What Is Third-Party Fraud? Types, Liability, and Penalties

Third-party fraud is any scheme in which someone other than you uses your stolen or fabricated personal information to open accounts, make purchases, or commit other financial crimes in your name. The victim and the perpetrator are different people, which is what separates it from first-party fraud, where someone misuses their own identity. In 2024, more than 1.1 million identity theft reports were filed with the Federal Trade Commission, and consumers reported losing over $12 billion to fraud overall.¹ Federal law caps most of your financial exposure when it happens, but the protections and the deadlines vary by account type.

How It Happens

Every scheme starts with data. Fraudsters harvest it through phishing emails and texts that trick people into entering login credentials, large-scale breaches that expose millions of records at once, and malware that quietly captures banking details from infected devices. Stolen information also circulates on dark-web marketplaces, where Social Security numbers, card details, and full identity profiles are bought and sold.

Once they have enough, they put it to work. Some open new credit cards, loans, or bank accounts in the victim’s name.² Others use card numbers to make purchases online or take over an existing account by resetting the password. Victims typically don’t find out until a bill arrives for an account they never opened, an application is denied, or a bank balance comes up empty.

The Main Forms It Takes

Identity Theft

The broadest category. A fraudster uses your personal information, usually a Social Security number combined with your name and date of birth, to impersonate you. That can mean opening credit lines, taking out loans, claiming government benefits, or filing a fraudulent tax return to steal your refund.² Repairing the damage can take months of letters, disputes, and follow-up.

Account Takeover

Here the fraudster skips opening anything new and breaks into an account you already have. That might be a bank account, an email account, or a shopping profile with stored payment methods. They typically gain access through credentials stolen in a breach, phishing, or brute-force password attacks, then change the login so you’re locked out while they drain funds or make purchases.

Synthetic Identity Fraud

Harder to spot because the “person” doesn’t fully exist. Instead of stealing one victim’s full identity, the fraudster combines real data, often a genuine Social Security number, with fabricated details like a fake name and date of birth to create an entirely new identity.³ They patiently build a credit history under the fictional identity, make small purchases, pay on time, then max out every available line and vanish. The real person whose SSN was used may not discover the problem for years because the accounts don’t appear under their name in the usual way.

Card-Not-Present Fraud

This one targets online, phone, and mail-order purchases where the physical card never changes hands. The fraudster needs only the card number, expiration date, and security code, all commonly harvested through breaches or skimming devices. Merchants can’t verify the card or check ID, so these transactions are inherently riskier and often end in chargebacks.

Tax Identity Theft

Someone files a federal tax return using your Social Security number before you do and claims the refund. You usually discover it only when the IRS rejects your real return as a duplicate.⁴ Resolving it means filing IRS Form 14039, the Identity Theft Affidavit, and waiting on an investigation that can delay your legitimate refund for months.⁵

What You Can Be Held Liable For

Federal law limits what fraud can cost you, but the ceiling depends on which account was hit. The gap between credit cards and debit cards is wide, and knowing it changes how fast you need to act.

Credit Card Charges

Your maximum liability for unauthorized credit card charges is $50. Federal law caps it there regardless of what the fraudster actually spent or how long the fraud went undetected.⁶ Most major issuers waive even that $50 through zero-liability policies, so in practice you’ll rarely owe anything. Charges made after you report the card compromised are entirely the issuer’s problem.

Debit Card and Bank Account Transfers

Debit cards are a different story, and the clock matters. Your liability depends on how quickly you report:⁷

Report within 2 business days of learning about the loss, and your liability is capped at $50 or the amount of unauthorized transfers before you reported, whichever is less.
Report after 2 business days but within 60 days of your statement, and your liability jumps to as much as $500 for transfers that occurred after those first two days and before you notified the bank.
Wait longer than 60 days from the statement, and you could face unlimited liability for unauthorized transfers that happen after that window closes.⁸

That escalating timeline is why monitoring debit statements matters so much more than monitoring credit card statements. The law allows extensions for extenuating circumstances like hospitalization or travel, but you’ll have to explain the delay to the bank.

Fraudulent Accounts on Your Credit Report

When a fraudster opens accounts in your name, the accounts and any unpaid balances can land on your credit report. Under the Fair Credit Reporting Act, credit bureaus must block fraudulent information within four business days once you provide proof of identity, a copy of your identity theft report, and a statement identifying the fraudulent items.⁹ Filing through IdentityTheft.gov first gives you the documentation that triggers this requirement.

What to Do If It Happens to You

Speed matters, especially for debit account fraud where your exposure grows the longer you wait. Work roughly through these steps:

Contact your bank or card issuer immediately. Report unauthorized charges and request a freeze or replacement card. This stops the clock on your liability for anything that happens next.
File a report at IdentityTheft.gov. The FTC’s site creates a formal identity theft report and generates a personalized recovery plan. That report is also the documentation credit bureaus and creditors require to investigate and remove fraudulent accounts.
Place a credit freeze or fraud alert. A freeze prevents anyone, including you, from opening new credit accounts until you lift it. A fraud alert is lighter, requiring lenders to verify your identity before granting credit. Freezes are free at all three major bureaus and are the stronger protection if you’re not applying for credit yourself.¹⁰
Request a block of fraudulent information on your credit report. Using your identity theft report, contact each bureau to block accounts and inquiries that resulted from the fraud. The bureaus must act within four business days.⁹
File IRS Form 14039 if your tax information was compromised. Submit it online, by fax, or by mail. If your e-filed return was rejected because a return was already filed under your Social Security number, attach the form to a paper return instead.⁵
File a police report if your losses are significant. Some creditors and insurers require one before they’ll write off fraudulent debts, and the report creates a paper trail that strengthens later disputes.

Recovery isn’t instant. The IRS investigation alone can take several months, and disputing fraudulent accounts with multiple creditors takes persistence. Keep copies of every report, letter, and communication. The identity theft report from IdentityTheft.gov is the single most important document in the process, because it unlocks your rights under federal law to have fraudulent information blocked.

How It Differs From First-Party Fraud

The line comes down to who is doing the deceiving. In third-party fraud, an outsider steals or fabricates someone else’s identity to commit the crime. In first-party fraud, the person committing the fraud uses their own real identity to cheat a lender, insurer, or creditor, for example by taking out a loan knowing they’ll never repay it or filing a false insurance claim. If you’re the person whose information was used without your consent, you’re dealing with third-party fraud, and the consumer protections above apply to you.

Federal Criminal Penalties

Prosecutors can bring several overlapping federal charges against a third-party fraudster, and they frequently stack them. Wire fraud under 18 U.S.C. § 1343 is the workhorse charge because nearly all modern fraud involves electronic communications; it carries up to 20 years in prison, or up to 30 years and a $1 million fine if the scheme affects a financial institution.¹¹ Identity fraud under 18 U.S.C. § 1028 carries up to 15 years for offenses involving government-issued IDs or birth certificates and up to 5 years for other identity fraud.¹² Aggravated identity theft under 18 U.S.C. § 1028A adds a mandatory two-year sentence that runs consecutively on top of the underlying crime, with no probation option.¹³ Access device fraud under 18 U.S.C. § 1029, covering stolen card numbers and similar devices, carries up to 10 or 15 years depending on the specific conduct and up to 20 years for repeat offenders.¹⁴ Someone who uses a stolen Social Security number to open a card online and then makes purchases could face all four charges at once.

1
Federal Trade Commission. Consumer Sentinel Network Data Book 2024
2
IdentityTheft.gov. When Information Is Lost or Stolen
3
FedPayments Improvement. Synthetic Identity Fraud Defined
4
FTC. What To Know About Tax Identity Theft
5
IRS. Form 14039 Identity Theft Affidavit
6
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
7
GovInfo. 15 USC 1693g – Consumer Liability
8
Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers
9
Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft
10
FTC. Credit Freezes and Fraud Alerts
11
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
12
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents
13
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
14
Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices