Card Fraud in France 2026: Statistics, Online Risk and Merchant Exposure
French card fraud has reached a paradoxical point: record-low fraud per euro paid, while internet transactions continue to absorb a disproportionate share of losses. The newest Banque de France figures show that where a payment is initiated—and how it is authenticated—matters much more than the familiar distinction between a plastic card and a phone.
Cards Are France's Everyday Payment Infrastructure
For an underwriting or fraud-control team, the denominator matters as much as the losses. Card payments are frequent, increasingly contactless and sometimes initiated by mobile wallets—yet those are different initiation methods, not separate national payment systems.
According to the Banque de France's September 2026 OSMP annual report (2025 data), cards represented 63% of French cashless payment transactions. The value of transactions made with cards issued in France increased to approximately €1,005 billion in 2025, from €977 billion in 2024. Value is not the same as transaction count, and card payments should not be confused with bank transfers carrying larger average amounts.
In-person card use has shifted substantially toward tap and wallet payments. For cards issued in France, the value mix comprised 36% conventional in-person payments, 16% contactless excluding mobile, and 7% mobile payments. Internet payments accounted for 27%, withdrawals 13%, and other remote payments about 1%. These figures describe payment value, not fraud.
At the point of sale, mobile wallets accounted for approximately 19% of proximity card payments by number in 2025. A phone can use the underlying card infrastructure, so it is incorrect to add mobile-wallet transactions on top of the overall card count. The growth of mobile initiation changes authentication and account-enrolment risks while leaving the underlying payment rail familiar.
This is the structural reason a national average can mask different fraud problems. A merchant selling furniture online, a supermarket accepting taps, and a hotel taking reservations by phone operate in very different risk environments even when all three transactions are called “card payments.”
Fraud Value Fell 8.6% as the Card Market Expanded
France is not experiencing a uniform increase in card losses. The value of fraudulent payments on French-issued cards declined in 2025, and the rate per euro paid fell to a new low. That improvement is real—but not universal across transaction types.
OSMP reported €474.5 million in fraudulent transactions on French-issued cards in 2025, down from €519.2 million in 2024. The count fell from 7,421,832 to 6,684,919. Both the value and volume declined while the value of legitimate card activity continued increasing. The corresponding value-based fraud rate was 0.047%, compared with 0.053% in 2024.
That is equivalent to roughly €47 of fraud per €100,000 paid with cards. This is a loss-value ratio, not the probability that one of every 2,128 individual transactions is fraudulent. The per-transaction count-based rate requires a transaction-count denominator and must be calculated separately.
The long view is more revealing than a 2024–2025 comparison alone. France's annual card-fraud value stayed in a comparatively narrow band for much of the 2020–2025 period, but genuine payment value expanded considerably. Rates therefore improved even when nominal losses were less dramatic. The same logic explains why an increase in suspicious attempts does not automatically mean a worsening confirmed-fraud rate.
We use the original report's French-issued card population throughout this section. Its separate domestic-transaction series can yield different rates and amounts because a French-issued card may be used abroad. Mixing domestic losses with worldwide French-issued card denominators would create a false comparison.
Internet Fraud Rates Fell, but Remote Acceptance Still Carries the Risk
The clearest evidence for an independent card-fraud article comes from the differences between channels and authentication methods. France's ecommerce improvements are substantial, but remotely initiated transactions remain structurally more exposed.
In 2025, fraudulent internet card payments on French-issued cards amounted to €331.7 million across 5.52 million cases, approximately 70% of card-fraud value. Internet fraud represented just 27% of card-operation value. The online fraud rate declined from 0.155% in 2024 to 0.124% in 2025, roughly half its 0.250% level in 2020.
Payments initiated remotely outside the internet—such as some mail- and telephone-order transactions—had an even higher rate of 0.322% in 2025, up from 0.271% in 2024. Their share of the total payment market is comparatively small. Still, the difference is material to a business that takes card numbers over the phone or accepts manually entered bookings.
At the other extreme, ordinary in-person card payments had a 0.011% fraud rate by value, while proximity mobile payments were 0.009%. Neither figure should be used to infer that a phone, wallet or physical card is inherently fraud-proof. The recorded mix reflects authentication, the payment environment and the risk of the underlying transaction population.
The chart compares the value-based fraud rates of different initiation channels within the same French-issued-card series. These are neither individual consumer victimization rates nor merchant chargeback ratios. Different transaction contexts also have different average ticket sizes and fraud-screening practices.
Where domestic ecommerce fraud was concentrated
France's domestic online-card fraud series—different from the French-issued card series used above—recorded approximately €210 million in 2025. Of that amount, general retail represented 24%, services to individuals and businesses 20%, and travel/transport 16%. These are shares of fraud value, not fraud rates for those merchant sectors.
The distinction is commercially important. A category with high fraud volume may simply process more legitimate payments; a meaningful risk-rate comparison needs legitimate volume or value in the same category as its denominator. We therefore present the sector data as exposure concentrations, not as a league table of the riskiest businesses.
Young Adults Report More Bank-Data Fraud—But That Is Not a Card-Only Rate
France publishes relevant surveys of who experiences banking-related scams. We include actual reported victimization, while explicitly refusing to mislabel broad bank-data fraud as confirmed card fraud.
The French Banking Federation's December 2025 survey release found that 14% of respondents ages 18–34 reported having been victims of bank-data fraud, compared with 11% overall. Its June 2025 older-adult analysis reported 9% victimization among those 60 or older. These describe a self-reported banking-data scam/fraud measure, not confirmed card-fraud financial loss or card transactions.
The surveys also distinguish attempts from successful victimization. Among people ages 18–34, 63% had been targeted by a bank-data scam attempt, versus 54% overall. Among adults aged 60 and older, 44% reported being targeted. A person who receives a phishing text should not be counted as someone whose account was successfully debited.
These age comparisons are revealing, but they cannot tell us the fraud rate per card payment. Differences in card ownership, purchase frequency, exposure to scams, survey recollection and channels of contact can influence observed proportions. The age bands also overlap the nationwide figure, which is a reference population rather than a separate category.
France does not provide in the OSMP tables a comparably detailed, nationally consistent card-only loss rate by age for 2025. A national estimate of card-fraud losses among 18–34-year-olds would therefore be speculation; we do not create one.
The Main Weakness Is Not the Card: It Is the Authorization Context
Fraudsters exploit card data, convincing messages, phone-initiated charges and recurring arrangements that are difficult to authenticate in the same way as a conventional customer-initiated checkout.
Stolen card credentials at checkout
Compromised numbers and security data are submitted through web checkout, sometimes in bursts of low-value tests before larger attempts. The legitimate cardholder never initiated the order. Account credentials, device consistency, order history and delivery changes can help separate this from genuine customer traffic.
Telephone and mail-order card acceptance
Remote payments outside an internet checkout have the highest fraud rate among the channels charted here. Some legitimate transactions require telephone or mail-order processing, but using manual entry merely to bypass authentication creates avoidable exposure.
Merchant-initiated transactions
Subscriptions, installment plans and delayed booking charges require clear customer authorization and appropriate links to the original customer-initiated transaction. The OSMP identifies recurring and deferred card arrangements as a focus of its out-of-3DS action plan, not as automatically fraudulent.
Account takeover and social engineering
A fraudster can steal a password or persuade a consumer to approve a payment or add a payment method. Strong authentication can establish the user's control of a device while not always verifying the underlying intent. This scenario overlaps broader bank-payment manipulation and should not be conflated with every card-not-present incident.
The 3-D Secure Boundary Is Where French Card-Fraud Rates Diverge
France's OSMP measures card-fraud outcomes for different authentication routes and has maintained a specific action plan for remote payments outside the 3-D Secure channel.
The OSMP statistical annex reports a 0.305% value-based fraud rate in 2025 for internet card payments made outside 3-D Secure and without strong customer authentication. The comparable figures were 0.085% for 3-D Secure payments with SCA and 0.052% for 3-D Secure transactions without SCA. These are observed payment populations, not controlled experiments proving that one authentication option mechanically changes risk by a fixed multiple.
In the separate domestic internet payment analysis, OSMP found that payments outside 3-D Secure without SCA were still about twice as fraud-prone as other channels, down from three times in 2024. Their fraud rate fell to 0.13% in 2025 from 0.18% in 2024. Domestic statistics use a narrower population than the French-issued figures illustrated at right, which is why the percentages differ.
The OSMP remote-card security recommendations cover mail/telephone orders and online payments outside 3-D Secure, including merchant-initiated transactions and certain direct-to-authorization exemptions. They recommend limiting those flows when a better-authenticated path exists, ensuring merchant-initiated transaction chaining, and addressing concentrated fraud at higher-risk acceptors.
In 2025, the domestic out-of-3DS/no-SCA flow contained a substantial merchant-initiated share: 58% of its payment value and 65% of its fraud value. That does not mean MITs alone cause 65% of all French card fraud. It identifies a specific subset of one domestic channel. The ratio makes billing design and mandate integrity commercially important.
Strong Customer Authentication under PSD2 reduces credential-only fraud, but exemptions exist, and the EBA/ECB cautions that fraudsters increasingly manipulate payers rather than solely defeat authentication technology. The joint regulators' December 2025 findings reinforce the importance of layering controls beyond a successful challenge.
Improve Fraud Controls Without Damaging Legitimate Approvals
For a merchant selling to French cardholders, a lower national fraud rate is encouraging but not an underwriting guarantee. The practical objective is to document legitimate customer intent, secure risky checkout paths and keep dispute evidence available.
Separate suspicious orders from genuine repeat shoppers
Monitor account age, device change, transaction velocity, basket anomalies and rapid shifts in shipping destinations. Use step-up authentication when risk warrants it, rather than introducing unnecessary friction for every low-risk sale.
Document the mandate and initiation chain
Make recurring terms prominent, authenticate original cardholder consent as applicable, and store scheme-compliant MIT references. Ensure fulfillment and refund documentation matches the processor's dispute requirements; use a documented chargeback-prevention process.
Reduce avoidable MOTO transactions
Prefer secure payment links or hosted checkouts where appropriate. Restrict manual card entry, control employee access to card data and never let insecure email serve as a substitute for an approved payment collection flow.
Know what the processor is actually measuring
Distinguish issuer-reported fraud, confirmed chargebacks, refund rates, authorization declines and abuse of account credentials. Provide clear sales, billing and delivery records rather than treating a lower national fraud rate as proof of low individual merchant risk.
Was the order in person, ecommerce, MOTO or merchant initiated?
Apply SCA and exemptions correctly for the transaction type.
Use device, velocity, account and fulfillment indicators.
Retain mandate, delivery, refund and issuer-response evidence.
France's record-low national card-fraud rate is a system-level result. A merchant's processing outcome still depends on its own authorization design, product mix, delivery exposure and dispute performance.
Understand the Fraud Risks Affecting Your Merchant Account
Fraud exposure and underwriting decisions depend on how your business bills, authenticates, delivers and handles disputes. DMS helps merchants evaluate those issues, organize documentation and pursue appropriate payment-processing approval. For cross-border sales into France, the relevant questions include payment initiation, issuer authentication, chargeback patterns and documentation. Merchants selling internationally can also review DMS' international merchant account guidance.