First-Party Fraud Still Tops Reported Fraud

1-888-216-3544

First-Party Fraud Still Tops Reported Fraud.
Proving Intent Is the Real Test.

First-party fraud remains the leading reported fraud classification globally. In the 2026 LexisNexis® Risk Solutions Cybercrime Report, it accounts for 38.3% of reported fraud classifications, up from 35.9% the previous year.¹ The findings are based on cybercrime attacks detected through the LexisNexis® Digital Identity Network® between January and December 2025.¹

The year-on-year increase may look modest, but that is partly the point. First-party fraud was already the largest reported category, and it is still growing. For teams across fraud, risk, credit, collections and customer operations, the difficult part is not always spotting suspicious activity but proving intent when the customer and their actions initially appear legitimate.

First-party fraud can take several forms, from manipulating information during an application to taking credit with no intention to repay, misusing refund or chargeback processes, or repeatedly disputing legitimate transactions. These behaviours can be difficult to separate from genuine customer difficulty at first, which is why intent often becomes clearer only when activity starts to form a pattern.

The growth in first-party fraud is playing out against a larger digital backdrop. LexisNexis® Risk Solutions analysed more than 116 billion transactions for the 2026 Cybercrime Report, up 12% year on year, with double-digit growth in new account creations and payment transactions.¹

More digital activity means more customer interactions to assess and more places for risk to appear. Across a large customer base, repeated abuse can create real financial and operational pressure, including increased losses, heavier manual review and more pressure on collections, customer service and disputes teams.

Misclassification also creates its own cost. If genuine customer difficulty is treated as fraud, organisations risk adding friction, complaints and poor customer outcomes. If deliberate abuse is treated as normal customer behaviour, losses can accumulate before the pattern is clear enough to act on.

First-party fraud cannot be treated only as a post-event investigation issue because the behaviour that helps establish intent often appears across several interactions rather than at one isolated moment.

Why isolated checks miss the pattern

Many fraud defences are designed to spot obvious anomalies, such as an unusual device, suspicious location, high velocity or identity mismatch. Those indicators still matter, but first-party fraud often raises a more contextual question: does this customer’s behaviour remain trustworthy over time?

The wider data also shows why looking only at onboarding, login and payment events is no longer enough. For the first time, more than 10% of transactions analysed fell outside the three primary use cases of new account creations, logins and payments.¹ These additional events included new device registrations, password resets, changes of personal details, chatbot interactions, auction bids and online reviews.¹

Viewed in isolation, onboarding, payment, dispute and collections activity may not give teams enough evidence to make a confident call, especially when the more useful signal comes from how those events relate to one another.

First-party fraud often exposes the gaps between teams because the behaviour rarely sits neatly with one function. Fraud teams may see behavioural risk, credit teams may focus on repayment exposure and collections teams may see the loss after the fact, while customer service and disputes teams handle complaints and chargebacks.

Each team may make a reasonable decision based on what it can see, but the customer’s behaviour often cuts across those boundaries. When decisions remain disconnected, organisations can miss repeat behaviour, escalate suspicious activity too late or leave confirmed abuse buried in case notes instead of feeding it back into future decisions.

That challenge can extend beyond one organisation. The same identity, device, email address or behavioural pattern may also appear in suspicious activity across other businesses or sectors, making related activity easier to identify when those signals are viewed together.

In practice, teams often have to make decisions before intent is fully proven. Waiting for certainty can allow losses to build, but acting too early can create friction for genuine customers, and that tension is what makes first-party fraud so difficult to manage consistently.

That makes first-party fraud more than a fraud policy issue. It raises a practical question about whether teams are working from the same definitions, evidence thresholds and view of risk when intent is unclear.

Where this leaves organisations

This raises a direct operating question: can teams make consistent decisions when intent is unclear? Adding friction everywhere will not solve that problem, because it creates cost, slows genuine customers and can still miss the behaviours that matter most.

The answer is not to treat more customers as suspicious. It is to give teams enough context to make better calls earlier, before repeated abuse turns into a wider loss problem. With first-party fraud now representing nearly two out of five reported fraud classifications globally, organisations need a clearer view of how intent is classified and what evidence supports that decision. That means connecting identity, behavioural and transactional context across the customer journey, so teams can make earlier decisions based on stronger evidence.

1. LexisNexis® Risk Solutions, 2026 Cybercrime Report.

Corporations Financial Services

Identity Fraud Risk Orchestration

Business Overview

Executive Leadership

Our Technology

Careers

Press Room

Experts

Corporate Responsibility

Diversity & Inclusion

Corporate Alliances and Partnerships

First-Party Fraud and the Intent Gap

1-888-216-3544