Payment fraud is any dishonest act that causes money to move through a payment system without the genuine consent of the person who owns it, or with consent obtained by deception. It covers stolen and counterfeit cards, hijacked bank logins, forged cheques, bogus direct debits and scams in which victims are talked into sending money themselves. Banks, card issuers, merchants, payment processors and regulators all track it because every payment method that moves money quickly also moves stolen money quickly.
Payment fraud is one branch of the wider field of fraud, which also includes accounting fraud, insurance fraud and investment schemes. Industry statistics usually split it into two families: unauthorised fraud, where a criminal makes a payment the account holder never approved, and authorised fraud, where the account holder approves the payment but has been tricked. The split matters because laws on who repays the loss treat the two very differently.
Payment fraud in plain terms
Think of a payment as a signed instruction to your bank: "move this much from me to them." Payment fraud happens in two ways. Either someone forges your signature on the instruction, or someone talks you into signing an instruction that sends money to the wrong place.
The first is like a stranger using a copy of your house key. The second is like a con artist dressed as a delivery driver who convinces you to hand over the parcel yourself. Banks are good at spotting the stranger with the copied key; the con artist is harder to catch, because you really did open the door.
Main types of payment fraud
Fraud teams group cases by how the criminal gets control of the payment:
- Card fraud. Stolen card numbers are used online as card-not-present purchases, while cloned or stolen physical cards are used in shops and at cash machines. Numbers come from card skimming, data breaches and card testing fraud, in which criminals use small trial payments to find out which stolen numbers still work.
- Account takeover. A criminal gains access to an online bank or wallet login, often through phishing or SIM swapping, and sends money out. See account takeover.
- Authorised push payment scams. The victim is persuaded to send a bank transfer to a criminal, for example by someone posing as the bank's fraud team. See authorised push payment (APP) fraud.
- Invoice and mandate fraud. A business pays a real supplier's invoice into an account that a criminal has swapped in, often after business email compromise. See payment diversion fraud.
- New-account fraud. Accounts are opened with stolen details (identity theft) or invented ones (synthetic identity fraud), then used to borrow, to cash out stolen funds or to act as mule accounts.
- Cheque and direct debit fraud. Forged, altered or stolen cheques and unauthorised debits drawn on someone else's account.
Scale of the problem
Figures are collected differently in each region, so they are not directly comparable. A joint report by the European Banking Authority and the European Central Bank, published in December 2025, put reported payment fraud in the European Economic Area at €4.2 billion in 2024, up from €3.5 billion in 2023. Credit transfers accounted for about €2.2 billion and cards for about €1.3 billion. The report found that payments protected by strong customer authentication were far less likely to be fraudulent, especially for cards, but that the protection was weaker for credit transfers because more losses came from scams in which customers authorised the payment themselves.
In the United Kingdom, UK Finance reported losses of about £1.17 billion for 2024: around £722 million of unauthorised fraud and about £451 million of APP fraud. In the United States, the Federal Trade Commission said consumers reported losing more than $12.5 billion to fraud in 2024, a figure that covers all scams rather than payments alone.
Who bears the loss
The answer depends on the payment type and the country. For cards, the chargeback system usually puts unauthorised card losses on the merchant or the card issuer rather than the cardholder, which is part of why card users tend to be well protected. In the US, Regulation E limits a consumer's liability for unauthorised electronic transfers if they report the problem promptly. In the EU, PSD2 requires providers to refund unauthorised transactions, subject to limited exceptions for gross negligence.
Authorised scams were long treated as the customer's own problem. That has changed in several places. Since 7 October 2024 the UK requires payment firms to reimburse most APP scam victims on Faster Payments up to £85,000 per claim, with the cost shared between the sending and receiving firms. In the EU, the Council and Parliament reached a provisional agreement in November 2025 on a Payment Services Regulation that would make providers refund customers in some cases where a fraudster impersonates the bank; the details depend on the final adopted text.
How payment fraud is fought
Defences sit at every stage of a payment's life. Before a payment is made, firms check who the customer is through know your customer checks and confirm the payee through tools such as verification of payee. At the moment of payment they use authentication such as 3-D Secure for online cards, and they score each transaction with rules and models: velocity checking, behavioral analytics and anomaly detection. Card data itself is protected by tokenization and the PCI DSS security standard.
After the fact, firms investigate disputes, recover funds where possible and feed confirmed cases back into their models. Organisations that manage all of this as a planned programme, rather than as a set of separate tools, are practising fraud risk management. Instant payment systems make the work harder, because there is no delay in which a suspicious transfer can be stopped once it has been sent.