Card-not-present fraud in Europe: why the payment channel matters

Where card payments happen, and where card fraud happens

Card fraud has followed card payments online, but not in proportion. The 2025 Report on Payment Fraud from the European Banking Authority (EBA) and the European Central Bank (ECB), published in December 2025 and covering 2022 to 2024, is the most detailed public picture of this for the European Economic Area (EEA).

According to that report, remote card payments made up only around 28% of the value and 18% of the number of card transactions in 2024, yet remote card fraud accounted for around 83% of all card fraud, by both value and volume. The report puts the fraud rate for remote card payments at 13 times that of in-person payments by value, and 22 times by volume.

The same report says fraudulent card payments with cards issued in the EU/EEA totalled about 1.4 billion US dollars in 2024, with around 17.06 million fraudulent card transactions out of around 111.05 billion. The average fraudulent card transaction was about 82 US dollars, far smaller than the average fraudulent credit transfer at about 2,333 US dollars, which the report suggests could be linked to attempts to avoid detection or strong authentication. Amounts converted from euros at the ECB's 2024 average reference rate of 1.08 US dollars per euro.

What online card fraud looks like

The EBA and ECB report breaks remote card fraud down by type. In 2024, theft of card details accounted for more than 56% of the value of remote card fraud and around 65% of its volume. Manipulation of the payer was a small part of card fraud, around 9% by value and 2% by volume. The report suggests this reflects fraudsters testing large volumes of card numbers and targeting payments where strong authentication was not applied, attacking the infrastructure rather than individual people.

That matches what card testing looks like in practice: many small authorisations from the same device, IP range or merchant account, with card numbers that change on every attempt. A rule that looks at one transaction at a time sees nothing unusual. A count over the last minute or hour sees the pattern at once.

Strong authentication works where it is used

The EU's second Payment Services Directive requires strong customer authentication (SCA) for most electronic payments, with some exemptions. The EBA and ECB report finds that card payments authenticated with SCA had consistently and substantially lower fraud rates than those without it. In 2024, card fraud rates without SCA within the EEA were twice as high as with SCA, and for transactions outside the EEA they were three times higher by value and four times higher by volume.

Coverage is far from complete. The report says only 40% of electronically initiated card payments by number were authenticated with SCA in 2024, around 64% by value, largely because contactless payments at the point of sale are often exempt.

Geography matters too. The report finds card fraud rates about seventeen times higher when the other side of the payment was outside the EEA, where SCA may not be required, and says 30% of the value of fraudulent card payments in 2024 was linked to cross-border transactions outside the EEA.

Exemptions are where fraud goes

For remote card payments, the most used exemption is transaction risk analysis: the payment provider assesses the payment as low risk and skips SCA. The EBA and ECB report says around 29% of remote card payments without SCA were exempted this way in 2024, with merchant-initiated transactions at 22% and 26% of remote transactions reported as outside the scope of SCA.

The report also finds that fraud rates for remote card payments exempted from SCA were generally above the overall card fraud rate, and suggests that fraudsters adapt by aiming at transactions likely to fall under common exemptions. An exemption is only as safe as the risk analysis behind it. The decision to skip authentication is a fraud decision and deserves the same care as any other.

The UK picture

UK Finance's Annual Fraud Report 2026, published in June 2026, shows the same shift. Remote purchase fraud, its name for card-not-present fraud, caused 423.5 million pounds of losses in 2025, up 3% from 2024, across 3,196,962 cases, up 13% and the highest case total it has ever reported.

UK Finance says average case values fell from 300 pounds in 2016 to 132 pounds in 2025. It also reports that criminals continue to trick victims into disclosing one-time passcodes, which are then used to register cards in digital wallets or to complete online transactions. A passcode proves that someone has the phone. It does not prove that the person holding it wanted to make the payment.

What this means for an online merchant or payment provider

A few practical habits follow. Look at bursts and links between payments, since card testing and stolen card details show up as patterns across many small payments rather than in any single one. Treat the choice between frictionless and authenticated as a risk decision, made per payment with the best data available. And pay close attention to cross-border payments, where both SCA coverage and fraud rates differ most.

How FRAPE uses this

FRAPE scores each payment in real time with the signals that card-not-present fraud leaves behind. It counts payments per card, device, email, IP and identity over minutes, hours and a full day, places every IP and card BIN in a country from reference data it holds itself, and recognises devices that have appeared on other cards or accounts. FRAPE never accepts card numbers: cards are identified by a fingerprint, the BIN and the last four digits.

Rules decide the clear cases, FRAPE Decision Core advises on the uncertain ones, and your policy returns approve, challenge, review or decline. A challenge is the natural place to ask for strong authentication when a payment does not look low risk.

• How a FRAPE decision is made
• Decision Core features