Card Fraud in Ireland 2026: Statistics, Online Payments and Merchant Risk
Ireland's card economy is growing faster than its fraud count. Yet fraudulent payment value rose sharply in 2025, concentrated overwhelmingly in remote transactions. The newest data reveal a system in which the average fraudulent card payment is getting larger even as the card-fraud rate per euro spent has edged lower.
A Card-Heavy Economy With an Increasingly Remote Spend Profile
Cards are the workhorse of everyday retail payments. But the value of online card transactions has grown far more quickly than terminal spending.
Ireland recorded 3.30 billion card payments worth €186.85 billion in 2025, according to the Central Bank of Ireland's payment statistics. Card volume increased 9.8% from 2024, while the value increased 23.0%. The statistics refer to card payments reported by Irish-resident payment service providers, not necessarily every purchase physically made on Irish soil.
The distinction between online and point-of-sale (POS) transactions is already changing the market's economics. Of electronically initiated card payments, 1.00 billion were online transactions, worth €106.73 billion; 2.26 billion were POS transactions, worth €66.93 billion. Online payments represented only 30.8% of electronic card transactions by number, but 61.5% by value. The value of online card payments rose 35.5% in one year, compared with 6.2% for electronic POS.
Domestic card payments remained the largest category by count: 2.57 billion transactions valued at €109.62 billion. However, a substantial share of card value is cross-border. For an Irish online merchant, that makes the country of the issuer, the location of the customer, the currency, and the acceptance path more important than a generic label such as “card payment.”
The opportunity for fraudsters is not that electronic payments are inherently unsafe. It is that a larger share of value now moves through remote experiences where merchants must decide whether the cardholder, device, account and delivery instructions belong together. For a wider picture of Irish transfer fraud and scam losses, see our Payments Fraud in Ireland country briefing; this report concentrates on cards rather than bank transfers or authorised push-payment scams.
The Number of Incidents Grew Modestly. Fraudulent Value Grew Faster.
Card fraud increased by value in 2025, even though reported card fraud remained a small proportion of legitimate card spending.
The Central Bank's September 2026 fraud release recorded €51.01 million in fraudulent card payments during 2025, an 18.6% annual increase. The number of fraudulent card payments reached approximately 429,000, up 2.8% from 417,230 in 2024. In other words, the growth in fraudulent value substantially outpaced the growth in cases.
Its reported average fraudulent card payment rose to €119 in 2025, compared with approximately €100 in the prior year's data. That is an average of fraudulent payments, not an average consumer's net financial loss, merchant chargeback, or fraud-attempt value. The regulator's revised 2024 comparison, implied by its 18.6% increase, is approximately €43 million; older editions may display earlier reported totals, so year-on-year comparisons should use the same statistical vintage.
The measured fraud rate tells a different but compatible story. Fraudulent card value represented 0.027% of card payment value in 2025, the lowest level recorded since the regulator began this series in 2022. The rate fell despite increasing gross fraud because legitimate card spending grew even faster. Low system-wide incidence should not be mistaken for equally low risk at every merchant, sector or checkout channel.
There is also a distinction between the annual value of identified fraudulent card payments and the amount ultimately borne by customers, financial institutions, or other parties. Later in this report we separate those figures rather than count the full €51.01 million as merchant losses.
Online Transactions Concentrate Card-Fraud Value
Electronic commerce now holds a disproportionate share of both legitimate card spending and reported fraudulent value.
Online payments represented 89% of Ireland's reported fraudulent card-payment value in 2025, according to the Central Bank of Ireland. At approximately €45.4 million, that left roughly €5.6 million associated with the physical terminal segment. The online figure is about €45.4 million because it is calculated from the published rounded 89% share; it should not be treated as a separately audited total.
For context, the regulator reported €106.73 billion in online card payments within a total €186.85 billion of card payments—a share of approximately 57% of overall card-payment value. The two published sources use different reporting subcategories, so the comparison is a descriptive contrast of spending concentration and fraud concentration, not a newly certified channel fraud-rate calculation.
The geography of card fraud is similarly revealing. €22.41 million—43.9% of reported card-fraud value—related to cross-border transactions outside the European Economic Area. Cross-border fraud is not necessarily fraud committed by foreign merchants; the regulator classifies destination-account geography, and legitimate international commerce has an entirely different denominator. Nevertheless, the concentration merits separate monitoring of settlement geography, issuer markets and delivery regions.
At physical EFTPOS terminals, the regulator identified 57,560 fraudulent transactions worth €5.61 million. Contactless payments accounted for €4.22 million of that value, and NFC mobile-wallet payments for approximately €4.0 million within contactless fraud. High representation among fraudulent contactless terminal transactions is not proof that wallets have a higher underlying fraud rate: the Central Bank reports that the mobile-wallet fraud rate by transaction volume fell from 0.005% in 2022 to 0.002% in 2025.
The risk-management lesson is therefore channel-specific. Ecommerce merchants need remote transaction authentication and behavioral screening; shops using card terminals need device, employee and wallet-provisioning awareness. Treating the two environments as one exposure obscures both.
Card Fraud Is the Most Common Fraud Type Reported by Irish Survey Victims
Ireland provides direct card-specific victimisation evidence. Its published age breakdown, however, measures broader fraud, not card fraud alone.
The Central Statistics Office's September 2026 Crime and Victimisation 2025 survey found that 11% of adults reported experiencing fraud—including attempted incidents—in the previous 12 months, compared with 4% in the 2019 survey. Among those reporting fraud, 45% identified card-payment fraud, making it the largest named fraud category. Phone fraud and online shopping or auction fraud were each reported by 26% of fraud victims; respondents could report more than one type.
The survey also publishes a strong age pattern for all fraud types combined: 14% of people aged 30–44 reported fraud, followed by 12% of those aged 45–59, 9% of adults aged 18–29, and 7% of those aged 60 and over. These age percentages should not be labeled card-fraud victimisation rates; the underlying published age table is not broken down by card-fraud subtype.
Independent Central Bank research released in April 2026 found that 35% of Irish adults had experienced fraud or scams over its survey's broader reference scope, and 38% of victims had never reported their experience to a financial provider or public authority. Its multivariate work identified risky online behaviours as a stronger predictor of fraud experience than age, income or education. That supports prevention based on actions and account signals rather than demographic stereotypes.
Regulator payment records count fraudulent transactions detected by financial providers. Household surveys capture reported personal experiences, including attempts and crimes that may not reach payment reporting systems. They are complementary sources, not datasets that should be added or divided to calculate a national card-fraud incidence rate.
Card-specific victimisation and age-specific victimisation exist in the same survey, but not as a published card-fraud-by-age cross-tabulation. Presenting the broader age findings honestly is more useful than inventing one.
Four Paths From Compromised Identity to an Unauthorised Purchase
The merchant sees a payment request; the fraud may have begun much earlier, at credential collection, account recovery or wallet provisioning.
Stolen card credentials and ecommerce testing
Compromised PAN, expiry and account data can be tested through small online purchases before higher-value transactions follow. A fraudster may exploit weak rate limits, repeated declines or a merchant that permits too many card-data entry attempts.
A legitimate account, but an illegitimate operator
Credential stuffing, phishing and stolen session tokens can let an attacker reuse a saved payment instrument and customer history. Authentication at card level does not automatically prove that a changed email, delivery address or device belongs to the genuine shopper.
Wallet provisioning and device-based impersonation
A criminal can seek to add stolen card details to a wallet or exploit stolen devices and identity evidence. The Irish regulator's terminal statistics measure fraudulent NFC wallet payments; they do not establish the mechanism of each case or imply mobile wallets are inherently less secure.
Social engineering around genuine businesses
False payment pages, impersonated support agents and fake delivery updates can collect credentials and authentication approvals. These attacks may lead to unauthorised card transactions or to bank transfers, which are reported in a different statistical category.
The card-fraud problem spans the customer session, the payment credential, issuer authentication, and the final fulfillment decision. No single checkout signal is a complete identity test.
Strong Authentication Matters—but Fraud Value Is Not the Same as Loss Liability
Ireland's published statistics measure both fraudulent payments and allocated financial losses. Keeping them separate reveals a more accurate account of who absorbs card fraud.
Strong Customer Authentication under PSD2 remains a central defence for electronic card payments. Of the electronically initiated card-fraud value covered by the Central Bank's SCA breakdown, 37.7% was associated with SCA-authenticated payments in 2025, down from 43.5% in 2024. The relevant reported value was €17.6 million. This percentage has a narrower electronic-fraud denominator than the €51.01 million total card-fraud figure and must not be applied indiscriminately to all card fraud.
The regulator also reports that the fraud rate by transaction count for SCA-authenticated card payments fell from 0.01% in 2022 to 0.005% in 2025. A fraud event can still occur following authentication, especially where the legitimate payer is manipulated or an attacker already controls the account context. The ECB/EBA's December 2025 report concludes that SCA is effective against the threats it was designed to prevent, while criminals continue to adapt.
Separately, of the card-related losses that the Central Bank explicitly allocated by bearer, payment service providers bore €14.23 million, or 63.2%, in 2025. That implies roughly €22.52 million in that card-loss allocation table, far below the €51.01 million of identified fraudulent card payments. The remaining 36.8% of allocated card losses fell to other reporting categories. Neither figure establishes a national total for merchant chargebacks or merchant-paid card fraud.
Under Ireland's 2018 Payment Services Regulations, liability for unauthorised transactions depends on the circumstances, including the use of SCA and whether a payer acted fraudulently or with gross negligence. The law also contains rules on payee or payee-PSP refusal to accept SCA. The Competition and Consumer Protection Commission explains the distinct card-scheme chargeback route for disputed or undelivered transactions.
For merchants, DMS's 3-D Secure guidance and 3-D Secure 2 can improve issuer risk assessment and may provide fraud-related liability protection when the applicable rules are satisfied, but liability treatment is scheme- and circumstance-dependent. A properly authenticated transaction can still generate a dispute for non-delivery, cancellation or service quality. Meanwhile, Verification of Payee for SEPA transfers is not a card-payment control and should not be presented as one.
Manage Remote-Card Risk Without Rejecting Good Customers
The business objective is not zero fraud at any cost. It is defensible transaction acceptance, predictable dispute handling and enough evidence to distinguish a genuinely unauthorised order from a legitimate purchase.
Match authentication to risk
Use scheme-appropriate 3-D Secure, transaction monitoring and issuer responses; pay attention to device changes, risky first-time orders, issuer country and mismatched delivery details. Avoid mandatory friction on every low-risk repeat purchase.
Identify small authorisation probes
Flag unusual declines, rapid retries and repeated payment attempts across accounts or IPs. Apply velocity and bot controls without collecting unnecessary sensitive card data. Maintain a clear customer support path for false declines.
Verify the acceptance environment
Use supported and updated POS equipment, implement terminal access controls and review wallet-related anomalies. A higher share of wallet transactions within terminal fraud is not evidence of a higher wallet fraud rate.
Underwrite the actual customer mix
Break down international fraud and legitimate volume by issuer region, channel, product type and fulfillment destination. A headline 43.9% outside-EEA share is context, not a defensible merchant-level risk estimate on its own. DMS also outlines international merchant-account considerations for cross-border acceptance.
Preserve evidence at the order level
Record the payment and authentication reference, customer communications, delivery status, refund history and recurring billing consent where relevant. Respond to card disputes using the applicable scheme's evidence requirements. See DMS's chargeback-prevention guidance for the evidence workflow.
Explain processing risk concretely
Provide sales volume, billing terms, fulfillment windows, refund trends, fraud and chargeback counts, and prior processor treatment. Underwriters assess a merchant's own track record rather than applying the national card-fraud rate as a guarantee.
Device, account and order changes.
Appropriate issuer and scheme checks.
Address and product anomalies.
Retain transaction and service records.
Ireland's value-based card-fraud rate is low, but the remote channel carries the great majority of identified card fraud. A merchant should measure its own fraud, declines and disputes by channel—not treat national averages as its risk model.
Make Your Card-Processing Risk Easier to Underwrite
For merchants with cross-border customers, the right processing setup depends on sales model, billing method, authentication approach, fulfillment exposure and dispute record. Durango Merchant Services helps merchants evaluate these issues, prepare documentation and pursue payment-processing approval. For Ireland-specific options, see the DMS Ireland merchant-services page; eligibility and provider capabilities should be confirmed for each applicant.