Triangulation Fraud (Seller Side)
A fraud scheme in which a criminal storefront accepts genuine customer orders and payments, then buys the goods with stolen card details from a legitimate retailer and ships directly to the customer.
Also known as: triangulation scheme, drop-ship fraud using stolen cards
Last reviewed: 1 June 2026
Triangulation fraud involves three parties: the genuine customer, the fraudulent 'seller', and the legitimate retailer whose goods are used to fulfil the order. The fraudster sets up a storefront — often on a major marketplace platform — listing goods at attractive prices. When a genuine customer places an order, the fraudster charges their card legitimately. The fraudster then uses a stolen payment card to purchase the same item from a real retailer, providing the genuine customer's shipping address. The legitimate retailer ships to the customer, the customer receives their order and is satisfied, and the fraudster has pocketed the legitimate payment while using stolen funds for the purchase.
The customer typically suffers no immediate harm (they receive what they ordered), but the stolen card's owner eventually disputes the charge. The legitimate retailer bears the chargeback cost. The fraudster profits on the spread between the sales price and the stolen-card purchase, scaled across thousands of transactions.
Triangulation fraud is difficult to detect because all three parties complete their part of a legitimate-seeming transaction. Marketplaces combat it through seller verification requirements, monitoring for new seller accounts with high sales volume, and patterns of purchases from multiple different card details. Banks and retailers look for shipping addresses associated with known fraud networks.
Examples
- A fraudster lists popular electronics on a major marketplace at slightly below market price; when customers order, they buy the items from a legitimate online retailer using stolen card details, shipping directly to the customer, and pocket the difference across hundreds of transactions before the scheme is detected.