Triangulation fraud is a three-party scam: a fraudster opens a fake storefront, a real shopper buys a real product from it, and the fraudster buys that product from your store with a stolen card. You ship the goods, the cardholder disputes the charge, and you eat the chargeback and the lost product.
The three parties
Triangulation fraud has three parties and the merchant is the one who loses. The fraudster opens a fake storefront selling a real product at a discount. A real shopper finds the storefront, buys the product, and pays the fraudster. The fraudster then buys the same product from a real merchant, using a stolen card, and has it shipped directly to the shopper. The shopper gets the product. The fraudster keeps the money. The merchant ships the goods and gets a chargeback.
The scheme works because every party except the merchant gets what they want. The shopper got a good price on a real product and has no reason to complain. The fraudster got paid and never touched the goods. The merchant is the only one who did not know what was happening, and the merchant is the one who pays for it twice: once for the lost goods, once for the chargeback.
The orders look legitimate, which is the problem. The shopper is real, the shipping address is real, and the product is real. The only thing that is fake is the card, and the merchant cannot see that from the order. The fraud is invisible at the point of sale and obvious only in hindsight, when the chargeback arrives.
Why the merchant eats it
When the cardholder discovers the charge, they dispute it, and the dispute goes to the merchant who took the card. That merchant is you. The chargeback is filed under Visa reason code 10.4, which covers disputes where the merchant cannot show the cardholder authorized the transaction. The merchant cannot show it, because the cardholder did not authorize it. The fraudster did.
Visa's Compelling Evidence 3.0 gives merchants a way to fight the dispute, by showing evidence that the cardholder received the goods and used them. But triangulation makes that evidence hard to produce, because the goods went to the shopper, not the cardholder, and the merchant's records show a delivery to an address the cardholder does not recognize. The evidence that would win a normal dispute does not exist for a triangulation dispute.
The scale is significant. The Merchant Risk Council's 2026 report found that merchants lose about 3.2 percent of ecommerce revenue to payment fraud, and more than 40 percent of MRC members said they had been hit by triangulation fraud in the past year. Chargebacks911 and Worldpay have estimated that triangulation accounts for about 26 percent of ecommerce fraud. This is not a niche scheme. It is one of the largest fraud types in ecommerce.
The signs in the order
Triangulation orders have tells, but they are subtle. The shipping address does not match the billing address, which is normal for a gift but a flag when combined with other signs. The customer is new, the order is for a high-value product, and the product is one that resells well. The order comes from a device or an IP address that has no history with the store.
The strongest tell is the pattern across orders. A single triangulation order looks like a normal order. Ten triangulation orders from the same fake storefront look like a pattern: the same shipping addresses, the same products, the same time of day, the same card BINs. The fraudster is running a business, and a business leaves a pattern.
The defense is to check the pattern, not just the order. Velocity rules that flag multiple orders to the same address, device fingerprinting that connects orders across accounts, and a manual review queue for first-time high-value orders are the tools that catch triangulation. The order itself will not tell you. The pattern will.
What to do when it hits
When a triangulation chargeback arrives, the first step is to check whether the order was part of a pattern. If it was, the other orders in the pattern are probably triangulation too, and they will generate chargebacks of their own. The loss is not one order. It is the whole pattern, and the pattern is the thing to stop.
The second step is to tighten the review rules for the product and the address pattern that was hit. Triangulation fraudsters return to the same merchants, because the merchants that do not catch it once usually do not catch it twice. The fake storefront stays up, the shopper keeps buying, and the merchant keeps shipping, until the merchant changes something.
The third step is to report the fake storefront. The storefront is the fraudster's business, and it is usually hosted on a platform that will take it down if it is reported. Taking down one storefront does not stop the fraud, but it stops that fraudster's pipeline, and the fraudster has to build a new one.
Keep reading
Related guides on this site: how card testing starts with small charges at checkout when 3DS2 challenges a payment and when it exempts it how chargeback alerts from Ethoca and Verifi work More from Bot Defense For Insurance.
Frequently asked questions
What is triangulation fraud?
It is a fraud scheme with three parties: the fraudster who runs a fake storefront, the real shopper who buys from it, and the real merchant who ships the product. The fraudster uses a stolen card to buy from the merchant, and the shopper gets the product.
Who loses money in triangulation fraud?
You do. The chargeback goes to the merchant who took the stolen card, which is you, and you lose both the payment and the goods you shipped. The fraudster keeps the money the shopper paid, and the shopper keeps the product.
How do I spot triangulation fraud?
Look for orders shipped to an address that does not match the billing address, for first-time customers ordering high-value goods, and for a pattern of chargebacks on orders that looked legitimate at the time. Triangulation orders often look clean because the shopper is real.
What Visa reason code covers triangulation fraud?
Visa reason code 10.4, which covers cardholder disputes where the merchant cannot show the cardholder authorized the transaction. Under Visa's Compelling Evidence 3.0, a merchant can fight the dispute with evidence that the cardholder received the goods, but triangulation makes that evidence hard to produce.
How common is triangulation fraud?
Merchants lose about 3.2 percent of ecommerce revenue to payment fraud, according to the Merchant Risk Council's 2026 report, and more than 40 percent of MRC members said they had been hit by triangulation fraud in the past year.
How much of ecommerce fraud is triangulation?
Yes. Chargebacks911 and Worldpay have estimated that triangulation accounts for about 26 percent of ecommerce fraud. It is one of the largest single fraud types, and it is growing because the fake storefronts are easy to set up.