Card Fraud in the Netherlands 2026: Online Attacks, Debit Cards and Merchant Risk
The Dutch payment market is almost frictionless at the physical checkout. Yet the country's newest fraud statistics show an uncomfortable reversal: fraudulent card transactions are climbing, and the increase is concentrated online. The risk is no longer defined by whether a customer carries a piece of plastic.
Contactless is the Dutch default. Online cards remain the minority.
Understanding Dutch card fraud starts with separating the two checkouts. A debit card at a supermarket and a card credential used on a distant website travel through different risk environments.
The Dutch Payments Association's March 2026 figures show that Dutch cardholders made 5.83 billion debit payments at domestic points of sale in 2025, worth €150 billion. More than 95% of those transactions were contactless. Paying with a phone or watch is no longer a niche behaviour; the digital wallet accounts for almost half of all debit transactions at Dutch tills.
But online shopping has a different infrastructure. The association reports that iDEAL accounted for 71% of Dutch online purchases in 2025, while credit cards represented 8%. Card-not-present risk must therefore be understood alongside bank-account-based ecommerce, not substituted for it. These percentages are purchase-method shares, not fraud rates.
Another structural change is under way. Dutch banks have been replacing legacy Maestro and V PAY cards with Visa Debit and Debit Mastercard. The newer products support broader international acceptance and online card use. This does not prove an increase in fraud; it means businesses must keep card-brand acceptance, authentication rules, and transaction monitoring current.
Cards generated roughly four in five fraudulent transactions.
The most revealing comparison is between how often a fraudulent payment occurs and how much money is involved. The difference helps explain why effective card controls must be optimized for repeated attacks, not just unusually large purchases.
On 30 June 2026, De Nederlandsche Bank (DNB) introduced a twice-yearly public fraud series. It counted approximately 658,000 fraudulent transactions across card payments, European bank transfers, and ATM withdrawals in 2025. Of these, 514,000 were fraudulent card payments, or about 78%. Card fraud was the largest category by incident count.
Its share of fraud value was much smaller. The recorded value of fraudulent card payments was €41 million, against roughly €148 million for transfers and €10 million for cash withdrawals. The reported aggregate was approximately €198 million. The difference between summed category values and the headline total reflects rounding.
From those rounded source figures, the mean fraudulent card payment works out to approximately €80. That is an arithmetic average, not a typical victim loss or a chargeback. Fraudsters can make hundreds of small attempts without producing a single six-figure incident, while one manipulated bank transfer may be much more expensive.
The DNB reporting covers specified instruments and about two-thirds of the broader payments market. It excludes some payment methods. The rate of seven fraudulent transactions per 100,000 payments applies to DNB's combined covered categories; it is not a standalone card-fraud rate.
The pressure is shifting toward remote card credentials.
Physical card fraud has not disappeared. But the central bank identifies online transactions—especially purchases made abroad with stolen card data—as the main source of the recent increase in fraudulent card payments.
The value of card payments classified as fraudulent rose from approximately €36 million in 2024 to €41 million in 2025, an increase of roughly 14%. Fraudulent transaction counts rose by more than a quarter. The divergence indicates that counts grew faster than value, although DNB's headline release does not provide the exact 2024 count needed to compute an exact change in mean transaction value.
In an ordinary Dutch shop, EMV chip technology, contactless protocols, and authentication make simple card cloning considerably harder than in the old magnetic-stripe era. Online, a criminal may not need the card at all: stolen credentials, compromised merchant accounts, or deception of the customer can permit attempted transactions at a distance.
The Dutch central bank's qualitative finding is specific: the increase in card fraud occurred mainly in online payments, with stolen card details often used for payments in other countries. The public summary does not provide an exact online percentage of the €41 million total. We should not invent that number—or borrow another country's remote-payment rate.
The Netherlands also illustrates the need for careful definitions. Fraud linked to a debit card at an ATM belongs to the central bank's cash withdrawals line, not automatically the card payments line. In 2025, ATM fraud had a reported value of about €10 million, compared with €6 million in 2024.
The strongest age evidence measures victims—not their card transactions.
Statistics Netherlands supplies age-specific evidence, but it must not be relabelled as a card-fraud rate. The distinction is especially important when comparing older and younger consumers.
Statistics Netherlands' 2025 Safety Monitor, summarized in its Cybersecurity Monitor, asked Dutch residents aged 15 and older whether they experienced online criminality in the preceding twelve months. Its category fraude betalingsverkeer (payment fraud) includes more than card-fraud transactions and therefore measures a different phenomenon from DNB's processor reports.
In that survey, 1.2% of people aged 15 and older reported online payment fraud. The prevalence was 0.6% among 15–24-year-olds, 1.2% among 25–44-year-olds, 1.5% among 45–64-year-olds, and 1.2% among people aged 65 or over.
These differences could reflect exposure, purchasing behaviour, recognition, or reporting as well as actual susceptibility. They cannot establish which age group has the highest rate of card fraud per transaction; the survey does not provide card-use denominators. Nor should we replace these figures with an age chart for online shopping or payment adoption.
Reporting behaviour also complicates comparisons. Among people who experienced online payment fraud, CBS recorded an 81.9% report rate to an institution and 16.3% formal police-report rate. Those measures refer to victims of the survey's broader payment-fraud category—not specifically to card chargebacks or bank-reported incidents.
The stolen number is often only the opening move.
Fraud mechanisms differ by channel. Merchant defenses should be built around the actual transaction journey rather than one universal fraud score.
Stolen card data and account testing
Phishing, malicious websites, or compromised accounts can expose card details. Criminals may test credentials through small attempted purchases before trying larger orders or repeated transactions. DNB specifically identifies stolen details in online payments, particularly abroad, as an important pattern.
The familiar customer suddenly behaves differently
Fraudsters may enter a legitimate customer's ecommerce account after credential theft. A stored payment token can allow an unfamiliar device or shipping address to be used without the buyer typing a card number again. Checkout-only fraud screening will miss some of this activity.
Lost cards and physical misuse
At Dutch tills, DNB notes that lost or stolen debit and credit cards appear more commonly in physical-point-of-sale fraud. The prevalence of contactless payments is a payment-usage fact, not evidence that the contactless technology itself caused the fraud.
The payer is persuaded to approve a bad payment
Strong authentication confirms possession or control of credentials; it cannot independently establish that a buyer's intentions have not been manipulated. DNB notes that people may be tricked into approving fraudulent transactions themselves, even when technical authentication succeeds.
A successful authentication is not a verdict on liability.
The Netherlands operates within EU payments law. But consumer reimbursement rules, the bank's immediate duty, card-scheme liability shifts, and the merchant's final exposure are related—not interchangeable—questions.
Under the EU's Payment Services Directive (PSD2), unauthorized transactions generally require the payer's payment-service provider to refund the customer promptly, subject to specific conditions and exceptions. The standard maximum payer exposure for certain lost, stolen, or misappropriated instruments is €50, with important exemptions; fraud or intentional or grossly negligent conduct can change the outcome. This is not a blanket guarantee that all disputed purchases are refunded.
Strong Customer Authentication (SCA) is designed to make electronic payments safer. The ECB/EBA joint fraud report published in December 2025 confirms that SCA remains effective against many established fraud types, particularly card fraud, while criminals increasingly manipulate payers. For card ecommerce, EMV 3-D Secure can support issuer authentication and fraud-liability treatment depending on scheme rules and the specific transaction.
Merchants should distinguish three timelines: the consumer's complaint and refund; the issuer–acquirer card-scheme dispute; and the merchant's eventual financial exposure. Authentication may shift liability in certain cases, but it does not guarantee that the order will be legitimate, that goods will not be returned, or that every disputed transaction will be protected.
Similarly, a DNB fraud statistic is not automatically a chargeback statistic. The central bank includes fraudulent transactions subsequently reimbursed or reversed and does not publish a final merchant-only loss allocation for the €41 million headline figure.
Protect the checkout without turning every order into a challenge.
Dutch card fraud is now a cross-border, online and identity problem as much as a lost-card problem. Controls should follow channel, fulfilment, and the actual reasons disputes arise.
Implement EMV 3-D Secure, issuer-authentication fallbacks, tokenization where supported, and velocity rules for card testing. Track approvals and false declines alongside fraud flags.
Review device changes, shipping mismatches, repeat purchases, risky subscriptions, digital goods delivered instantly and cross-border fulfillment. Not all categories justify the same checkout friction.
Separate disputed value, reversed fraud, true chargeback losses, lost inventory and operational cost. The regulator's aggregate €41 million cannot be entered into a merchant P&L as-is. See DMS's chargeback-prevention guidance for the operational distinction between fraud disputes and recoverable revenue.
Check support for Visa Debit and Debit Mastercard, terminal software, EMV configuration and contactless verification. The brand migration creates acceptance considerations as well as new checkout options.
Retain authentication indicators, order details, proof of delivery, refund records, customer communications and concise dispute documentation. Apply retention and privacy controls proportionately.
Investigate transaction bursts, repeat low-value authorization attempts and unexpected concentrations by country or device. A processor's monitoring concerns are easier to address before an account review. DMS's international merchant-account guidance provides related cross-border context.
For merchants trading internationally, a defensible fraud program is a combination of checkout authentication, fulfilment integrity, disciplined dispute handling and transparent underwriting information.
Make fraud and chargeback risk easier to underwrite.
The right processing structure depends on what you sell, where customers pay, how quickly you fulfil orders, and how chargebacks develop. Durango Merchant Services helps businesses assess underwriting concerns, organize documentation, and pursue appropriate merchant-account approvals.
This discussion is relevant to cross-border card acceptance and international ecommerce; it is not a claim that DMS directly underwrites domestic Netherlands merchant accounts.