Collusion fraud is fraud run by two or more people working together to beat controls that assume everyone acts alone. Each participant can look perfectly clean on their own, because the crime lives in the relationship between them, not in any single account.
What is collusion fraud, in plain English?
Collusion fraud is any scheme where two or more parties coordinate to defeat a control. The pairing can take many shapes: an employee plus an outside accomplice, a buyer and a seller on a marketplace, a borrower and a crooked broker, or a cluster of accounts secretly run by the same ring. The common thread is that the fraud depends on cooperation.
What makes it slippery is that most controls are built around the individual. Identity checks, credit checks, and single-account rules all ask "is this person or this account legitimate?" and each colluder can answer yes. A staff member has valid access. A buyer has a real card. A seller has a real store. Nothing looks wrong until you connect them.
So the signal lives in the relationship, not the record. Shared devices, shared addresses, shared funding sources, and repeated dealings between the same parties are what expose it. Collusion is especially common in procurement, marketplaces, and insider fraud, wherever trusted access meets a willing partner on the other side.
How a collusion scheme works
Collusion follows a coordinated arc that no single actor could pull off alone:
- Pair up — Two roles align. One party holds access or authority, the other supplies the counterparty needed to exploit it, for example an approver and a fake vendor.
- Set up — Build clean cover. Each side is made to look legitimate on its own: real credentials, a registered business, a valid card, a plausible history.
- Execute — Trade with each other. The parties transact so value flows the way they want, an approved payment, a won auction, a rubber-stamped claim.
- Repeat — Cycle quietly. Because each event looks normal, the pair repeats it, often just under thresholds, until a link surfaces the pattern.
Who is involved?
Who | Their role |
The insider | An employee or contractor with access or approval authority who bends a control from within. |
The outside partner | The vendor, buyer, seller, or borrower who provides the other half of the transaction. |
Linked accounts | Multiple accounts, often one ring, that transact with each other to move or launder value. |
The controls owner | The risk, audit, or platform team whose single-actor rules the colluders are built to slip past. |
What it looks like in practice
In practice
On a resale marketplace, a seller lists high-value electronics and a buyer purchases them at full price, over and over, always the same two accounts. Each order pays cleanly, ships to a real address, and clears the platform's protection. Individually, both accounts look like good customers with strong histories.
A graph analysis links them: the two accounts share a device, a funding card seen on both sides, and a payout account that quietly receives the money back. The "sales" were a loop designed to farm seller reputation and pull payouts forward. Neither account ever tripped a single-account rule.
Why it matters to operators
Collusion fraud defeats the assumption underneath most fraud controls: that you can judge an actor in isolation. When every participant passes their own checks, rules and manual reviewers looking at one record at a time will keep approving the scheme. The loss can run for a long time because nothing individually looks wrong.
Catching it means changing the unit of analysis from the account to the network. Link analysis, transaction graphs, and segregation-of-duties monitoring turn "who is this person?" into "who does this person keep transacting with, and do they share anything they should not?" That shift is what surfaces the relationship the colluders were counting on you to miss.
What to watch in the data
- Repeated counterparties. The same two parties dealing with each other far more than normal, especially in ways that always benefit one side.
- Shared attributes. Common devices, addresses, IPs, phone numbers, or funding sources across accounts that claim to be unrelated.
- Broken separation of duties. One person able to both create and approve a payment, vendor, or claim, or approvals that always route to the same pair.
- Circular value flows. Money or goods that loop back to an origin, or payouts that quietly return to a linked account.
- Threshold hugging. Transactions sized just under approval or review limits, repeated between the same parties.
Quick questions
How is collusion fraud different from insider fraud?
Insider fraud can be one employee acting alone. Collusion adds at least one more party, often an outside accomplice, so the insider's access is paired with a counterparty. Many insider cases are also collusion cases.
Why do single-account rules miss it?
Because each colluder is engineered to pass their own checks. The fraud only appears when you look at how the parties relate: shared attributes, repeated dealings, and value that flows in a suspicious loop.
Where is collusion most common?
Procurement and accounts payable, two-sided marketplaces, lending, and insurance. Anywhere a trusted insider or a real counterparty can be paired to push value in a chosen direction.
What is the best way to detect it?
Network and link analysis that maps relationships across accounts, plus segregation-of-duties controls so no single person can both initiate and approve. Graph signals beat record-by-record review here.
Can accounts collude without the people knowing each other?
Sometimes a single fraudster controls both sides, so the "parties" are really one operator with linked accounts. From a controls view that still counts, because it defeats single-actor logic the same way.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.