Triangulation Fraud

Triangulation fraud is a sophisticated form of payment card fraud that operates across three parties: a fraudulent marketplace seller, an unsuspecting genuine buyer, and a legitimate retailer whose stock is purchased using stolen card details. The buyer places an order with the fraudulent seller, pays a genuine price, and actually receives the goods they ordered — but the goods were purchased using someone else's stolen payment card.

The genuine buyer is typically unaware anything improper has occurred. Their order arrived; their payment went to the seller. From their perspective, the transaction looks normal. The harm falls on two other parties: the cardholder whose stolen details were used to fund the fulfilment order, and the legitimate retailer who shipped goods for which they will eventually face a chargeback.

This makes triangulation fraud unusual among online shopping scams. Most scams harm the buyer directly. In triangulation fraud, the buyer may be an inadvertent participant in a crime without knowing it — and may later find themselves drawn into the investigation or dispute process when the fraud is unravelled.

The fraudulent seller profits by collecting genuine payments from buyers while fulfilling orders using stolen cards — effectively monetising card data at scale. Cardholder details used in the scheme often come from large-scale data breaches or card-skimming operations.

The fraudulent operator sets up a seller account on a marketplace, classifieds platform, or standalone store. Prices are set at competitive market rates — not so low as to attract suspicion, and sometimes slightly below market to generate volume. The listings appear entirely legitimate.

When a buyer places an order, the operator takes that genuine payment. They then log into a legitimate online retailer — using stolen card details — and place an identical order, entering the buyer's address as the delivery address. The legitimate retailer processes the stolen card and ships the item directly to the buyer.

The buyer receives the item. The stolen cardholder later identifies the fraudulent charge and initiates a chargeback against the legitimate retailer. The retailer loses both the goods and the payment, and may also incur chargeback fees. Meanwhile, the fraudulent operator has the buyer's genuine payment and has exited the arrangement with a profit.

In some cycles, the fraudulent seller also extracts the buyer's card details through the fake checkout, enabling a second layer of fraud against the buyer themselves.

The elegance of the scheme from a criminal perspective is that it is self-concealing. The buyer receives their order and has no reason to suspect anything is wrong. The transaction looks successful from every angle the buyer can observe. The fraudulent seller maintains a seller account that generates positive feedback — because buyers are satisfied — which enables the operation to continue at scale before detection.

The harm is invisible to the most proximate party (the buyer) and falls on parties further removed (the cardholder and the legitimate retailer), slowing the detection of the pattern.

A buyer orders a popular electronic item from a marketplace seller offering a slightly below-market price. Payment is processed normally. The item arrives promptly, shipped in the original retailer's packaging with a packing slip made out in the buyer's name. The buyer is satisfied. Several weeks later, the buyer receives a message from the marketplace indicating the seller's account has been suspended following a fraud investigation. The buyer's order was fulfilled using a stolen card from a separate victim, who has now initiated a chargeback against the legitimate retailer.

Your order from [seller] has been dispatched by [different retailer name]. Tracking: [number].

We have a wide range of [products] available. Prices are competitive — we ship fast. Order now at [fake link].

Your item is on its way. Note: our fulfilment partner ships on our behalf, so the package may show their name.

Thank you for ordering from [seller]. Your [product] ships via our logistics partner [different name] today.

From a buyer's perspective, triangulation fraud is difficult to detect because you receive what you ordered. However, some signals can indicate involvement: the seller account is newly created; prices are slightly below the usual market rate without an obvious reason; the item ships from an unexpected legitimate retailer rather than from the seller themselves; or the package arrives from a major retailer with that retailer's branding despite having been ordered from a different seller.

If you receive an item and the package or paperwork shows it was shipped from a completely different retailer than the one you purchased from, this is worth noting. You are not necessarily at direct risk, but the pattern can indicate your order was part of a triangulation scheme.

For sellers and platforms, monitoring for new accounts with unusually high order volumes, consistent fulfilment via third-party retailers, and chargeback patterns from legitimate retailers are key detection signals.