Fictional scenario. Synthetic data. Your notes stay on this browser; do not enter real customer information.
Triangulation is the scheme that makes good merchants doubt their own data. The order was real. The delivery address was real. The person at the address wanted the goods, paid for them, and will say so if asked. And the dispute arrives anyway, because the card that paid your merchant belonged to someone else.
Three parties, hence the name. A buyer who thinks they are getting a bargain from a seller on a marketplace. A seller who has no goods. And your merchant, who has the goods and ships them to the buyer, paid for with a card the seller stole. The buyer is happy. The cardholder disputes. The merchant loses the goods and the dispute.
OWASP's catalogue does not list triangulation as an automated threat, because the fraud lives in commerce rather than automation. Where it touches the catalogue is OAT-001, Carding: the stolen cards used at the third corner were often tested somewhere first.
What the scheme needs.
From the defender's view, four preconditions.
A merchant whose goods are resaleable and whose delivery is to an address the customer chooses. Brightwater Tickets, our fictional event ticketing merchant, is exposed in the digital form: a ticket is delivered to an e-mail address, and an e-mail address is easy to hand over.
A supply of stolen card details that work at that merchant. This is the link to enumeration, and to breaches that have nothing to do with you.
A place to advertise. The seller needs buyers, and finds them wherever people buy at a discount from strangers.
A dispute window long enough for the goods to be used. The cardholder notices the charge on a statement, which can be weeks later. Visa’s dispute-resolution guidance describes the lifecycle: the cardholder raises it with their issuer, and the merchant learns afterwards.
What it looks like in your data.
A synthetic illustration at Brightwater. Over six weeks, 180 orders in one event category share a shape no single order would reveal.
- The cardholder name and the recipient name differ on 170 of the 180. Ordinarily at Brightwater they differ on about one order in eight.
- The billing country and the delivery e-mail domain or shipping address are mismatched more often than the baseline.
- Each card is used once. There is no repeat custom on the paying credential, ever.
- Order values cluster near a discount point that makes sense for a buyer who was promised 30 per cent off.
- Disputes arrive in a cohort, 25 to 60 days after the order date, coded as fraud rather than as goods not received. The goods were received. By someone.
- When Brightwater's support contacts the recipient, the recipient has a receipt, from a different seller, for a different amount.
The last line is the one that identifies the scheme. A triangulated order has two receipts.
What else looks like this.
Gifts. People buy tickets for other people, and the names differ. A gift order has a repeat customer behind it and a dispute rate near zero.
Corporate and agency purchasing. One card, many recipient names, over a long relationship.
A legitimate reseller. Allowed or not, a reseller has a history, a volume and, usually, an account.
Each of these has a repeat credential or a relationship. Triangulation has neither. The ratio to watch is repeat cards among name-mismatched orders. Near zero, the mismatch stops being a gift pattern.
Where it is usually caught.
Late, . The order passes every check at the point of sale, because every field is genuine; only the combination is wrong, and only the dispute reveals it.
The earlier catch is at the cohort level. A desk that tracks disputes by order date and category, as in A chargeback arrives in its own time., will see the cohort's fraud-coded dispute rate rise before any single order looks like anything. Earlier still is a name-mismatch ratio by category with a baseline, which is a rule any analyst can write and explain.
For a CE3.0 response, confirm the current pathway, eligible prior transactions, date anchor and required matching elements with the acquirer. A familiar account alone is not the evidence test. Compelling evidence in practice explains how to keep those checks separate.
A desk card.
- Track name mismatch between payer and recipient by category, against a baseline.
- Among mismatched orders, count repeat payment credentials. Zero is the signal.
- Put disputes into order-date cohorts by category and watch the fraud-coded share.
- When a dispute arrives, ask the recipient for their receipt. Two receipts is the finding.
- Decide in advance what you do with the recipient, who is usually a victim too.
Read next.
Four families of dispute, four kinds of evidence. sets out why a fraud-coded dispute on a delivered order is a different animal from a goods-not-received one. The Volume 01 case Dispute spike is the cohort view from the other end. Look up triangulation fraud. Part three is refund fraud, where the money leaves without a dispute at all.
Edited 6 November 2026. Primary references are listed above; fictional scenarios are not claims about Antifrog customers or operating experience.
Fictional learning material. Any numerical examples are synthetic. Use only authorised, appropriately minimised records for workplace exercises; do not upload customer information to this learning site.