Card Fraud

Card fraud is any use of a debit, credit or prepaid card, or of the data on it, that the legitimate cardholder did not authorise or that deceives the card system to obtain money, goods or services. It includes using a stolen card in a shop, making online purchases with stolen card numbers, producing counterfeit cards, and opening card accounts in another person's name. Losses fall on cardholders, merchants, acquirers or card issuers depending on the type of fraud and the rules that apply.

Card fraud is one of the largest categories of payment fraud worldwide. Its pattern has shifted over time with technology: the move to EMV chip cards cut counterfeit fraud at the point of sale, while the growth of online shopping pushed criminals towards card-not-present fraud, which now accounts for most card fraud losses in many countries. Card schemes, issuers, acquirers and regulators share responsibility for controlling it.

• Card-not-present fraud. Stolen card details are used for online, phone or mail order purchases where the card is not physically shown.
• Counterfeit fraud. Data copied from a card's magnetic stripe, often through card skimming at ATMs or terminals, is written onto a fake card. Chip cards are much harder to clone, so this type mostly occurs where stripe transactions are still accepted.
• Lost and stolen card fraud. A physical card is used by someone who found or stole it, often for small contactless payments or, if the PIN was observed, at ATMs.
• Card not received. A new or replacement card is intercepted before it reaches the cardholder.
• Account takeover. A fraudster gains control of an existing card account, for example by changing contact details and ordering a new card, a form of account takeover.
• Application fraud. A card account is opened using stolen or synthetic identity details, covered under application fraud.
• First-party misuse. The genuine cardholder makes a purchase and then falsely disputes it, known as friendly fraud.

Card details are stolen through data breaches at merchants or service providers, malicious code inserted into online checkout pages, phishing emails and texts that imitate banks or delivery firms, skimming devices on terminals, malware on phones and computers, and social engineering by phone. Large quantities of card data are traded on criminal marketplaces. Criminals also generate and test card numbers automatically, as in a BIN attack, or check stolen numbers with small transactions, as in card testing fraud, before using the working ones.

Consumers in most developed markets are well protected. In the United States, federal law limits credit cardholders' liability for unauthorised use, and debit card protection depends on how quickly the loss is reported, while card schemes' zero-liability policies often go further. In the European Union and the UK, payment services rules limit the cardholder's liability for unauthorised transactions to a small amount unless they acted fraudulently or with gross negligence. Between businesses, scheme rules decide who pays. Issuers usually recover card-not-present fraud from merchants through chargebacks, unless the merchant authenticated the payment with 3-D Secure 2, in which case liability generally shifts to the issuer. For in-person fraud, liability shifts to whichever party did not support chip technology, a rule that drove chip adoption in the United States after 2015.

Defences operate at several layers. Chip and PIN, contactless limits and cardholder verification protect in-person payments. Online, issuers use cardholder authentication and machine-learning models for real-time fraud scoring that examine every authorisation for signs of fraud, such as unusual locations, merchant types or spending patterns. Merchants and acquirers add address and security code checks, device analysis and velocity limits. Network tokenization replaces card numbers with tokens tied to a device or merchant, so that stolen data is less useful. The Payment Card Industry Data Security Standard sets rules for protecting stored and transmitted card data. Cardholders can help by using alerts, freezing lost cards in their banking app and checking statements.

The industry tracks card fraud as losses relative to the value of card transactions, often expressed in basis points, a measure described under fraud loss rate and, for merchants, the fraud-to-sales ratio. Central banks and industry bodies in many countries publish annual figures by fraud type and channel, which show the share of card-not-present fraud rising as e-commerce grows, and cross-border transactions carrying higher fraud rates than domestic ones. Scheme monitoring programmes require merchants and acquirers whose fraud levels exceed set thresholds to take corrective action or pay fines.

As technical controls improve, criminals increasingly target people rather than systems, persuading cardholders to share one-time passcodes or approve payments in their banking apps. This blurs the line between unauthorised card fraud and authorised scams, raising questions about liability. Other trends include the use of stolen card details to set up mobile wallets, fraud through digital goods and gift cards, and attacks on subscription merchants. Industry responses include stronger device binding, richer data sharing between merchants and issuers, and phishing-resistant authentication such as passkeys.

• PCI Security Standards Council