First-Party Fraud

First-party fraud is fraud committed by a genuine account holder, using their own real and correctly-verified identity, against the business they legitimately hold an account with, not impersonation of anyone else, but a real person deliberately misusing access they were properly granted. It shows up in a few recognizable patterns. "Friendly fraud" is a cardholder disputing a charge for a purchase they actually made and actually received, falsely claiming it was unauthorized or never arrived, to get a free refund while keeping the goods. "Bust-out fraud" is opening a real account under one's own real identity, behaving well enough over time to earn trust and an increased credit limit, then maxing it out all at once with no intent to repay. Loan-stacking is applying for several loans simultaneously under one real identity, drawing more total credit than any single lender would have approved, faster than credit bureaus can update and catch the pattern.

The defining feature that separates first-party fraud from every other fraud category in this Lexicon is that identity verification, however strong, does not catch it. The person genuinely is who they claim to be: their document is real, their face matches it, their liveness check passes cleanly. The fraud isn't in the identity claim at all; it's entirely in the behavior layered on top of a perfectly legitimate identity.

Who actually built this

Same shared-vocabulary origin as Synthetic Identity Fraud, a category name used across payments, banking, and credit-risk practice rather than defined by one authoritative body. The card networks themselves, Visa and Mastercard specifically, publish their own guidance framing "friendly fraud" as a named, illegitimate-dispute category distinct from fraud committed by an impostor, largely because it determines how a merchant is expected to fight a given chargeback. None of this originated with Solidus.

Solidus today

This is genuinely, explicitly out of scope for Solidus, not a gap waiting on a future roadmap slot. Because first-party fraud is committed with a real, correctly-verified identity, no amount of identity-verification strength closes it, and Solidus does not pretend otherwise. Detecting it requires behavioral and transaction-pattern signals, spending velocity, cross-merchant dispute tracking, device and session fingerprinting, an entirely different product category from what Solidus builds. Solidus has no such tooling today, no roadmap entry for it, and no intention of building one. It's worth being direct about why the reusable-credential wedge doesn't help here either: a first-party fraudster's Solidus credential would pass every check cleanly, because the identity behind it really is genuine. The fraud lives entirely outside what an identity credential can attest to.

See also

Chargeback is the mechanism "friendly fraud" actually exploits, a dispute filed in bad faith by the genuine cardholder. Synthetic Identity Fraud is the closest adjacent category, and the clean contrast: a fabricated identity misused, rather than a real one. Account Takeover is fraud committed by someone who is not the genuine account holder, the opposite structural situation from first-party fraud. KYC and Credential Portability are both, by design, unable to address first-party fraud, stated here as the honest limit of what identity verification can do.