Third-Party Fraud: Types, Examples, Detection and Prevention

A payment may look genuine even when a criminal with access to the account makes it. Stolen credentials, compromised identities, and manipulated payment orders can help fraudsters carry out transactions that slip past analysts before they spot the warning signs.

According to UK Finance’s Annual Fraud Report 2026, 3.81 million confirmed cases of unauthorised fraud were recorded in the UK during 2025. This figure reflects the scale of unauthorised fraud, not third-party fraud. Financial institutions also face authorised push payment (APP) fraud, where criminals persuade unsuspecting account holders to authorize payments to fraudulent recipients.

External criminals have more points of entry, and compliance analysts have less time to intervene with digital onboarding, instant payments, and connected financial services. The impact goes beyond the losses—they’re losing customer data, their alert queues are growing, and accounts are being used to facilitate money laundering.

Understanding Third-Party Fraud and How It Works

Third-party fraud typically involves an external party using a person’s identity or account/financial details, without their consent, to secure money, credit, services, or confidential information. Stolen identities, compromised accounts, or exposed credentials can then give fraudsters the opportunity to realise financial gain. What “the term” means can also vary by institution, especially in cases of impersonation and payments made after deception.

In reality, the fraudster pretends to be a real customer and either assumes an existing customer’s identity or changes payment details to access financial services or transfer money to their account. The real customer is the victim.

This distinguishes third-party fraud from processing mistakes, disputes, and payments the customer made but wasn’t tricked into making. When a payment is unusual, it’s not necessarily fraud.

Once an ID is verified during onboarding, that doesn’t mean the risk of account compromise or identity mischief has passed. If an account is verified correctly in January, the customer may lose control of the account in June. Financial institutions should evaluate identity, account activity, and transaction context on an ongoing basis throughout the financial relationship.

First-Party Fraud vs. Second-Party Fraud vs. Third-Party Fraud

The three labels describe who commits the fraud and whose identity or account is used. Terminology is not fully standardised, particularly for second-party fraud, where definitions differ between organisations and overlap with the other two categories. Each institution should define the categories in its own fraud policy.

Second-party fraud is not defined consistently across the industry, so financial institutions should document how their fraud taxonomy distinguishes deliberate customer participation from third-party account compromise and other forms of financial crime.

The distinction shapes the response. A first-party case may justify exiting the relationship, while a third-party case means the customer needs support and possibly reimbursement. Evidence standards and controls differ too, from income verification for first-party risk to stronger authentication for third-party risk.

Common Types and Real-World Examples of Third-Party Fraud

Identity Theft and Fraudulent Account Opening

Criminals use stolen identifying details, including a person’s name, home address, and identity document information, to apply for accounts, loans or credit cards in another person’s name. The real person may learn about the account only when repayment demands arrive.

Account Takeover

Through deceptive messages, automated login attempts using stolen passwords or SIM swaps, fraudsters gain access to a legitimate customer’s account. They often change contact details or add new payees before moving funds out.

Impersonation and Payment Fraud

Criminals impersonate banks, regulators, employers or suppliers to persuade customers or employees to disclose sensitive information or transfer money. In a report published in August 2025, the UK Financial Conduct Authority (FCA) received 4,465 reports of scams impersonating the regulator during the first half of that year. The FCA also reported that 480 victims had been deceived into sending money to fraudsters. These figures illustrate the financial harm associated with impersonation scams, although they represent one type of scam rather than the total volume of third-party fraud.

Money Mule Activity

When accounts are opened in the victim’s name, or accounts are stolen, they can become collection points for the proceeds of other crimes. Money comes in and is divided, and then it goes out, turning a fraud issue into a possible money laundering issue.

How to Detect Third-Party Fraud Before Losses Escalate

A good, reliable solution will differentiate between new-account fraud and existing-account fraud, since they require different detection approaches. Onboarding checks are used to combat new account fraud, and ongoing monitoring is used to combat existing account fraud.

Identify Unusual Onboarding Activity

Watch for warning signs that may indicate stolen or misused personal information. Look for identification inconsistencies across sources, the use of one address or device for multiple unrelated applications, and recurring applications with minor changes to names or birth dates.

Monitor Account and Transaction Behavior

Sudden shifts in transaction value, frequency or destination warrant review, particularly after a password reset, new device login, or change to contact details. That sequence often marks the early stage of an account takeover.

Connect Related Risk Signals

A single alert rarely shows the full picture. Linking accounts, counterparties, devices and transactions can expose patterns that individual checks miss, such as several new accounts paying the same beneficiary.

Apply Risk-Based Investigation

Automated alerts should route cases to analysts according to risk level and available evidence. An unfamiliar device alone is insufficient to establish that an account has been compromised. Analysts weigh the context, contact the customer where appropriate and then decide whether to block, restrict or close the alert.

These indicators do not establish fraud on their own. Investigators should assess the available evidence, customer history and transaction-surrounding circumstances before determining the appropriate response, if the case warrants further measures.

How Financial Institutions Can Prevent Third-Party Fraud

Strengthen Customer Due Diligence

Identity verification and document authentication give compliance teams a way to detect applications involving stolen or misused identity information. Risk-based screening by screening customers against sanctions designations, politically exposed person (PEP) lists, adverse news sources and additional risk information provides a complementary layer of customer due diligence.

The Financial Action Task Force (FATF) sets international standards for customer due diligence through Recommendation 10. These include identifying and verifying customers when establishing business relationships, when suspicion of money laundering or terrorist financing arises, and when previously obtained customer identification data is considered unreliable or inadequate. Specific legal requirements and additional fraud prevention obligations depend on the applicable jurisdiction.

Protect Account Access

Multi-factor authentication, device binding and step-up checks before high-risk actions make stolen credentials far less useful. Changes to phone numbers, email addresses or payees deserve extra verification, since fraudsters often alter these before moving money.

Use Ongoing Transaction Monitoring

Fraud prevention cannot stop at account opening. Ongoing transaction monitoring helps financial institutions identify changes in customer behaviour, unusual payment activity and potentially fraudulent relationships between accounts and counterparties. Monitoring rules should reflect the institution’s risk assessment and be reviewed when emerging fraud tactics, or existing controls no longer reflect observed activity. Alerts require investigation because unusual transactions do not necessarily indicate fraud.

Create a Consistent Escalation Process

Investigators need defined steps for reviewing alerts, recording investigative findings and escalating suspected criminal activity. A structured case management workflow keeps that record consistent and auditable. Where an investigation identifies potential money laundering, the designated compliance officer should assess whether the circumstances trigger a suspicious activity report (SAR), suspicious transaction report (STR) or another applicable filing under local law. In the UK, the MLRO typically oversees the relevant escalation and reporting process in accordance with the firm’s legal obligations.

Review Fraud Controls Regularly

Fraud patterns change as criminals probe defenses. Periodic reviews of rules, thresholds and loss data show whether controls still match current risk. Staff training and information sharing with peers and law enforcement help teams recognize new methods sooner.

The Role of AML Compliance in Third-Party Fraud Detection

Fraud detection asks whether a payment was unauthorized or induced by deception. AML monitoring asks whether funds are being moved to disguise their criminal origin. A fraud team can stop one payment while the receiving account keeps collecting funds from other victims.

Customer screening, risk assessments, transaction monitoring and investigation workflows each provide part of the picture. A confirmed account takeover should prompt a review of relevant account activity and any implications for the customer’s AML risk assessment. Similarly, a screening alert involving a counterparty may provide additional context for a fraud investigation, depending on the nature of the alert and the evidence available. Financial institutions that fail to connect fraud investigations with AML monitoring may overlook relationships between compromised accounts, suspicious counterparties and the movement of potentially criminal funds.

AML Watcher supports fraud and compliance teams through configurable fraud detection scenarios and sender-receiver relationship analysis. These capabilities can help institutions examine suspicious transaction patterns and identify relationships that warrant further investigation. Connecting transaction-level findings with broader account and counterparty activity can support a more informed assessment of potential fraud and associated money laundering exposure.

Strengthen Third-Party Fraud Detection With AML Watcher

Third-party fraud can leave financial institutions investigating individual transactions without seeing how suspicious activity connects across accounts and counterparties. AML Watcher helps compliance teams examine transaction patterns through configurable fraud detection scenarios and sender-receiver relationship analysis, supporting a more informed approach to identifying suspicious activity.