Payment Fraud Statistics 2026
By Axis Intelligence Research
Co-authors: Sarah Davis & Marcus Chen | Last updated: August 3, 2026 | License: CC BY 4.0
Something broke in the payments fraud model somewhere around 2024, and the December 2025 EBA-ECB report and the June 2026 UK Finance report both describe the same fracture from different sides. Card fraud is being contained. Fraud that walks through the front door — payments the victim authorised — is not. In the UK, £576.4 million was lost that way in 2025, a 19% rise, while unauthorised losses fell 5%.
Quick Answer
UK payment fraud losses reached £1.28 billion in 2025 across 4.06 million confirmed cases, per UK Finance. Across the European Economic Area, the total value of fraudulent payment transactions hit €4.2 billion in 2024, per the joint EBA-ECB report. Axis Intelligence Research finds that authorised push payment fraud now accounts for 45.0% of all UK payment fraud losses, up from 34.9% in 2020 — the highest share since comparable reporting began. In the United States, 76% of organisations faced attempted or actual payments fraud in 2025, with checks the most-targeted instrument.
Key Findings
- According to Axis Intelligence Research’s Authorised-Loss Share calculation, victim-authorised payments accounted for 45.0% of total UK payment fraud losses in 2025, up 10.1 percentage points from 34.9% in 2020 — meaning nearly half of all money lost to payment fraud now moves on payments the account holder personally approved.
- Axis Intelligence Research finds that malicious-payee scams — where the victim pays a criminal directly — grew from 47.6% of UK APP losses in 2020 to 75.8% in 2025, a 118.1% increase in absolute losses, while malicious-redirection scams (invoice, mandate, CEO and impersonation fraud) fell 36.8% over the same period.
- Axis Intelligence Research’s Recovery Gradient analysis finds a strong inverse relationship between average case value and reimbursement rate across the eight UK APP scam types — Spearman ρ = −0.762 — meaning the larger the typical loss, the less likely the victim gets the money back.
- Total fraudulent payment transaction value across the EEA reached €4.2 billion in 2024, up from €3.4 billion in 2022, while the fraud rate held near 0.002% of total transaction value, per the EBA-ECB joint report — growth driven by payment volume expansion rather than a rising fraud rate.
- Axis Intelligence Research finds the UK loss-per-case gap between authorised and card fraud widened to 14.7× in 2025 (£2,323.54 per APP case against £157.56 per card case), the widest since 2021, as card fraud shifted decisively toward high-volume, low-value attacks.
The Axis Payment Fraud Authorised-Loss Share (ALS) — Baseline Reading
Original Axis metric. Not published by any regulator or trade body.
Payment fraud reporting splits along a liability line rather than an analytical one. Regulators publish unauthorised fraud (a third party moves the money) separately from authorised fraud (the account holder is manipulated into moving it themselves). Nobody publishes the ratio between them as a tracked series — which is the number that actually tells you whether authentication controls or social-engineering controls are the binding constraint on losses.
The Axis Authorised-Loss Share (ALS v1.0) is that ratio.
Formula: ALS = authorised fraud losses ÷ total payment fraud losses × 100
Inputs: Gross loss values as published in the UK Finance Annual Fraud Report 2026 appendix (2020–2025 series). No normalisation, no weighting — a single disclosed division, reproducible by anyone holding the source table.
| Year | Unauthorised losses | Authorised (APP) losses | Total | Axis ALS |
|---|---|---|---|---|
| 2020 | £783.8m | £420.7m | £1,204.6m | 34.9 |
| 2021 | £730.4m | £583.2m | £1,313.6m | 44.4 |
| 2022 | £726.9m | £485.2m | £1,212.1m | 40.0 |
| 2023 | £708.7m | £459.7m | £1,168.4m | 39.3 |
| 2024 | £744.2m | £484.0m | £1,228.2m | 39.4 |
| 2025 | £703.4m | £576.4m | £1,279.8m | 45.0 |
Source: UK Finance, Annual Fraud Report 2026 (primary), published June 2026. ALS calculation: Axis Intelligence Research, methodology v1.0, as of August 3, 2026. This is the baseline reading of the index.
Limitations. ALS is currently UK-only, because the UK is the only major market publishing authorised and unauthorised payment fraud losses on a consistent, comparable annual series back to 2020. It measures gross losses before reimbursement, so it describes criminal proceeds rather than net consumer harm. It does not capture fraud that victims never report to a bank.
Sarah Davis: The number a fraud director should sit with is 45.0, not £1.28 billion. Total losses moved 4% — a rounding error against the underlying growth in payment volumes. The composition moved 5.6 percentage points in a single year. Every pound spent on strong customer authentication defends a shrinking share of the loss pool, because the criminal’s answer to authentication was to stop trying to beat it and start getting the customer to complete it for them. Confirmation of Payee catches a payment going to the wrong name. It has nothing to say about a payment going to exactly the name the victim intended.
How Much Is Lost to Payment Fraud Each Year?
The honest answer is that no single global figure exists, and the ones in circulation are built by adding numbers that do not add.
United Kingdom
UK Finance’s Annual Fraud Report 2026, compiled from data submitted by more than 300 member firms, is the most granular payment fraud dataset published anywhere. It records £1,279.8 million stolen in 2025 across 4,062,198 confirmed cases, both figures up on 2024 (+4% and +11% respectively). The industry prevented a further £1.68 billion, which UK Finance frames as 70p stopped in every £1 attempted.
| Metric | 2023 | 2024 | 2025 | Change |
|---|---|---|---|---|
| Total losses | £1,168.4m | £1,228.2m | £1,279.8m | +4% |
| Total confirmed cases | 2,967,363 | 3,675,955 | 4,062,198 | +11% |
| Unauthorised losses | £708.7m | £744.2m | £703.4m | −5% |
| APP (authorised) losses | £459.7m | £484.0m | £576.4m | +19% |
| Fraud prevented | — | — | £1.68bn | +11% |
Source: UK Finance, Annual Fraud Report 2026 (primary).
European Economic Area
The joint EBA-ECB 2025 Report on Payment Fraud, published December 15, 2025, covers every EU/EEA country reporting the full series under PSD2 Article 96(6). Total fraudulent transaction value ran €3.4 billion in 2022, €3.5 billion in 2023 and €4.2 billion in 2024 — a 23.5% rise across two years against a fraud rate the ECB describes as stable at roughly 0.002% of total transaction value.
Read carefully, the report publishes two different things, and conflating them is the most common error in secondary coverage. Total fraudulent transaction value was €4.2 billion. Separately, losses for 2024 were €2.200 billion on credit transfers (+16%) and €1.329 billion on card payments issued in the EU/EEA (+29%). Those two loss lines sum to €3.529 billion — but they cover two of five instruments, while the €4.2 billion headline spans all five and measures a different quantity.
Axis Intelligence Research does not merge these figures, and will not publish a derived difference between them. They answer different questions on different bases. Publishing €4.2bn − €3.529bn as a meaningful number would produce a statistic with no referent. The EBA’s own summary keeps the two separate; so do we.
United States
The US has no equivalent single payment-rail dataset. What exists is fragmented across the FTC’s consumer reports, FinCEN’s suspicious activity filings, the FBI’s complaint data, and industry surveys. The FTC’s 2024 Consumer Sentinel data recorded $2.09 billion lost through bank transfers and payments and $1.42 billion through cryptocurrency — the two highest-loss payment methods, exceeding all others combined. [older data] The 2025 Consumer Sentinel Data Book had not been published as of this article’s last-updated date; the FTC’s 2025 headline of $15.9 billion in total fraud losses comes from congressional testimony rather than a full payment-method breakdown.
Which Payment Rails Get Attacked Most?
Cards: high volume, collapsing value
Cards carry 99% of UK unauthorised fraud cases and a shrinking share of the money. Losses on UK-issued cards were £594.9 million in 2025, statistically unchanged from £592.5 million in 2024, while cases rose 11% to 3,775,687.
| Card fraud type | 2025 losses | 2025 cases | Loss change | Source |
|---|---|---|---|---|
| Remote purchase (CNP) | £423.5m | 3,196,962 | +3% | UK Finance 2026 |
| Lost & stolen | £109.8m | 449,189 | −2% | UK Finance 2026 |
| Card ID theft | £54.0m | 103,171 | −12% | UK Finance 2026 |
| Counterfeit | £4.7m | 18,477 | +21% | UK Finance 2026 |
| Card not received | £2.8m | 7,888 | −4% | UK Finance 2026 |
| Total | £594.9m | 3,775,687 | 0% | UK Finance 2026 |
Source: UK Finance, Annual Fraud Report 2026 (primary).
Card-not-present fraud alone produced more cases in 2025 than every fraud category combined in any year before 2024. The average CNP case value fell to £132, down 56% from £300 in 2016. UK Finance attributes the pattern to criminals socially engineering one-time passcodes out of cardholders, then using them to provision digital wallets or push through single transactions — authentication defeated by persuasion rather than by cryptography.
The fraud-to-turnover ratio, which normalises losses against spend, fell to 0.057% in 2025 from 0.084% in 2016. On that basis card fraud is a solved-and-managed problem that produces an enormous, irritating volume of small cases.
Credit transfers and instant payments: where the money actually goes
The EBA-ECB data makes the rail asymmetry explicit. Card fraud dominates by volume — roughly 17 million fraudulent card transactions in 2024 out of some 111 billion card payments on EU/EEA-issued cards — while credit transfers dominate by value at €2.200 billion in losses. And the distribution of who absorbs the damage differs sharply: for credit transfers, payment service users bore approximately 85% of total fraud losses in 2024, which the ECB attributes mainly to scams that tricked users into initiating the payments themselves.
The single most policy-relevant finding in the EEA report concerns strong customer authentication. Card payment fraud rates ran 17 times higher when the payee was located outside the EEA, where SCA is not legally required and often not applied. That is the cleanest natural experiment available on whether mandated authentication works on the fraud it was designed for. It does.
Checks: the rail that refuses to die
The United States is the outlier here, and the reason is instrument mix rather than criminal preference. The 2026 AFP Payments Fraud and Control Survey, fielded in January 2026 among 465 treasury practitioners, found 58% of organisations reported check fraud in 2025 — ahead of ACH debits (30%) and wire transfers (25%). Yet 72% of check-using organisations plan to keep using them, and 68% of those cite vendor requirements as the reason.
The contrast with the UK is stark. UK cheque fraud losses in 2025 were £4.1 million across 795 cases — the lowest ever recorded, with 96% of attempted cheque fraud prevented outright.
FinCEN’s Bank Secrecy Act data captures the American side of this. Financial institutions filed over 350,000 check fraud SARs in 2021 and over 680,000 in 2022, a 94.3% jump, per FinCEN’s mail theft alert. A follow-up FinCEN Financial Trend Analysis covering February 27 to August 31, 2023 identified 15,417 BSA reports tied to mail theft-related check fraud, involving roughly $688 million in completed and attempted transactions — an average of about $44,626 per report. [older data] FinCEN has not published an updated Financial Trend Analysis on this typology since.
Sarah Davis: A cheque is a bearer instrument with the account number, sort code and a signature specimen printed on the front, mailed through an unsecured physical network. The UK ran that instrument to near-zero — 795 loss cases in a country of 68 million people. The US files SARs on it by the hundred thousand. Nothing about the criminal is different. The difference is that 68% of US firms still writing cheques told AFP they do it because a vendor asked them to. That is not a fraud problem being solved by a fraud team. It is an accounts-payable procurement decision with a fraud invoice attached.
What US institutions are actually seeing
Federal Reserve Financial Services surveyed 400+ risk professionals in Q4 2025 for its 2026 Risk Officer Report.
| Finding | Share of institutions | Change |
|---|---|---|
| Debit card fraud attempts | 75% | — |
| Debit card share of total payments fraud losses | 40% | +4% YoY |
| Check fraud reported | 60% | multi-year resurgence |
| ACH account-holder scams | 41% | rising |
| Account takeover by authorised parties | 23% | +7% YoY |
| Counterfeit check increase cited | 32% | — |
Source: Federal Reserve Financial Services, 2026 Risk Officer Report press release, April 22, 2026 (primary). Survey fielded Q4 2025.
One inconsistency worth flagging: the Fed’s own Fed360 write-up of the same report states 63% of institutions reported check fraud attempts, while the press release states 60%. We use the press release figure and flag the discrepancy rather than silently picking the higher number.
What Kinds of Scams Drive Authorised Payment Fraud?
The UK data resolves this to eight named scam types, and the internal movement is more informative than the total.
| APP scam type | 2025 losses | Cases | Avg case value | Returned to victim | YoY loss |
|---|---|---|---|---|---|
| Investment | £221.5m | 14,893 | £14,873 | 48.1% | +40% |
| Purchase | £118.1m | 175,809 | £672 | 77.7% | +20% |
| Advance fee | £58.4m | 24,080 | £2,425 | 59.8% | +65% |
| Impersonation: police/bank | £55.5m | 6,016 | £9,225 | 79.5% | −18% |
| Invoice & mandate | £41.3m | 2,305 | £17,918 | 48.4% | −4% |
| Romance | £39.2m | 6,335 | £6,188 | 66.8% | +23% |
| Impersonation: other | £36.9m | 18,435 | £2,002 | 80.5% | −1% |
| CEO fraud | £5.6m | 197 | £28,426 | 19.6% | −53% |
Source: UK Finance, Annual Fraud Report 2026 (primary). Average case values and reimbursement percentages calculated by Axis Intelligence Research from published loss, case and returned-to-victim figures.
The malicious payee shift
UK Finance groups these eight into two families. Malicious redirection — the victim intends to pay a legitimate party but the payment is diverted — covers invoice and mandate, CEO, and both impersonation categories. Malicious payee — the victim pays exactly who they meant to pay, and that person is the criminal — covers purchase, investment, romance and advance fee.
Axis Intelligence Research finds malicious-payee scams rose from 47.6% of UK APP losses in 2020 (£200.5m of £420.8m) to 75.8% in 2025 (£437.2m of £576.5m). In absolute terms, malicious-payee losses grew 118.1% while malicious-redirection losses fell 36.8%.
Formula: malicious-payee share = (purchase + investment + romance + advance fee) ÷ (all eight scam types) × 100. Component values taken directly from the UK Finance 2026 appendix. Components sum to £576.5m against a published total of £576.4m; the £0.1m difference is rounding in the source, disclosed rather than adjusted.
That reversal is the whole strategic story of payment fraud in one ratio. Every control built for redirection fraud — Confirmation of Payee, payee-name matching, mandate verification — works by detecting a mismatch between intent and destination. Against malicious-payee fraud there is no mismatch. The name matches. The account matches. The intent matches. The only thing wrong is that the person on the other end is lying about what happens next.
The Axis Recovery Gradient
Original Axis cross-source finding.
Reimbursement is usually discussed as a policy question — whether firms should reimburse, at what threshold, funded by whom. The UK data supports an empirical question instead: which victims actually get money back?
Axis Intelligence Research calculated the average case value and the reimbursement rate for all eight UK APP scam types, then measured the relationship between them.
Result: Spearman rank correlation ρ = −0.762 between average case value and share of losses returned to the victim. Pearson r on log-transformed case values = −0.741.
The gradient is visible without statistics. The two scam types with the lowest average losses — impersonation: other (£2,002) and purchase (£672) — return 80.5% and 77.7% of losses. The two with the highest — CEO fraud (£28,426) and invoice & mandate (£17,918) — return 19.6% and 48.4%.
Two mechanisms plausibly drive this, and the published data cannot separate them. Business accounts are disproportionately represented in the high-value categories: 68% of invoice and mandate losses (£28.0m of £41.3m) sat on non-personal accounts, and businesses fall outside much of the UK’s mandatory reimbursement scope. Separately, the Payment Systems Regulator’s mandatory reimbursement framework caps in-scope claims at £85,000, which structurally excludes the largest losses.
Limitations: eight observations is a small sample, the correlation is descriptive rather than causal, and UK Finance’s reimbursement figures cover a wider payment and account population than the PSR’s in-scope mandatory reimbursement rules. We publish the coefficient with the sample size attached, and would revise the reading on any restatement of the source series.
Sarah Davis: The gradient describes something the reimbursement debate keeps missing. A framework that returns four-fifths of a £672 purchase scam and one-fifth of a £28,426 CEO fraud is not a safety net; it is a deductible applied in reverse. UK Finance itself reports that 88% of in-scope APP losses were reimbursed in the first year of the PSR rules. Both numbers are true. They describe different populations, and the population outside the scope is precisely the one where a single case can take a business’s working capital.
Where the money is authorised
| APP payment type | 2025 value | Payments | Value change | Source |
|---|---|---|---|---|
| Faster Payments | £460.9m | 486,050 | +20% | UK Finance 2026 |
| International | £69.6m | 12,312 | +40% | UK Finance 2026 |
| BACS | £19.1m | 2,929 | −30% | UK Finance 2026 |
| CHAPS | £17.6m | 183 | +11% | UK Finance 2026 |
| Intra-bank transfer | £9.2m | 17,959 | +37% | UK Finance 2026 |
Source: UK Finance, Annual Fraud Report 2026 (primary).
International payments are the line to watch: value up 40% and payment count up 106% year over year. Mandatory reimbursement applies only to payments authorised in the UK and received in a UK account — a boundary that criminals can read as easily as regulators can.
Mobile banking carried £301.8 million of APP losses across 410,417 payments in 2025, up 28% by value, overtaking internet banking (£218.5m) by a widening margin.
Who Enables Payment Fraud Before It Reaches the Bank?
UK Finance publishes origination data drawn from its Best Practice Standards platform, based on where victims report the approach began.
| Enabler | 2022 volume | 2025 volume | 2022 value | 2025 value |
|---|---|---|---|---|
| Online | 78% | 66% | 36% | 32% |
| Telecommunications | 18% | 17% | 45% | 28% |
| 2% | 1% | 12% | 7% | |
| Other | 1% | 5% | 3% | 8% |
| Unable to ascertain | 1% | 11% | 4% | 24% |
Source: UK Finance, Annual Fraud Report 2026 (primary).
The row that deserves attention is the last one. Cases where the origination channel could not be determined rose from 1% of volume and 4% of value in 2022 to 11% of volume and 24% of value in 2025. Nearly a quarter of APP fraud value in 2025 has no identified starting point. Any claim that fraud origination is shifting between platforms has to be read against a denominator that is losing resolution fast — and UK Finance itself notes that victims are not always aware where the initial compromise happened.
Sarah Davis: Attribution data is being used in a live policy fight about who pays for fraud prevention, which is exactly when a growing “unable to ascertain” bucket stops being a footnote. The telecoms value share fell from 45% to 28% over three years. Some of that is real — impersonation scams genuinely declined. Some of it is sitting in the unknown column. Anyone quoting the 66%/17% online-versus-telecoms split without quoting the 11% and 24% alongside it is quoting a number that has quietly lost a quarter of its base.
Is Business Email Compromise Still the Biggest Corporate Threat?
Two datasets point in opposite directions, and both are correct.
In the US, 74% of organisations were affected by business email compromise in 2025, per the 2026 AFP survey — a significant rise on 2023 and 2024. In the UK, CEO fraud losses fell 53% to £5.6 million across just 197 cases, the lowest case total ever recorded, and invoice and mandate fraud hit its lowest loss total ever at £41.3 million.
The reconciliation is that the two sources measure different things: AFP measures whether an organisation was targeted, UK Finance measures confirmed losses on UK payment accounts. Being targeted by BEC is now close to universal. Losing money to it, in the UK’s payment environment, is increasingly rare and increasingly concentrated — CEO fraud carries the highest average case value of any APP scam type at £28,426.
For scale on the American loss side, the FBI’s IC3 recorded $3.047 billion in BEC losses across 24,768 complaints in 2025, with 86% of those losses travelling by wire transfer or ACH. That figure is held in the Axis canonical registry and owned by our online fraud statistics analysis; the underlying source is the FBI IC3 2025 Annual Report, published April 2026 at ic3.gov.
One further AFP finding is worth putting next to that: just 17% of organisations use AI to combat payments fraud, while criminals are documented deploying it on the attack side. Of the organisations that do, 45% reported improved deepfake detection.
Methodology
Collection. Every figure in this article was retrieved from a primary source document opened during the production session on August 3, 2026, and every figure appears as a row in the accompanying CSV with its source organisation, document, URL and retrieval date. No figure was carried over from prior Axis articles except the FBI IC3 BEC figures, which are restated from the Axis canonical registry at their registry value and as-of date, with the owning page linked.
Primary sources.
- UK Finance, Annual Fraud Report 2026 (published June 2026; covers calendar year 2025; data submitted by 300+ member firms under agreed reporting templates with three-stage plausibility validation).
- European Banking Authority and European Central Bank, 2025 Report on Payment Fraud (EBA/REP/2025/40, published December 15, 2025; semi-annual PSD2 Article 96(6) data, H1 2022–H2 2024).
- Federal Reserve Financial Services, 2026 Risk Officer Report press release (April 22, 2026; survey of 400+ risk professionals fielded Q4 2025).
- Association for Financial Professionals, 2026 Payments Fraud and Control Survey (fielded January 2026; 465 US treasury practitioners).
- FinCEN, Alert on Nationwide Surge in Mail Theft-Related Check Fraud and Financial Trend Analysis: Mail Theft-Related Check Fraud.
- Federal Trade Commission, 2024 Consumer Sentinel data release (March 2025).
Formulas. Axis Authorised-Loss Share: ALS = authorised losses ÷ total losses × 100. Malicious-payee share: (purchase + investment + romance + advance fee) ÷ sum of all eight scam types × 100. Average case value: losses ÷ confirmed cases. Reimbursement rate: returned to victim ÷ losses × 100. Recovery Gradient: Spearman rank correlation and Pearson correlation on log₁₀-transformed average case values, n = 8.
Validation. Our average-case-value method was tested against figures UK Finance publishes independently. We calculate £132.47 for remote purchase fraud against UK Finance’s stated £132; £157.56 across all card fraud against its stated £158; £671.71 for purchase scams against its stated £671; and £28,426 for CEO fraud against its stated “just over £28,000.” All four match, which confirms the derived averages elsewhere in the table use the same basis as the source.
Limitations.
- All loss figures are reported losses. Unreported payment fraud is excluded by construction and is believed to be substantial.
- UK Finance figures are gross, before recoveries and reimbursement.
- The ALS index is UK-only; no other market publishes a comparable authorised/unauthorised split on a consistent annual series.
- EEA data runs to end-2024; the next EBA-ECB report is expected to extend the series to 2025.
- The Recovery Gradient rests on eight observations and describes correlation, not causation.
- US organisational figures come from surveys of self-selected respondents, not from transaction-level reporting.
- UK Finance notes that its data series are subject to restatement; readings here reflect the June 2026 publication.
About This Dataset
Title: Payment Fraud Statistics 2026 — Axis Intelligence Research Dataset
Coverage: United Kingdom (2016–2025), European Economic Area (2022–2024), United States (2021–2025)
Contents: Payment fraud losses and case counts by rail, instrument and scam type; authorised versus unauthorised splits; reimbursement rates; organisational survey findings; Axis-derived indices
Derived metrics: Axis Authorised-Loss Share (ALS v1.0); malicious-payee share of APP losses; Axis Recovery Gradient; loss-per-case divergence ratio
License: Creative Commons Attribution 4.0 International (CC BY 4.0). Share and adapt freely with attribution.
Dataset mirrors: Hugging Face, Kaggle and GitHub (CC BY 4.0).
Citation formats:
APA: Axis Intelligence Research, & Davis, S. (2026, August 3). Payment fraud statistics 2026: Losses by rail, region and scam type. Axis Intelligence. https://axis-intelligence.com/payment-fraud-statistics/
MLA: Axis Intelligence Research and Sarah Davis. “Payment Fraud Statistics 2026: Losses by Rail, Region and Scam Type.” Axis Intelligence, 3 Aug. 2026, axis-intelligence.com/payment-fraud-statistics/.
Chicago: Axis Intelligence Research and Sarah Davis. “Payment Fraud Statistics 2026: Losses by Rail, Region and Scam Type.” Axis Intelligence. August 3, 2026. https://axis-intelligence.com/payment-fraud-statistics/.
Copy this citation block to attribute this research in your work.
Frequently Asked Questions
How much money is lost to payment fraud each year?
UK payment fraud losses reached £1,279.8 million in 2025 across 4,062,198 confirmed cases, per UK Finance. Across the European Economic Area, fraudulent payment transactions totalled €4.2 billion in value in 2024, per the joint EBA-ECB report. No comparable single figure exists for the United States, where payment fraud data is split across the FTC, FinCEN, the FBI and industry surveys with different scopes and definitions.
What is authorised push payment fraud?
APP fraud occurs when a victim is deceived into personally authorising a payment to a criminal. Because the account holder approves the transaction, authentication controls such as strong customer authentication do not block it. UK APP losses were £576.4 million in 2025 across 248,070 cases, up 19% year over year. Axis Intelligence Research calculates that APP fraud now represents 45.0% of all UK payment fraud losses, up from 34.9% in 2020.
Which payment method is most targeted by fraud?
It depends on whether you measure cases or value. By case volume, cards dominate: 99% of UK unauthorised fraud cases occur on debit and credit cards, with 3,775,687 card cases in 2025. By value, credit transfers lead in Europe at €2.200 billion in 2024 losses. For US organisations, paper checks are the most-targeted instrument, cited by 58% of respondents to the 2026 AFP survey, ahead of ACH debits at 30% and wires at 25%.
Is card fraud getting better or worse?
Both, depending on the metric. UK card fraud losses were essentially flat in 2025 at £594.9 million, while cases rose 11% to a record 3.78 million. The average loss per card fraud case fell to £158 from £410 in 2015, and the fraud-to-turnover ratio dropped to 0.057%. Criminals are hitting many more people for much smaller amounts — better in aggregate financial terms, worse in the number of people affected.
Does strong customer authentication actually reduce payment fraud?
The evidence for the fraud types SCA was designed to stop is clear. The EBA-ECB 2025 report found card payment fraud rates ran 17 times higher when the payee was outside the EEA, where SCA is not legally required. SCA does not address authorised push payment fraud, where the victim completes the authentication themselves, which is why APP losses have grown as card fraud has been contained.
What percentage of payment fraud losses are reimbursed?
In the UK, £354.3 million of £576.4 million in APP losses was returned to victims in 2025 — 61% overall — with UK Finance reporting that 88% of losses in scope of the Payment Systems Regulator’s mandatory reimbursement rules were reimbursed in the framework’s first year. Axis Intelligence Research finds reimbursement rates vary sharply by scam type, from 80.5% for other-impersonation scams down to 19.6% for CEO fraud, with a Spearman correlation of −0.762 between average case value and reimbursement rate.
Why is check fraud still a major problem in the United States?
Because the instrument is still widely used. The 2026 AFP survey found 58% of US organisations experienced check fraud in 2025, yet 72% of check-using organisations plan to continue, with 68% citing vendor requirements. FinCEN recorded over 680,000 check fraud suspicious activity reports in 2022, nearly double the 2021 figure. By contrast, UK cheque fraud losses in 2025 were £4.1 million across 795 cases, the lowest ever recorded.
What is the Axis Authorised-Loss Share?
The ALS is a proprietary Axis Intelligence Research metric measuring the share of total payment fraud losses attributable to payments the victim personally authorised. The formula is authorised losses divided by total losses, times 100, applied to the UK Finance published series. The 2025 baseline reading is 45.0, up from 34.9 in 2020. It exists because regulators publish authorised and unauthorised fraud separately but never as a ratio, and the ratio is what indicates whether authentication controls or social-engineering controls are the binding constraint on losses.
Is AI increasing payment fraud?
Adoption on the defensive side lags the threat. The 2026 AFP survey found only 17% of organisations use AI to combat payments fraud, while 74% experienced business email compromise in 2025. Organisations that do deploy AI reported improved deepfake detection (45%), more efficient fraud reporting (49%) and better real-time identification (43%). Federal Reserve Financial Services reported that criminals are increasingly using impersonation, social engineering and credential compromise across every payment rail.
Which fraud types are growing fastest?
In the UK in 2025, advance fee fraud losses rose 65% to £58.4 million, investment scam losses rose 40% to £221.5 million, romance scam losses rose 23% to £39.2 million, and purchase scam losses rose 20% to £118.1 million — all record highs. Every one of them is a malicious-payee scam. Over the same period, CEO fraud fell 53% and impersonation of police or bank staff fell 18%.