Card Fraud in Spain 2026: Statistics, Authentication and Merchant Risk
Spanish card payments have become an everyday utility. The latest supervisory series shows a narrower gap between card-fraud rates with and without Strong Customer Authentication (SCA); it does not by itself establish why the rates changed. Merchant exposure still turns on stolen details, deceptive checkout journeys and authentication exceptions.
A card-first checkout market with distinct payment risks
Spain uses cards for most everyday noncash transactions, but fraud must be assessed per comparable card transaction, not per inhabitant.
Spain's payments revolution is easy to mistake for a fraud story. By the second half of 2025, cards accounted for 65.9% of the number of noncash transactions reported by payment-service providers, according to Banco de España’s H2 2025 payment statistics. The country's stock of payment cards reached 126 million, or approximately 2.5 per inhabitant. The mean card transaction was €32.10. These figures describe payment activity, not how many card purchases were fraudulent.
Cards dominate everyday low-ticket commerce. Transfers, meanwhile, handle much larger amounts per operation. That asymmetry makes a single nationwide “payment-fraud rate” a poor guide for merchants: the average value, authorization pattern, reversal mechanism and fraud controls of an ecommerce card order differ fundamentally from those of a bank transfer.
A useful distinction for retailers, travel businesses and subscription sellers is between cards issued to Spanish customers, cards accepted by Spanish merchants and transactions reported by Spanish payment-service providers. Those populations overlap but are not identical. Cross-border commerce makes them more complicated still.
Spain's longstanding card infrastructure—banks, domestic acquiring technology and international schemes—has also enabled contactless checkout and ecommerce expansion. Yet the best evidence about fraud requires a separate denominator: fraudulent card transactions divided by all card transactions in the same reporting group and time period.
The right question is not how many cards Spain has issued. It is which transaction paths let a fraudster use a card successfully, and at what cost to the merchant.
The gap between authenticated and non-authenticated fraud has narrowed
The Banco de España series shows small but meaningful differences in card-fraud incidence by authentication pathway.
Banco de España’s 2025 Supervisory Report, released on 28 April 2026, presents the country's most recent card-fraud-rate series in the material reviewed for this briefing. Its chart ends in June 2025. The important development is a narrowing of the gap between card transactions recorded with and without Strong Customer Authentication (SCA).
In June 2022 the reported fraud incidence, measured as a percentage of card-payment counts, was roughly 0.036% without SCA and 0.010% with SCA. By June 2025, the corresponding values were approximately 0.021% and 0.0175%. These are small fractions of reported card transactions, but at national payment volumes even small rates matter.
The divergence does not mean that SCA has become ineffective. The two groups are not randomized, transaction risk differs, and exemptions change their composition. In particular, an authenticated payment can still involve deception or a compromised account; a non-SCA payment can be legitimate and appropriately exempt. The ECB/EBA's broader analysis finds that strong authentication remains effective against traditional card fraud, even as attackers adapt.
The central bank also reports a decline in the absolute and relative number of fraudulent card operations compared with 2024. Because the source does not publish a complete 2025 annual card-loss value alongside this chart, this article does not invent an annual Spain-specific euro loss total.
Three years of card fraud data point to a changing attack mix
National supervisory trends need a consistent denominator and a careful distinction between counts and euros.
The longer sequence helps explain why the 2025 result deserves caution. From mid-2022 to mid-2025, the reported non-SCA fraud rate declined from about 36 to 21 per 100,000 card transactions. The SCA series moved in the opposite direction, from about 10 to 17.5 per 100,000. Taken together, the pattern is one of convergence, not a simple victory narrative.
Both series are aggregated across the transactions assigned to each authentication pathway. Changes in the share of ecommerce orders, risk-based exemptions, customer-initiated versus merchant-initiated payments, cross-border acquiring and fraud attempts can affect the comparison. Merchants should not use these national averages to decide whether a particular checkout requires step-up authentication.
Another critical distinction is that these figures represent rates based on payment counts, not fraudulent euros per euro of legitimate card payments. A burst of low-value card testing can increase incident counts while leaving overall loss value relatively unchanged. Conversely, a handful of high-ticket fraudulent purchases can raise losses without moving the transaction count very much.
Banco de España’s graphical breakdown of card-fraud causes shows that theft of card details and subsequent orders placed by the fraudster remains the dominant operational category, followed by lost or stolen physical cards, with counterfeiting less prominent. The report includes a graphic with category bars; rather than manufacture exact values from the image, we retain its qualitative ranking.
The headline of 2025 is not “fraud disappeared.” It is that the mix of fraudulent card transactions changed as card usage expanded and authentication became more deeply embedded in checkout.
The best available age evidence is broader than card fraud
Police reporting tells us something about victims, but not a directly comparable bank-card fraud rate for each age bracket.
Spain offers useful evidence about who reports fraud, but the figures cannot be treated as an age-by-age card transaction fraud rate. The Interior Ministry’s 2025 Cybercrime Report, published in July 2026, recorded 383,285 cybercrime victims. Its most frequently represented age band was 51–65 years. This is an observation about the entire police-reported cybercrime-victim population, not the age pattern of fraudulent card transactions.
The same report says 52% of cybercrime victims were men and identifies 146,737 people affected by a combined category involving fraud related to credit cards, debit cards and traveller's cheques. Those reports capture a different phenomenon from payment-service-provider fraud counts: they refer to criminal complaints and victims, not necessarily unique card transactions, settled card losses or recognized chargebacks.
That matters for interpreting risk. People using cards more frequently may have greater opportunity for exposure, but card adoption by age does not establish victimization rates. Likewise, a police complaint may involve a social-engineering episode, misuse of credentials or multiple fraudulent transactions. A person and a transaction are not interchangeable units.
For merchants, age is also a poor substitute for evidence about the order itself. A blanket rule that challenges customers above or below a specific age can penalize legitimate buyers and produce discriminatory friction. Better fraud signals include unusual device changes, velocity, behavioral inconsistencies, address discrepancies, delivery modifications and mismatch between an account's history and its current activity.
A credible human layer reports the population that was actually measured. It does not substitute internet usage, card ownership or all-cybercrime victim counts for card-fraud incidence by age.
A stolen credential is not the same risk as a lost card
Payment authentication, account control and fulfillment evidence matter at different stages of the transaction.
Stolen card data at remote checkout
Phishing, data breaches and compromised merchant accounts can give criminals the information needed to attempt remote purchases. Strong authentication raises the difficulty, but merchant exemptions and account compromise change the threat surface.
Physical cards and contactless misuse
The loss of a payment card can expose the issuer and merchant to unauthorized transactions before it is blocked. PIN, device-based authentication, contactless limits and issuer risk systems operate differently from ecommerce controls.
Authenticated does not always mean intended
An attacker may take over an ecommerce account, switch its device or shipping address and successfully pass a checkout step. Authentication events establish specific facts, not whether fulfillment details have been manipulated.
Disputes that do not begin with stolen cards
Some chargebacks concern subscriptions, delivery timing or a customer who does not recognize a merchant descriptor. These disputes matter operationally but should not automatically be counted as criminal card fraud. For practical recordkeeping and dispute-response steps, see DMS’s chargeback-prevention guide.
Card-number compromise, stolen plastic and disputed purchases generate different evidence. Treating them as one undifferentiated “fraud” category weakens both prevention and dispute defense.
Strong authentication works—yet it is not an all-purpose guarantee
PSD2, Strong Customer Authentication, consumer protections and card-scheme disputes address different responsibilities.
Spain applies the EU’s PSD2 framework for payment services and Strong Customer Authentication. In remote card commerce, EMV 3-D Secure is a common channel through which issuers can authenticate customers. The relevant exemptions, including low-value and risk-analysis paths, have conditions; merchants should not conflate exempted with unprotected. For a merchant-focused explanation, see DMS’s guide to 3-D Secure 2.0.
The 2025 ECB/EBA review found that SCA remains effective against traditional card-fraud patterns across the European Economic Area. It also warned that manipulation of payers increasingly defeats the assumption that authentication alone identifies a legitimate economic decision. That distinction aligns with Spain's national trend, although the European statistics do not directly substitute for Spain's population or its 2025 series.
Cardholder law is another distinct layer. Banco de España explains that for a lost or stolen card, a customer may in relevant circumstances bear up to €50 of unauthorized charges before notifying the issuer; after notification the customer generally should not carry those losses, subject to exceptions such as fraud or gross negligence. The regulator also describes the issuer's obligation to restore unauthorized payment amounts, generally by the end of the next business day following notice, subject to applicable exceptions.
That is consumer-versus-issuer liability. It is not a national statistic for what Spanish merchants pay in chargebacks. Merchant liability depends on scheme rules, transaction facts, acceptance channel, authentication result, reason code, evidence and the acquiring arrangement. An issuer reimbursement is not automatically a merchant debit.
Match each control to the fraud that can actually occur
A merchant taking Spanish cards should assess credentials, authentication, fulfillment, cross-border exposure and dispute operations together.
Separate transaction fraud from service disputes
Tag each dispute by fraud reason, product/service issue, timing, transaction channel and evidence completeness. A single chargeback count does not tell the whole underwriting story.
Use risk-sensitive step-up checks
Determine when SCA is required, when an exemption is valid, and when an unusual order merits additional review. Preserve authentication metadata in the gateway and order record.
Close the gap between authorization and delivery
For tickets, travel, digital services and advance delivery, preserve customer instructions, timestamped notices, proof of consumption and changes to beneficiary or recipient.
Measure fraud per sale cohort
Track confirmed fraud by count and by euros, false declines, refund speed, fraud-alert response, dispute reason and merchant category. Use the same denominator in each trend.
Make underwriting evidence easy to inspect
Prepare monthly processing volume, average ticket, largest ticket, geographic mix, cancellation terms, processing history, chargeback ratios and remediation steps. DMS’s high-risk merchant account page explains the account review and application context.
Validate cross-border acceptance rules
For merchants selling to Spanish customers from abroad, confirm SCA obligations, acquirer location, scheme treatment, local-language disclosures and fulfillment support before launch. See DMS’s international merchant account page for related cross-border processing information.
An effective card-fraud program is not a single approval screen. It is a chain of decisions—from account opening and customer authentication through fulfillment, evidence retention and dispute resolution.
Build a more defensible card-processing profile.
If your business accepts cards from customers in Spain—or operates internationally—its payment-processing risks depend on billing, fulfillment, chargebacks, ticket size, sales geography and the documentation supporting each order. Durango Merchant Services can review merchant-account eligibility and help prepare the details needed for an underwriting conversation.
Availability for Spanish-incorporated businesses is subject to the actual acquiring and underwriting arrangements; this article does not promise a domestic Spanish merchant account.