Card Fraud in Italy 2026: Statistics, Ecommerce Risk and Merchant Losses
Italy's most recent card-fraud data reveal two contrasting realities: fraudulent transactions remain rare across the payment system, yet an online card purchase carries ten times the fraud rate of a physical terminal payment by value. A decade-long central-bank study adds another layer: consumers encounter more potential exposure because they use cards far more often.
More Card Payments Create More Opportunities—Even When the Fraud Rate Is Low
The relevant denominator is a market that has shifted from occasional card use toward habitual electronic checkout. A larger number of transactions increases opportunities for abuse without proving that any individual transaction has become more dangerous.
Bank of Italy research published in December 2025 traces the domestic payment-card market from 2015 through 2024. The ten-year analysis finds that cards rose from approximately 55% to 70% of noncash payment transaction counts in its statistical perimeter. Their share of payment value stayed much smaller because high-value transfers dominate the euro denominator. That contrast matters: a card's popularity by count does not mean it carries most euro-denominated financial risk.
Physical-point-of-sale transactions grew from roughly 2.5 billion in 2015 to 9 billion in 2024, while online card transactions expanded from about 300 million to 1.6 billion. Contactless terminals, wider acceptance and ecommerce growth changed exposure as profoundly as any new fraud technique. The same research documents that annual payment-and-withdrawal operations with cards grew from roughly 4 billion to just under 12 billion.
In the second half of 2025, debit and credit cards accounted for about 65% of payments by transaction count among the instruments in the Bank of Italy's reporting. This narrower half-year perimeter should not be read as a contradiction of the separate historical research. The present article isolates debit and credit cards where possible, and reports prepaid cards as electronic money when the central bank does so.
That last distinction is not pedantry. An Italian merchant selling fashion online may accept Visa or Mastercard credit and debit cards and also an electronically issued prepaid product. For regulatory reporting, the second product may fall into a different statistical category even when the consumer experiences both as a plastic or virtual card.
Nearly Half a Million Fraudulent Card Transactions in Six Months
Italy's latest observed period is the second half of 2025, reported by Banca d'Italia in July 2026. This is a completed half-year observation—not an estimate of all calendar-year 2026 activity.
The central bank's H2 2025 report identifies 457,500 fraudulent debit and credit card-payment transactions with a combined value of approximately €36.5 million. The mean fraudulent transaction was about €80. Neither the €36.5 million nor the count should be described as merchant-only chargeback losses: reported fraudulent payment value and who ultimately bears the financial cost are different measures.
The value-based card-fraud rate declined to 0.017% in H2 2025, from a revised 0.019% in H1. The count-based rate was 0.009%, down from 0.011%. Those rates answer different questions: 0.017% describes the fraction of money in the reported card-payment stream that was fraudulent; 0.009% describes the fraction of payments, equivalent to nine fraudulent transactions per 100,000 card transactions.
Separately, the report puts electronic-money fraud, largely associated with prepaid cards, at 0.024% of payment value, compared with 0.010% for ATM withdrawals. Those instruments have their own bases and cannot be summed into a fictional combined card-fraud rate. The previous 2025 first-half publication contained some figures since revised in the July report; for like-for-like comparisons, this article uses the later published rates.
Italy therefore presents a useful counterweight to headlines about fraud “exploding.” Legitimate payments, fraud counts, the average fraudulent purchase and recovered losses can move in different directions. A merchant should calculate its own confirmed fraud per transaction, fraud value per processed euro, and chargeback ratio rather than using one aggregate national statistic as a substitute.
Online Card Fraud Was Ten Times Higher by Payment Value
The greatest separation in Italy's card-fraud figures is not between debit and credit cards but between how the payment is initiated. Remote payments carry far more fraud per euro than transactions at a physical terminal.
In the H2 2025 Banca d'Italia report, fraudulent card payments accounted for 0.060% of ecommerce card-payment value, versus 0.006% at physical POS terminals. In practical terms, that is €60 and €6 of fraud per €100,000 respectively. The tenfold ratio uses two comparable card-value fraud rates for the same reporting period, not fraud share divided by payment share.
The distinction persists when counting transactions rather than euros: 0.047% of online card transactions were fraudulent compared with 0.003% of POS transactions. A small web purchase is not necessarily fraudulent, but the aggregate card-not-present environment presents more opportunity for stolen credentials, automated account testing, and payments initiated from devices not controlled by the legitimate cardholder.
There is also encouraging evidence. The latest central-bank series shows ecommerce's value-based fraud rate declining from 0.074% in H1 2025 to 0.060% in H2, while the POS rate remained at 0.006%. These are successive half-year snapshots, not a seasonally adjusted annual trend, so we cannot attribute the decline to any one control or regulatory change.
For merchants, the response should be differentiated. Point-of-sale security centers on terminal integrity, cardholder verification, tap-to-pay handling, and refund controls. Ecommerce requires dynamic order screening, device signals, authenticated checkout, velocity monitoring, and a defensible record of fulfillment. A blanket challenge on every order creates an avoidable cost in declined legitimate sales.
Greater Card Use Raises Exposure—But Age-Specific Rates Remain Unverified
The Italian central bank provides unusually useful longitudinal evidence about potential exposure per adult and per card. It does not, in the cited research, establish a comparable 2025 card-fraud victimization rate for each age group.
A December 2025 Bank of Italy paper documents that the ratio of fraudulent card transactions to the population aged 15 and older rose from 0.9% in 2015 to 2.9% in 2024. That ratio is not the measured percentage of unique adults victimized: some people can experience multiple fraudulent transactions, and the denominator includes people without cards. It is an exposure indicator calculated by dividing incidents by the age-15-plus population.
The study reports two other ratios with different denominators. Fraudulent card transactions per card in circulation increased from 0.5% to 1.2%, while transactions per bank-account holder increased from 0.7% to 2.0%. These are analytically different from age-specific prevalence. A direct comparison of young and older cardholders would require victim-level data with clearly specified age cohorts, which the national 2025 card-fraud report does not supply.
Why did the exposure indicator rise? Much of the answer is ordinary payment behavior. The study finds that the average number of card payments per card rose from about 39 to 98 between 2015 and 2024. It attributes approximately 89% of the increase in the fraud-incidents-per-card indicator to greater usage frequency, with the remainder associated with the change in transaction-level fraud rates. This decomposition is an author's accounting analysis, not a causal experiment proving that higher frequency caused individual fraud events.
For context only, the CRIF 2025 credit-fraud observatory, published in August 2026, reports that under-30s were its largest age group—more than one in five cases—with reported cases in that band up 13.8% in 2025. This is a separate identity-based consumer-credit dataset, not a national sample of unauthorized card payments, so it cannot supply a card-fraud rate by age.
From a merchant perspective, demographic assumptions are especially hazardous. Fraud-risk rules that depend on perceived age can add friction to legitimate shoppers and create proxy discrimination. The useful controls concern transaction behavior—abnormal repeat attempts, device changes, delivery mismatches, and high-risk checkout patterns—rather than unsupported claims about who is most likely to commit or suffer card fraud.
The Border Matters Almost as Much as the Checkout Channel
Fraudulent card transactions are much more internationally concentrated than legitimate card spending. That exposure reflects where payments are routed and accepted; it is not a verdict about customers from particular countries.
The Italian central bank's H2 2025 data show that 64% of card-fraud value was associated with cross-border transactions, compared with only about 20% of ordinary card-payment value. By count, cross-border transactions represented 71% of card-fraud incidents but approximately 18% of card-payment transactions. The latter payment shares are rounded from the report's geographic composition charts; fraud shares are reported in the explanatory text.
The concentration is most striking for transactions outside the European Economic Area (EEA). The report observes that such transactions form only a small fraction of card and electronic-money payments, yet account for a substantially larger share of their fraudulent transactions. The geographical classification follows the payment service provider of the payee and, for in-person transactions, the point-of-sale location—not simply the shopper's declared address or citizenship.
Five mechanisms deserve particular attention. Stolen card credentials enable remote purchases without possession of the card; account takeover can pair legitimate credentials with a new device; automated card testing creates clusters of small authorizations and declines; social engineering can persuade a genuine customer to approve a transaction; and refund and chargeback abuse can exploit weak evidence or inconsistent fulfillment policies. These are operational risk patterns, not a claim that the central bank quantified each category separately.
For a merchant selling internationally, the appropriate denominator is its own authorized and settled card volume by issuer country, acquiring route, product, and channel. A high national cross-border share of fraud does not mean a given customer is fraudulent or that cross-border sales should be switched off. Screening should distinguish higher-risk orders from healthy international demand.
Strong Authentication Reduces Risk. It Does Not Resolve Every Dispute.
Italy's PSD2 framework and the European card networks separate fraud prevention, statutory reimbursement rights, and contractual chargeback rules. None of those systems creates a universal promise that an authenticated card sale is risk-free.
Bank of Italy reports that transactions made using Strong Customer Authentication (SCA) exhibit substantially lower fraud rates than transactions outside SCA and its risk-based exemption framework, particularly on cross-border flows. Its 2025 findings are consistent with the December 2025 EBA/ECB payment-fraud review, which documented the protective effect of SCA across European card payments. Authentication verifies that the payer can demonstrate possession, knowledge or inherence factors; it does not prove goods will be delivered or that a seller's recurring billing is fair.
There are legitimate exceptions. Italy's central-bank consumer guidance explains that low-value contactless and online payments can qualify for SCA exemptions under specified cumulative and consecutive-payment conditions, and that risk-based and certain recurring payments can follow different paths. These are permission thresholds, not guaranteed frictionless checkouts: an issuer or payment service provider can still request a challenge. The rules must be applied to the actual transaction and authentication context.
Consumer reimbursement rules are distinct from card-scheme dispute protections. The Bank of Italy's consumer-rights guidance describes the qualified €50 exposure that can apply to certain unauthorized card transactions before the issuer is notified. Its e-commerce payments guide provides consumer-protection context. These rules do not set a merchant's chargeback cost; liability can depend on SCA, negligence, dispute reason, issuer/acquirer handling and other transaction facts.
In the H2 2025 report, the central bank reported that customers bore approximately 40% of reported card-fraud losses in its loss-allocation reporting. The remaining 60% is not a synonym for “merchants.” Other loss bearers include payment service providers under the report's classification; it does not provide a merchant-specific national chargeback total. Likewise, gross card-fraud value of €36.5 million is not identical to realized customer loss.
For a merchant, 3-D Secure can strengthen cardholder authentication and may shift specified fraud-related liability under applicable network rules. It is not a blanket defense against consumer disputes alleging non-delivery, defective products, cancellation or misrepresentation. Maintaining order-to-delivery documentation remains essential even when authentication succeeds.
Design Fraud Controls Around the Transaction, Not the National Average
For businesses accepting Italian cards—or processing cross-border sales into Italy—the goal is to reduce confirmed fraud and disputes without blocking legitimate orders. That requires differentiating the risk of an online purchase, a face-to-face payment and a recurring charge.
Authenticate where the signal justifies it
Use issuer-supported 3-D Secure, transaction-risk analysis and fraud scoring suited to order size, card history, device changes and delivery destination. Track challenge abandonment and false declines alongside blocked fraud.
Stop rapid, low-value probes
Apply authorization velocity limits, bot protection and anomaly alerts to repeated retries and small charges. Log the attempted authorization pattern without storing sensitive card credentials.
Protect terminal operations
Keep POS devices updated, restrict staff permissions, log manual overrides and reconcile refunds. Use the correct EMV/contactless workflow rather than ad hoc entry that weakens evidence.
Measure foreign orders on their own terms
Compare fraud by issuer region, legitimate transaction count, average ticket and fulfillment corridor. Geo-blocking based only on a country label discards valid demand and ignores device- and account-level context. DMS also outlines international merchant account considerations for cross-border acceptance.
Preserve consent and cancellation evidence
Record initial authentication, subscription terms, renewal notices and cancellation requests. A legitimate recurring-payment exemption is not proof that later customer disputes will be rejected.
Explain actual operating risk
Prepare monthly card volume, refund and chargeback percentages, fulfillment periods, product categories and prior processor treatment. Underwriting is based on a merchant's own exposure, not on Italy's 0.017% national rate. See DMS’s high-risk merchant account overview for related underwriting and application details.
Card and device signals, location and order history.
Use SCA and scheme rules appropriately.
Shipping, service delivery and customer contact.
Preserve response timelines and supporting records.
Italy's card-fraud rate is low in the aggregate, but an online merchant still faces roughly ten times the physical POS fraud rate per euro transacted. A useful merchant fraud program begins with channel-specific data, not a reassuring national average.
Present a Clearer Card-Processing Risk Profile
Merchant approval depends on sales volume, billing terms, products, fulfillment windows, refund practices and documented chargeback experience. Durango Merchant Services helps businesses assess underwriting concerns, assemble application information and pursue payment-processing approval. Support for an Italy-based entity or particular cross-border configuration must be confirmed for that merchant and provider.