Card Fraud in Greece 2026: Online Risk, Losses and Merchant Exposure
Greek card fraud is becoming less frequent even as digital payments become routine. But a falling national rate obscures a persistent vulnerability: most fraudulent card transactions happen without the physical card, and much of the online activity crosses borders.
A growing card economy, but not a uniform fraud exposure.
Transactions are rising faster than card-payment value. The distinction between debit, credit and remote checkout matters more than the count of cards alone.
Greece's card market is no longer merely an alternative to cash. In the Bank of Greece’s May 2026 review (pp. 82–84), the full-year 2025 series records 2.76 billion payment-card transactions carrying €119.56 billion in value. The number of card transactions grew 10% compared with 2024, while the monetary value increased 6%. This means cards were used more often, even as the average value per transaction continued to fall.
Debit products drove the volume: the central bank recorded around 2.5 billion debit-card transactions and 195.5 million credit-card transactions in 2025. Debit accounted for about 93% of all transactions under the central bank's classification, which also includes certain prepaid and cash-withdrawal cards. Cards are woven into supermarket checkouts, travel purchases, services and online subscriptions, but each use case has a different risk profile.
That distinction is critical to a card-fraud briefing. Counting cards in circulation or payment transactions tells us about the size of the market; it does not tell us which customer, device or merchant session was fraudulent. National transaction fraud rates should therefore use the relevant payments denominator, not population, internet use or the number of cards issued.
The Bank of Greece's October review records 22.7 million active cards at June 2026, including 19.2 million debit and 3.5 million credit cards. H1 2026 activity reached 1.438 billion transactions worth €60.014 billion. The annual series below remains separate from these six-month totals.
Nearly 85% of card-fraud cases occurred without the card present.
The newest half-year data show substantial improvement in incident totals but persistent concentration in remote transactions.
The headline for the first half of 2026 is a measurable improvement. The Bank of Greece’s October 2026 Financial Stability Review (pp. 93–94) records 154,186 fraudulent card transactions in Table VI.1; its channel counts independently sum to the same total. That is around 23% fewer incidents than in the corresponding period in 2025. Fraudulent transaction value fell 14%, from €12.3 million to €10.6 million.
Using the exact totals, fraud represented 0.01072% by transaction count, or about one in 9,328 transactions. By value, €10,618,456 divided by €60,014,496,656 gives 0.01769%, or about €1 per €5,652. The report rounds these rates to 0.01% and 0.02%, respectively (approximately one in 9,300 and €1 per €5,700). Those ratios describe different denominators and should not be directly compared as if they were the same measure.
But incidence is heavily concentrated. The reported card-not-present category included 130,898 fraudulent transactions, versus 21,180 at physical POS terminals and 2,108 at ATMs. Therefore remote activity represented about 84.9% of the three-channel total. This is a share of fraudulent incidents, not an assertion that 84.9% of remote card purchases are fraudulent.
The difference matters to payment processors. A checkout accepting an international card does not have the same authentication context as a chip-and-PIN purchase. A retailer should evaluate its fraud-to-sales ratio for comparable types of orders, while the national chart explains where criminal effort is concentrated in aggregate.
From 410,000 cases to 363,000—and then another half-year decline.
Annual fraud incidence fell between 2023 and 2025. A newer first-half result extends the trend but uses a different observation window.
The longer view helps prevent a misleading reading of one encouraging half-year. In 2023, the Bank of Greece counted 410,345 fraudulent card transactions. The count declined to 398,723 in 2024 and then to 363,101 in 2025. During the same interval, total card transactions expanded from 2.21 billion to 2.76 billion. The resulting fraud incidence fell from 0.019% to 0.013% of transactions.
Measured in money rather than cases, the story is more restrained. The value of fraudulent card transactions was €23.77 million in 2023 and roughly €22.60 million in both 2024 and 2025. Fraud value did not decline materially in 2025, even though the number of fraudulent transactions did. Fraud value and chargeback value are separate measures. These figures establish that fewer fraudulent transactions did not produce a comparable reduction in fraud value.
The first half of 2026 therefore represents a further positive development, but it is a six-month figure. It should be compared to the first half of 2025, not divided by the full-year 2025 count without adjustment. The full October 2026 review is available in Greek and supplies the latest half-year tables. The May 2026 English review supplies the full-year 2023–2025 series.
There is also a distinction between the value of fraudulent transactions (€10.6 million in H1 2026) and financial losses ultimately allocated (€9.6 million). Reimbursements, recoveries and responsibility can change the final burden; these two figures should not be conflated.
| Measure | H1 2025 | H1 2026 |
|---|---|---|
| All card transactions | 1,325,355,638 | 1,438,297,328 |
| Fraud transactions | 199,742 | 154,186 |
| Fraud rate by count¹ | 0.01507% | 0.01072% |
| Fraud value | €12,279,471 | €10,618,456 |
| Fraud rate by value¹ | 0.02157% | 0.01769% |
| Mean fraudulent transaction¹ | €61.48 | €68.87 |
¹ Calculated from Bank of Greece Tables VI.1–VI.2. Fraud count fell 22.8% and fraud value fell 13.5%; average fraudulent transaction value rose 12.0%. These are transaction measures, not losses per victim or merchant chargeback rates.
Younger customers reported more cases; older victims lost more on average.
Greek Revolut customer findings provide age-specific fraud evidence, with limits: they describe reported cases at one provider, not national victimization rates.
Revolut findings reported by Dimokratiki in July 2024 describe fraud reported by a sample of its customers in Greece over the preceding 12 months. Gen Z (18–27) accounted for 32% of reports and Millennials (28–43) for 21%, or 53% combined. Gen X (44–59) represented 26%, and Boomers (60–78) 16%.
The reported average loss was €955 for Gen Z, €1,090 for Millennials, €970 for Gen X and more than €2,000 for Boomers. Case frequency and financial severity therefore tell different stories within this sample.
How to read the chart: 32% means the share of reported cases attributed to Gen Z. It does not mean 32% of young Greeks experienced fraud. Customer counts and payment exposure by age are missing, so the figures cannot rank an age group's individual risk. The coverage also describes fraud and scams more broadly; it does not establish a clean card-only national dataset.
The published shares add to 95%. The reporting does not explain the remaining five percentage points, so the chart preserves the figures without rescaling them. The age bands are those used in the original findings, rather than present-day generation boundaries.
These findings come from secondary reporting. The underlying microdata, sample size and precise field dates were not available for this audit.
The central-bank card-fraud tables reviewed do not supply age, sex, income or regional victimization rates. These older provider findings add useful context but cannot fill those national gaps.
Remote credentials, social engineering and cross-border checkout.
Different attacks reach the payment system through different weaknesses. Fraud prevention starts before the authorization request.
Stolen card details at an online merchant
Credentials obtained through phishing, data exposure or deceptive checkout pages can be tried at a real merchant, often across borders. The Bank of Greece reports that nearly all fraudulent card-not-present transactions in 2025 were conducted online and most involved foreign merchants.
Small attempts precede a larger loss
Attackers may test compromised payment credentials through automated authorization attempts at low-value or easily fulfilled merchants. Counts of declined attempts are not the same as confirmed fraudulent transactions, but repeated declines and tight request intervals can reveal abuse.
The false bank, courier or tax notification
Messages that imitate banks, delivery firms or public authorities direct cardholders to counterfeit sites, collecting payment details or authentication credentials. Some attacks manipulate the victim into approving an action rather than bypassing the authentication step entirely.
Lost or stolen cards at POS terminals and ATMs
Physical card compromise remains relevant, although national data show far fewer fraudulent card-present cases than remote ones. The Bank of Greece recorded a decline in lost- and stolen-card POS fraud in 2025.
Authentication reduces risk; it does not remove it.
3-D Secure, PSD2, issuer responsibility and payment-network dispute procedures intersect—but are not substitutes for each other.
Greece follows the European framework for card payments. PSD2 and the regulatory technical standards for Strong Customer Authentication (SCA) require step-up authentication in many electronic payment situations, subject to defined exemptions and exclusions. In online card acceptance, the relevant practical tool is usually EMV 3-D Secure, which allows issuers to assess transaction context and, where necessary, challenge the payer.
The ECB/EBA’s 2025 payment-fraud report provides the wider European context for authentication and fraud. SCA is a control, not proof that the purchase was honest. An impostor might control an authenticated session or trick a real cardholder into authorizing a payment. Meanwhile, certain genuinely low-risk or merchant-initiated payments may take an exempt or out-of-scope path. A low friction rate can be desirable, but it needs to be assessed alongside fraud incidence, approval rates and subsequent disputes.
The May 2026 review’s full-year 2025 findings are particularly striking: 99% of remote fraudulent transactions by count and 98% by value were online, with a substantial cross-border component. The central bank observed that most involved purchases at foreign merchants. This does not quantify a domestic-versus-cross-border fraud rate for Greek merchants. That is a concrete reason for online merchants serving Greek cardholders to examine issuer geography, 3DS behavior and fulfillment evidence.
Liability is narrower than the headline fraud number. Under PSD2, an unauthorized cardholder transaction can trigger payment-service-provider refund obligations, with exceptions and rules concerning customer fraud or gross negligence. Specific payment-network chargeback rules govern disputes between merchant, acquirer and issuer and depend on reason code, authentication, evidence and scheme conditions. A liability shift is not automatic protection for every merchant transaction. The EBA’s guidance on SCA exemptions and liability also explains that, where the payer’s PSP does not require SCA, the payer generally bears no financial loss unless acting fraudulently; allocation between payment providers remains a separate question.
| Control | Applies to | Important limitation |
|---|---|---|
| 3-D Secure / SCA | Remote checkout authentication | Not every authenticated payment is legitimate; exemptions must be managed. |
| Network tokenization | Stored credentials and digital wallets | Reduces exposed credentials; does not stop manipulated purchases. |
| Velocity and bot screening | Automated account or card testing | Overly aggressive rules may decline legitimate orders. |
| Fulfillment evidence | Dispute response and chargebacks | Evidence needs to match the relevant scheme reason code. |
| Chargeback trend review | Acquirer risk monitoring | Monitor ratios, amounts, cause and sales segments together. |
An operational playbook for cross-border card acceptance.
Use segmented fraud monitoring, sound checkout design and defensible fulfillment evidence rather than treating a national average as the business’s fraud rate.
For a merchant accepting Greek-issued cards, the useful question is not whether the Greek card system is becoming safer overall. It is whether the business's own order flow exposes it to the channels that still generate most card fraud. A subscription business, travel provider and ecommerce retailer can all have very different exposure even when they accept the same card network.
The most useful review begins with a small number of linked operational decisions. Who is paying? What is being sold? How is the order authenticated? Where and when is it fulfilled? What happens when a transaction is disputed? A retailer should not expect a fraud model calibrated for low-value physical purchases to control a cross-border, high-value online transaction.
Segment sales before you set rules
Compare domestic and cross-border card orders, ecommerce versus terminal payments, ticket sizes and recurring billing. A single blended fraud rate can hide risk concentration in one segment.
Track fraud and false declines together
Review 3DS challenge rates, issuer declines, authentication abandonment, fraudulent approvals and legitimate orders caught by screening. A lower approval rate is not automatically a safer business.
Preserve defensible transaction records
Keep transaction identifiers, order and customer communication history, delivery confirmation, usage evidence and the relevant authentication indicators. Match evidence requirements to the dispute reason.
Monitor what an underwriter will ask
Maintain accurate figures for monthly sales, refunds, chargeback rate, product type, fulfillment time and prior processor concerns. These determine how acquiring risk is evaluated.
Create an incident-response trigger
Assign responsibility for spikes in low-value card tests, compromised customer accounts and unusual order clusters. Preserve logs before evidence expires or a fraud ring changes tactics.
Know your acquiring footprint
Evaluate domestic and international transaction routes and authentication expectations. Check merchant eligibility rather than assuming every processor supports Greek-established entities.
The lesson from Greece is not that remote card payments are inherently unsafe. It is that improved national fraud rates do not remove the merchant's obligation to manage a concentrated, often cross-border fraud problem.
Put card-fraud exposure into an underwriting-ready plan.
If your business serves buyers in Greece or sells internationally, processing risk depends on sales geography, billing model, refund policy, chargebacks, fulfillment timing and current fraud controls. Durango Merchant Services can review merchant-account eligibility and help organize an application around how your business operates.
Availability for Greece-incorporated entities depends on actual acquirer and underwriting arrangements; this article does not promise a domestic Greek merchant account.