Credit Card Fraud Statistics 2026: CNP, Skimming and Losses

Credit card fraud statistics for 2026 show losses near record levels as fraud moves online. Payment card fraud cost issuers, merchants and acquirers USD 33.41 billion worldwide in 2024, according to the Nilson Report, and the United States had 41.87% of those losses with 26.31% of card volume. Most of it is card-not-present: 83% of card fraud by value in the European Economic Area in 2024 was remote, and remote purchases made up about 71% of UK card fraud losses in 2025. Below are the verified numbers, what each one measures and what they mean.

Credit card fraud statistics at a glance

Every figure below was checked against the publisher's own report, page or press release on 5 November 2026. Most datasets combine credit, debit and prepaid cards, and they use different units and currencies, so read the "What it measures" column before comparing two rows.

Primary sources for each row are linked in the sections below and listed under Sources and References.

Where is the FTC's 2025 Data Book?

As of 5 November 2026, the FTC's Consumer Sentinel reports page still lists the 2024 Data Book, published in March 2025, as its newest edition. The FTC has not published a 2025 breakdown of fraud reports by payment method or category, so every FTC number on this page is 2024 data and will be updated when the 2025 Data Book appears. The FTC also counts credit card identity theft, such as new accounts opened in a victim's name, in a separate category; those numbers are covered in our identity theft statistics and are not repeated here.

Six sources, six different measures

Card fraud numbers disagree because each publisher measures a different thing in a different market. A "USD 33 billion" figure and a "USD 275 million" figure can both be correct.

The practical rule: use Nilson for the global total, the Federal Reserve and the EBA/ECB for official channel and liability data, UK Finance for the longest consistent trend, and the FTC and FBI for what victims report.

Global card fraud losses

The Nilson Report, a payments trade publication that surveys more than 2,000 card issuers and payment businesses, put worldwide payment card fraud losses at USD 33.41 billion in 2024, down 1.2% from USD 33.83 billion in 2023. Those losses were tied to USD 51.920 trillion in global credit, debit and prepaid card volume (Nilson Report summary, December 2025). Nilson's full tables are subscription-only, so the figures here come from its public summary and its 7 January 2026 press release.

• Fraud losses equaled 6.43 cents per USD 100 of card volume in 2024, down from 6.58 cents in 2023.
• Nilson projects card fraud losses of USD 41.06 billion by 2030 and USD 48.50 billion by 2034, and USD 407.60 billion cumulatively over the next 10 years.
• Nilson's publisher attributed the dip to AI-based fraud models, while pointing to social engineering scams that trick consumers into handing over card details as a growing source of fraud.

The 2024 decline is small, and losses remain far above pre-pandemic levels. Treat it as a plateau rather than a turning point.

Credit card fraud in the United States

The US carries a disproportionate share of global losses

The United States accounted for 26.31% of global card volume in 2024 but 41.87% of global card fraud losses, according to Nilson. Applied to the USD 33.41 billion total, that is about USD 14.0 billion in US card fraud losses (our calculation). Nilson links the gap to the size of US online spending, which is more exposed to fraud, and to scams that collect card details for resale.

US card fraud rates are also higher than in markets that require strong customer authentication: the Federal Reserve Bank of Kansas City found that the US debit card-present fraud rate on Visa- and Mastercard-type networks was 14.2 basis points in 2023, compared with 0.7 basis points for card-present payments in the EEA (Kansas City Fed, February 2026).

What consumers report to the FTC

When consumers report fraud to the FTC and say how they paid, credit cards are the payment method named most often. In 2024 the FTC received 2,600,678 fraud reports, and 475,905 of them (18%) identified a payment method (FTC Consumer Sentinel Network Data Book 2024, page 11).

Credit cards appear in about 23% of reports that named a payment method (our calculation), but they carry far smaller losses than bank transfers or cryptocurrency. That pattern reflects chargeback rights: card payments can be disputed, so scammers who want large sums push victims toward transfers and crypto instead. The FTC's figures are unverified consumer reports, and they cover scams paid with a card, not every unauthorized card charge.

What the Federal Reserve's debit card data shows

The Federal Reserve Board's biennial report on debit card transactions, published in December 2025, gives the most detailed official US view of card fraud by type. It covers issuers with USD 10 billion or more in assets (Federal Reserve Board, 2023 debit card report):

• Fraud losses to all parties were 17.6 basis points of transaction value in 2023, or USD 17.63 per USD 10,000, up from 7.8 basis points in 2011 and 17.5 in 2021.
• Card-not-present fraud made up 54.3% of fraud losses, followed by lost and stolen card fraud (22.2%) and counterfeit fraud (17.5%).
• Fraud losses were 17.9 basis points on dual-message networks (the Visa and Mastercard type), 6.7 on single-message (PIN) networks and 312.6 on prepaid cards.
• Merchants absorbed 49.9% of fraud losses, issuers 28.3% and cardholders 21.8%. Merchants absorbed 65.1% of card-not-present fraud losses.

The Kansas City Fed's analysis of the same data found the card-not-present fraud rate kept rising from 2021 to 2023 on both network types, and on single-message networks it rose by more than 10 basis points to overtake dual-message networks for the first time.

Complaints to the FBI: up 46% in 2025

The FBI's Internet Crime Complaint Center tracks "credit card/check fraud," defined as theft and fraud committed using a credit card or similar payment mechanism as a fraudulent source of funds. Its 2025 Internet Crime Report shows a sharp rise:

Complaints rose 46% and reported losses rose 41% in 2025 (our calculations). These are small numbers next to Nilson's totals because most cardholders resolve fraud with their bank and never file with the FBI.

Prosecutions: 718 federal cases a year

Few card fraud cases reach federal court. The US Sentencing Commission reports that 718 of the 66,662 federal cases sentenced in fiscal year 2025 involved credit card and other financial instrument fraud, down 8% since fiscal 2021. The average sentence was 28 months, 95% of individuals were sentenced to prison, and 39% received a sentence increase for using an unauthorized means of identification (USSC Quick Facts). The category also includes debit cards, checks, bank accounts and non-mortgage loans.

Card-not-present and ecommerce fraud statistics

Card-not-present (CNP) fraud happens when stolen card details are used online, by phone or by mail order, without the physical card. Every official dataset now shows it as the largest share of card fraud.

The EEA data shows why criminals prefer remote channels. In 2024 the fraud rate for remote card payments was 0.091% of value, against 0.007% for in-person card payments, 13 times higher by value and 22 times higher by volume (EBA and ECB 2025 Report on Payment Fraud). Chip cards and contactless limits made in-person fraud harder, so stolen card numbers are monetized online.

UK remote purchase and ecommerce fraud

UK Finance reports that remote purchase fraud on UK-issued cards reached GBP 423.5 million in 2025, up 3%, across 3,196,962 cases, up 13% and the highest case count UK Finance has recorded. Within that, fraud on online card transactions reached GBP 250.8 million, up 9% and the highest since the series began in 2018 (UK Finance Annual Fraud Report 2026). UK Finance names data compromise, "including through data hacks at third parties such as retailers," as a major driver of ecommerce card fraud, and notes that stolen card data can be used for months or years after a breach.

The average remote purchase case fell from GBP 300 in 2016 to GBP 132 in 2025. UK Finance links this to a high-volume, low-value pattern: criminals socially engineer victims into revealing one-time passcodes, then use them to register stolen cards in digital wallets or to approve one-off online purchases.

Ecommerce fraud reported by US consumers

On the consumer side, "online shopping and negative reviews" was the second most reported fraud category in the FTC's 2024 Data Book, with 383,441 reports. Seventy-six percent of those reports included a loss, totaling USD 432 million, with a median loss of USD 130. These are mostly scams such as goods paid for and never delivered, not unauthorized use of a stolen card, but they share the same online checkout channel.

Card testing

Before using stolen cards, criminals check which numbers still work by running small authorizations against real merchants. Recorded Future, a threat intelligence firm owned by Mastercard, reported that Telegram-based card testing services validated at least 27 million payment card records in 2025 (Recorded Future 2025 Annual Payment Fraud Intelligence Report). For a merchant, card testing shows up as bursts of small declined and approved payments, chargebacks and processor penalties, even when no customer data was stolen from its own site.

E-skimming and Magecart statistics

E-skimming, often called Magecart after the groups that popularized it, is malicious JavaScript added to a checkout page that copies card details as customers type them and sends them to the attacker while the purchase completes normally. Attackers get the script in through a vulnerable ecommerce platform or plugin, a compromised admin account, or a compromised third-party script such as a tag manager, chat widget or analytics library. Skimmed card data is typically resold through carding shops; our BriansClub explainer shows how one of the largest priced and sold it.

Recorded Future's 2025 report, a vendor estimate based on its monitoring of ecommerce sites, found:

• More than 10,500 unique Magecart e-skimmer infections were active at some point in 2025, stable compared with 2024, and more than 7,300 of them were new.
• Those infections likely compromised at least 23.4 million online transactions.
• One e-skimmer kit sold on criminal forums accounted for 26% of infections, a sign that skimming is now sold as a ready-made service.
• Criminals posted more than 142 million stolen card records for sale, down 19% from 2024, but 82% of card records stolen from online transactions came with the victim's email address or phone number, up 9 percentage points, which makes follow-on account takeover and phishing easier.
• Infection volumes did not appear to fall after the PCI DSS v4.0 future-dated requirements took effect in early 2025. Recorded Future's reading is that compliance rules alone are not enough.

The 2024 spike that preceded these numbers was driven by mass exploitation of CosmicSting (CVE-2024-34102), a vulnerability in Adobe Commerce and Magento, which shows how quickly one unpatched platform flaw becomes a skimming wave.

The PCI Security Standards Council responded with two requirements in PCI DSS v4.0.1 that have been mandatory since 31 March 2025. Requirement 6.4.3 requires every script on a payment page to be authorized, integrity-checked and inventoried, and Requirement 11.6.1 requires a mechanism that detects unauthorized changes to payment page scripts and security-relevant HTTP headers (PCI SSC e-skimming guidance). Our guide to PCI DSS 6.4.3 and 11.6.1 explains both requirements, the 2025 SAQ A change and the British Airways skimming case, in which the UK Information Commissioner's Office fined the airline GBP 20 million.

Card fraud in Europe

The European Banking Authority and the European Central Bank publish the most complete official fraud dataset in the world, based on mandatory reporting by payment providers under the revised Payment Services Directive (PSD2). Their joint press release of 15 December 2025 and full report show:

Strong customer authentication works where it is applied: SCA-authenticated card payments showed lower fraud rates than non-SCA payments. The gaps are transactions outside the EEA, where SCA is often not required, and exemptions such as low-value and contactless payments. Total payment fraud across all instruments in the EEA rose from EUR 3.5 billion in 2023 to EUR 4.2 billion in 2024, and cards were about 31% of it (our calculation).

Card fraud in the UK

UK Finance publishes the longest consistent card fraud series. Fraud losses on UK-issued cards were GBP 594.9 million in 2025, almost unchanged from GBP 592.5 million in 2024, but confirmed cases rose 11% to 3,775,687. Banks prevented a further GBP 1.33 billion in attempted card fraud.

Source: UK Finance Annual Fraud Report 2026, pages 21 to 26. Cases count cards defrauded, not people.

Three trends stand out. First, criminals are trading value for volume: the average loss per card fraud case fell from GBP 410 in 2015 to GBP 158 in 2025. Second, card-present fraud is a small and low-tech slice, with GBP 86.3 million lost in UK shops, including GBP 46.8 million through contactless. Third, breaches keep feeding the system: UK Finance's intelligence unit passed 2,774,022 compromised card numbers back to issuers in 2025 so they could block or reissue the cards.

Payment fraud statistics beyond cards

Cards produce the most fraud cases, but bank transfers now produce the largest losses, because criminals persuade victims to authorize the payment themselves.

• EEA: fraudulent credit transfers reached EUR 2.5 billion in 2024, up 24%, and manipulation of the payer accounted for 74% of that value, up from 65% in 2023. Payment service users bore about 85% of credit transfer fraud losses, compared with 38% for cards.
• UK: authorized push payment (APP) fraud losses rose 19% to GBP 576.4 million in 2025, while unauthorized fraud losses, mostly cards, fell 5% to GBP 703.4 million. Total UK payment fraud losses were GBP 1.28 billion.
• US: in the FTC's 2024 Data Book, bank transfers and payments carried the highest aggregate reported fraud losses (USD 2.09 billion), followed by cryptocurrency (USD 1.42 billion).

For organizations, the lesson is that card fraud controls and social engineering defenses have to work together. The same one-time passcode theft that drives UK card fraud also drives account takeover, which our account takeover statistics cover in depth.

Who pays for card fraud

Cardholders are usually reimbursed, but the cost does not disappear. It moves to merchants and issuers, and the split depends on the market and the channel.

The US figure that matters most for online businesses is the second row: merchants absorbed about two-thirds of debit card-not-present fraud losses, mostly through chargebacks. The merchant's share of all US debit fraud losses rose from 38.3% in 2011 to 49.9% in 2023, while cardholders' share rose from less than 1.8% to 21.8%.

What the numbers mean for merchants and payment teams

The statistics point to the places where a merchant or payment provider can cut its share of card fraud: the checkout page, the payment and account APIs, and the people who handle authentication. This checklist is DeepStrike's method guidance, not a requirement from any regulator or card brand.

1. Inventory and authorize every payment page script. List each first- and third-party script that loads on payment pages, record why it is needed, and enforce integrity with Content Security Policy or Subresource Integrity, as PCI DSS 6.4.3 requires. Output: an approved script inventory with owners.
2. Detect tampering in the customer's browser. Monitor payment pages and security headers as the browser receives them and route alerts to someone who acts, as Requirement 11.6.1 requires. Output: alert records and a tested response procedure.
3. Test the paths skimmers use to get in. Test the ecommerce platform, plugins, admin logins and the tag manager or content management system that can change checkout code, including cross-site scripting flaws that let attackers inject script. Output: validated findings with severity, not a scanner list.
4. Test checkout and payment APIs against card testing. Check rate limits, bot controls, authorization logic and error messages on payment, gift card and stored-card endpoints. Output: a pass or fail for each control.
5. Test account takeover routes to stored cards. Verify credential stuffing defenses, MFA, password reset, session handling and the step-up checks for adding a new card or wallet. Output: bypass paths with severity.
6. Scope and segment the cardholder data environment. Confirm which systems store, process or transmit card data and test the segmentation that keeps others out, as PCI DSS 11.4 requires. Output: a validated scope and segmentation test result.
7. Retest after fixes. Confirm each fix closes the path rather than moving it. Output: a closed finding with evidence.

Our credential stuffing statistics show the scale of automated login attacks, and the retail data breach statistics cover the breaches that feed stolen card data into this cycle.

How we compiled these credit card fraud statistics

Selection. We used government and regulator data (FTC, Federal Reserve Board, Federal Reserve Bank of Kansas City, FBI IC3, US Sentencing Commission, EBA and ECB), an industry association that reports its members' data (UK Finance), a payments trade publication (the Nilson Report) and one threat intelligence vendor for e-skimming data that no public body collects (Recorded Future). Every figure was read on the publisher's page, report or press release and checked on 5 November 2026. We excluded survey figures from aggregator and vendor blog pages.

Report years. Nilson's 2024 losses were published in December 2025 and January 2026. The FTC Data Book 2024 covers calendar 2024 and was published in March 2025; no 2025 Data Book exists yet. The Federal Reserve Board's debit card report covers 2023 and was published in December 2025. IC3, UK Finance and Recorded Future report on 2025. The EBA and ECB report covers 2022 to 2024.

Calculations. These figures are our arithmetic from published numbers: US card fraud losses of about USD 14.0 billion (41.87% of USD 33.41 billion); credit cards in about 23% of FTC reports that named a payment method (108,881 of 475,905); the 46% rise in IC3 complaints (18,774 against 12,876) and 41% rise in losses; UK remote purchase fraud at about 71% of card losses (423.5 of 594.9) and 85% of cases; cards at about 31% of EEA payment fraud (1.3 of 4.2); and the 62% of EEA card losses not borne by payment service users. All other numbers are quoted as published.

Limits. The datasets cover different markets, card types, currencies and years, so they cannot be added together. Report and complaint counts measure who chose to report, not how much fraud occurred. The Federal Reserve data covers debit cards at large issuers only. Recorded Future's infection and transaction counts are a vendor's estimates and are labeled as such. No single figure on this page is a complete count of card fraud.

Frequently asked questions

How much money is lost to credit card fraud each year?

Worldwide payment card fraud losses were USD 33.41 billion in 2024, according to the Nilson Report, down 1.2% from USD 33.83 billion in 2023. Nilson projects USD 41.06 billion by 2030. The US accounted for 41.87% of global losses, about USD 14.0 billion (our calculation).

How common is credit card fraud?

Very common, but most cases are resolved with the card issuer and never reported to authorities. UK banks recorded 3.78 million card fraud cases on UK-issued cards in 2025, and EU/EEA providers recorded about 17.06 million fraudulent card transactions in 2024. In the US, credit cards were the payment method named most often in FTC fraud reports in 2024.

What percentage of card fraud is card-not-present?

Most of it. Remote payments made up about 83% of EEA card fraud by value in 2024, remote purchase fraud made up about 71% of UK card fraud losses in 2025, and card-not-present fraud was 54.3% of US covered-issuer debit card fraud losses in 2023.

What are the latest ecommerce fraud statistics?

UK ecommerce card fraud losses reached GBP 250.8 million in 2025, the highest since 2018. US consumers filed 383,441 online shopping fraud reports with the FTC in 2024, with USD 432 million in reported losses. Recorded Future estimates that Magecart e-skimmers compromised at least 23.4 million online transactions in 2025.

What is Magecart, and how common is it?

Magecart is the name for e-skimming attacks that inject malicious JavaScript into checkout pages to copy card details. Recorded Future counted more than 10,500 active Magecart infections in 2025, more than 7,300 of them new. PCI DSS Requirements 6.4.3 and 11.6.1, mandatory since 31 March 2025, target this attack.

Is credit card fraud increasing?

It depends on the measure. Global losses dipped 1.2% in 2024, and UK card losses were flat in 2025, but case volumes keep rising: UK card fraud cases rose 11% in 2025, and credit card and check fraud complaints to the FBI rose 46%. Debit card fraud losses as a share of value have more than doubled since 2011.

Who pays for credit card fraud?

Mostly merchants and issuers. In US covered-issuer debit card data for 2023, merchants absorbed 49.9% of fraud losses and 65.1% of card-not-present fraud losses, issuers 28.3% and cardholders 21.8%. In the EEA, cardholders and other payment service users bore 38% of card fraud losses in 2024.

What can merchants do to reduce card fraud?

Inventory and authorize every payment page script, monitor payment pages for tampering, test the ecommerce platform and admin paths that skimmers use, test checkout and payment APIs against card testing and account takeover, and retest after fixes. These steps map to PCI DSS 6.4.3, 11.6.1 and 11.4.

Next steps

The numbers show where card fraud has moved: away from the physical card and into the checkout page, the payment API and the customer's inbox. Merchants cannot stop stolen cards from being sold, but they can make their own checkout a poor place to steal them and a poor place to use them.

If you need a PCI DSS penetration test that covers payment pages, payment APIs and segmentation, start with our PCI DSS penetration testing guide. DeepStrike's penetration testing services provide manual testing with fix recommendations for every finding.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• Nilson Report, "Card Fraud Losses Worldwide — 2024" (Issue 1298, 22 December 2025): https://nilsonreport.com/articles/card-fraud-losses-worldwide-2024/
• Nilson Report, "Global Card Fraud Losses at $33 Billion," press release via GlobeNewswire (7 January 2026): https://www.streetinsider.com/Press+Releases/Global+Card+Fraud+Losses+at+%2433+Billion/25819121.html
• Federal Trade Commission, Consumer Sentinel Network Data Book 2024 (March 2025): https://www.ftc.gov/system/files/ftc_gov/pdf/csn-annual-data-book-2024.pdf
• Federal Trade Commission, Consumer Sentinel Network Reports: https://www.ftc.gov/enforcement/consumer-sentinel-network/reports
• Board of Governors of the Federal Reserve System, 2023 Interchange Fee Revenue, Covered Issuer Costs, and Covered Issuer and Merchant Fraud Losses Related to Debit Card Transactions (December 2025): https://www.federalreserve.gov/paymentsystems/files/debitfees_costs_2023.pdf
• Federal Reserve Bank of Kansas City, "New Data on Card-Present and Card-Not-Present Fraud Rates in the United States" (25 February 2026): https://www.kansascityfed.org/research/payments-system-research-briefings/new-data-on-card-present-and-card-not-present-fraud-rates-in-the-united-states/
• Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 Internet Crime Report (April 2026): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• United States Sentencing Commission, Quick Facts: Credit Card and Other Financial Instrument Fraud (fiscal year 2025): https://www.ussc.gov/research/quick-facts/credit-card-fraud
• European Banking Authority and European Central Bank, 2025 Report on Payment Fraud, EBA/REP/2025/40 (December 2025): https://www.ecb.europa.eu/press/intro/publications/pdf/ecb.ebaecb202512.en.pdf
• European Banking Authority, "Joint EBA-ECB report on payment fraud" press release (15 December 2025): https://www.eba.europa.eu/publications-and-media/press-releases/joint-eba-ecb-report-payment-fraud-strong-authentication-remains-effective-fraudsters-are-adapting
• UK Finance, Annual Fraud Report 2026 (June 2026): https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf
• PCI Security Standards Council, "Payment Page Security and Preventing E-Skimming" information supplement announcement (March 2025): https://blog.pcisecuritystandards.org/new-information-supplement-payment-page-security-and-preventing-e-skimming
• Recorded Future, 2025 Annual Payment Fraud Intelligence Report (2026): https://assets.recordedfuture.com/Reports/Annual_Payment_Fraud_Intelligence_Report_2025.pdf