Third-party fraud

Using someone else's real identity without their knowledge.

For example, a criminal might apply for a credit card using a stranger's name, date of birth, and government ID number, while the real person has no idea until the bills or a credit report arrive.

Impersonation of a genuine, unwitting individual using stolen or compromised identity data.

Third-party fraud typically follows these steps:

1. The fraudster obtains a victim's personal details, for example from a data breach, a phishing message, or a marketplace for stolen data.
2. They apply for credit or open an account using those details.
3. They use the account or credit and do not repay.
4. The victim discovers the problem later, often through collection notices or a credit report.

The stolen data can come from several places:

• Data breaches, which expose names, numbers, and addresses in bulk.
• Phishing and scams, which trick people into handing over details.
• Stolen documents, such as a lost wallet or intercepted mail.

Third-party fraud sits next to terms that are easy to mix up:

• First-party fraud uses the fraudster's own real identity, while third-party fraud uses someone else's.
• Synthetic identity fraud builds a person who does not exist, so no real victim is involved in the same way.
• Account takeover targets an existing account, while third-party fraud usually opens a new one in the victim's name.