Card and payment fraud, and the first response.

Where card and payment fraud happens

Card fraud comes in a few main forms:

• Card-not-present (remote) fraud: stolen card details used online or by phone, where no physical card is needed.
• Counterfeit cards: copies made from data skimmed from a card's magnetic stripe.
• Lost or stolen cards used in shops or at cash machines.
• Manipulation of the cardholder: tricking the genuine cardholder into making or approving a payment themselves.

Transfer fraud affects bank and instant payments: criminals take over an online banking account, or trick a customer or business into sending money, for example by impersonating the bank or redirecting a supplier invoice.

What the latest EU data shows. The European Banking Authority and the European Central Bank publish joint reports on payment fraud across the European Economic Area. Their December 2025 report found:

• total payment fraud of EUR 4.2 billion in 2024, of which EUR 2.5 billion was credit transfer fraud and EUR 1.3 billion card fraud;
• fraud is a tiny share of payments: about 0.033% of card payment value;
• remote payments are the weak point: about 83% of card fraud value was remote, although remote payments were only about 28% of card value. The remote fraud rate was about 13 times the in-person rate by value;
• for remote card fraud, theft of card details was the largest type, at over half the value;
• in person, lost and stolen cards were the largest type;
• for credit transfers, manipulation of the payer grew from 65% to 74% of fraud value between 2023 and 2024.

Who pays. In 2024, customers bore about 38% of card fraud losses but about 85% of credit transfer fraud losses, because in transfer fraud the customer usually authorised the payment themselves. That gap is why several countries are changing refund rules for scams.

In the US, the FBI's Internet Crime Complaint Center received complaints of over US$3 billion lost to business email compromise in 2025, in which criminals hijack or impersonate email to redirect payments. These figures are reported complaints, not the total of all fraud.

Chip cards, 3-D Secure and strong customer authentication

Chip cards against counterfeits. EMVCo, the card industry's technical body, explains that an EMV chip generates a unique one-time code, a cryptogram, for each transaction. Copying the magnetic stripe does not copy that ability, so chip cards make counterfeit cards far less useful. The EU reports credit global chip adoption with limiting counterfeit fraud.

3-D Secure for online payments. EMV 3-D Secure lets the merchant and the card issuer exchange information about the transaction, the payment method and the customer's device before an online payment goes through. For most low-risk payments the customer simply clicks to buy. For higher-risk ones, the issuer asks for a challenge, such as a one-time passcode or a biometric check in the banking app.

Strong customer authentication (SCA) is the EU's legal requirement. Under the Payment Services Directive (PSD2), it means using at least two independent elements from different categories:

• knowledge: something only the user knows, such as a PIN;
• possession: something only the user has, such as their phone;
• inherence: something the user is, such as a fingerprint.

SCA applies when a customer accesses an account online, makes an electronic payment or does something remotely that could involve fraud. For remote payments, the authentication must be dynamically linked to the amount and the payee, so that a code approved for one payment cannot be used for another.

Exemptions keep everyday payments smooth. EU technical standards allow, among others, contactless payments up to EUR 50, with cumulative limits, low-value online payments up to EUR 30, and payments assessed as low risk by real-time transaction risk analysis, if the provider's own fraud rate stays below set reference levels.

Does it work? The EU's 2025 report found card fraud rates without SCA were about twice the rate with SCA, and card fraud was about 17 times higher when the other party was based outside the EEA, beyond the reach of EU authentication rules. For credit transfers, SCA payments showed higher fraud rates, which the report explains by SCA being applied to riskier, higher-value payments, and by criminals manipulating customers into approving payments themselves.

Customers' rights to dispute and refunds

Refund rights depend on the country and the payment type. Do not mix the rules.

European Union (PSD2):

• A customer must tell their payment provider without undue delay about loss, theft or unauthorised use, and can claim for unauthorised payments within 13 months.
• For an unauthorised payment, the provider must refund by the end of the next business day, unless it has reasonable grounds to suspect fraud by the customer and reports this to the authority.
• The customer can be asked to bear up to EUR 50, unless they acted fraudulently or with gross negligence. They bear nothing if strong authentication was not required, or for payments after they reported the problem.

United States:

• For debit cards and electronic transfers (Regulation E), a customer who reports a lost or stolen card within two business days is liable for at most US$50; later, up to US$500. Unauthorised transfers on a statement must be reported within 60 days. Banks must investigate errors within 10 business days, or up to 45 days with provisional credit.
• For credit cards (Regulation Z), liability for unauthorised use is capped at US$50, and billing disputes must be raised within 60 days of the statement.

United Kingdom:

• Under section 75 of the Consumer Credit Act 1974, a credit card provider is jointly liable with the seller for misrepresentation or breach of contract on purchases priced over £100 and up to £30,000.
• For authorised push payment scams, where a customer is tricked into sending money by bank transfer, the Payment Systems Regulator introduced mandatory reimbursement for Faster Payments and CHAPS from 7 October 2024, up to £85,000 per claim, with the cost split between the sending and receiving firms. The advanced course on push payment scams covers this in detail.

Card scheme chargeback rules also let card issuers reclaim money from merchants in some disputes, but they are private scheme rules rather than law, and they vary.

The first hours after fraud

Speed decides how much money comes back. The FBI's Internet Crime Complaint Center says "time is of the essence".

For the customer:

• Call the bank immediately using a number you already trust, not one from a message. Ask the bank to stop or recall the payment.
• Report it to the police or the national fraud reporting service, with full details of the transactions.
• Secure accounts: the UK National Cyber Security Centre advises changing passwords, including anywhere the same password was reused, logging out other sessions, checking email forwarding rules and turning on two-step verification.
• Keep the evidence: receipts, transfer confirmations, messages and screenshots. The FBI advises keeping original documents in a safe place.

For the institution:

• act on reports at once, including outside office hours;
• freeze or recall funds and contact the receiving institution quickly, before the money moves on;
• preserve logs and records for the investigation;
• support the customer and check whether other accounts or customers are affected.

Why speed works. The FBI's Recovery Asset Team runs a process it calls the Financial Fraud Kill Chain, working with banks to freeze funds sent by fraud. In 2025 it handled 3,900 incidents involving about US$1.16 billion and froze about US$679 million, a 58% success rate. It can sometimes follow money to a second account, but every hour of delay lets funds move further.

Building defences that customers can live with

Card and payment fraud controls must stop criminals without stopping customers. A layered approach works best:

• Strong authentication where risk is high, and smooth exemptions where it is low, decided by real-time risk analysis.
• Device and behaviour signals, such as a new device, an unusual location or an unusual payee, to decide when to step up checks.
• Payee checks that compare the name with the account before a transfer, now spreading in the UK, the EU and elsewhere, to catch misdirected and scam payments.
• Clear warnings at the moment of payment, specific to the scam type, rather than generic messages that customers learn to ignore.
• Fast reporting and freezing, connected to other banks and to law enforcement.
• Measurement: fraud rates by channel and type, false positives, customer friction and recoveries, reviewed regularly.

Remember the human side. The EU data shows criminals increasingly manipulate customers into authorising payments themselves, which strong authentication alone cannot stop. Customer education, warnings and support for vulnerable customers matter as much as technology.

In Kenya: the National Payment System Regulations, 2014 make payment service providers liable for transactions made without the customer's knowledge, unless the provider can prove the customer was at fault, and say a transfer instruction cannot be revoked once the payee's provider receives it unless reversed under the provider's dispute process. Providers must have a clear mechanism for complaints about loss of funds through fraud; customers have 15 days to complain, providers must resolve complaints within 30 days, and customers can appeal to the Central Bank. The Central Bank's fraud safety guidance describes card fraud through phishing for PINs and login details, skimming and lost or stolen cards, and advises customers to tell their bank at once, change passwords and report to the police. A draft financial consumer protection framework was published for comment in 2026; check the current rules.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.