a short window.
This is fraud screening, a different job from what preventing avoidable disputes does. Triangulation is not an avoidable dispute caused by a confusing descriptor or a slow refund. The card really was used without consent, so the lever is order-time risk review, not post-purchase clarity. It is also the opposite of first-party fraud, where the cardholder made the purchase and later denies it. Here the cardholder is telling the truth.
Can you fight a triangulation fraud chargeback?
Rarely with success, and it is worth being honest about why.
Chargeback representment works by contradicting the cardholder's allegation. On a card-absent fraud claim, filed under Visa reason code 10.4, the allegation is that the cardholder never authorized the charge. In triangulation that allegation is true. You can prove the parcel shipped and even delivered, but delivery to the fraudster's chosen address does not prove the cardholder agreed to buy anything.
The one Visa remedy built for 10.4, Compelling Evidence 3.0, leans on a history of prior undisputed transactions on the same card. A stolen card used once at your store has no such history, so the argument that rescues a friendly-fraud case is unavailable here. You are left answering a genuinely unauthorized charge, the hardest position in the dispute system.
That does not make every case hopeless. Occasionally the same card or address ran multiple orders through you, or you hold evidence the shopper confirmed receipt in a way that links back to the cardholder. Those are worth assembling. A representment runs 20 to 45 minutes, and a chargeback fee of $15 to $25 or more is already gone regardless of outcome. We made representment free at Redo, no install fee and no success fee, so the arithmetic on a long-shot filing is the labor rather than a cut of nothing.
The honest part
Most triangulation chargebacks are a real fraud loss, and no dispute response reverses one. Treating them as a representment problem is how a store keeps eating them. The work is at the front door.
Be careful with the numbers you read on this. Chargebacks911's triangulation statistics guide, checked August 7, 2026, puts triangulation at around 26% of ecommerce fraud, attributing the figure to Worldpay. I could not trace that share to a primary report with a published methodology, so I would treat it as directional, not exact. What I can state from the mechanics is narrower and more useful: each of these disputes counts toward your Visa VAMP ratio from the day it is filed, win or lose, so a run of triangulation orders inflates both your fraud losses and the ratio your acquirer watches. Winning the odd one back does not remove it from that count.
The prevention levers are real but come with a cost. Blocking freight-forwarder and reshipper addresses stops a common path and also turns away legitimate cross-border buyers. Holding orders where billing and shipping identities diverge catches the pattern and delays gifts and workplace deliveries. Manual review of sudden repeat demand on one SKU works but does not scale. Every one trades a fraud catch against a false decline, and the right setting depends on your margins and volume, not a universal rule.
Frequently asked questions
What is triangulation fraud in ecommerce?
A three-party scheme where a fraudster lists goods cheaply on a fake storefront, a real shopper buys and pays the fraudster, and the fraudster then orders the same item from a legitimate store using a stolen card, shipping it to the shopper. The fraudster keeps the shopper's payment, the legitimate store ships real inventory, and the true cardholder later disputes the charge, leaving that store with the chargeback and the lost goods.
Who loses money in a triangulation fraud scheme?
The store that fulfilled the order. The shopper usually gets what they paid for, the fraudster keeps their money, and the true cardholder is refunded by their bank once they dispute the unauthorized charge. The chargeback and the lost inventory both land on the store that shipped the goods.
What reason code does triangulation fraud come in under?
On Visa it typically arrives as reason code 10.4, Other Fraud, Card-Absent Environment, because the true cardholder is reporting a charge they did not authorize. Other networks number card-absent fraud differently but allege the same thing.
Can you win a triangulation fraud chargeback?
Usually not. Representment works by disproving the cardholder's allegation, and in triangulation the allegation that the charge was unauthorized is true. Proving the parcel shipped does not prove the cardholder agreed to buy it, and the stolen card has no prior undisputed history to lean on. Some cases with repeat activity on the same card or address are worth filing, but most are a genuine fraud loss.
What to check on your own orders
Pull a recent slice of your 10.4 disputes and put two columns next to each one: the billing name on the card, and the name and address the parcel shipped to. Then flag every order where those two identities diverge.
That single mismatch, the person who paid against the person who received, is the fault line triangulation runs along. Count how many of your card-absent losses sit on it, and whether any SKU or shipping address shows up more than once. If the answer is more than a handful, your problem is at checkout risk review, not the dispute queue, and that is where the next hour of work belongs.