First-Party Fraud

PCIComplianceHubLast updated

Fraud committed by the account holder, often involving the use of their own payment card or account, with the intention of defrauding the issuing bank or merchant.

Applies to. PCI DSS v4.0.1 does not address first-party fraud; it protects account data, and here the account holder is the actor rather than the victim. The merchant meets it as a chargeback, typically a friendly-fraud dispute on a card-not-present sale, handled through the acquirer under the payment brands' dispute rules, with the issuer deciding whether the cardholder's claim stands.
Related. Chargeback, Issuer, Acquirer, Cardholder, Card-Not-Present Transaction (CNP)
Sources. PCI DSS v4.0.1 (June 2024)