Card Fraud in the UK 2026: Statistics, Online Fraud and Merchant Risk
The UK's card-fraud problem has become a problem of scale. Fraudsters made more successful remote purchases in 2025, but the average loss per remote case kept falling. That creates a demanding trade-off for merchants: identify stolen credentials early, preserve legitimate approvals and understand which financial losses actually reach their accounts.
Britain Uses Cards for Nearly Two-Thirds of Payments
Card fraud takes place inside a payment market that keeps getting faster, more mobile and more fragmented. Digital wallets change the way a cardholder proves identity, but often not the underlying payment rail.
UK Finance's 2026 payments-market update puts the number of UK payments at 49.7 billion in 2025. Cards accounted for 64% of payment transactions, with debit cards alone making up more than half. This is a market where an inexpensive daily purchase, a subscription renewal and a high-value ecommerce order may all traverse a card network but need radically different fraud controls.
Contactless payments reached 19.2 billion transactions, equivalent to 39% of all UK payments. These figures must not be added to the card share: contactless is mostly an initiation method within the card market, not a separate category of payments. Mobile-wallet registration reached almost two-thirds of the population, increasing the importance of device enrolment and account recovery.
For a payment processor, the meaningful distinction is not simply whether the customer taps a card or a phone. It is whether the merchant can depend on an authenticated, legitimate cardholder; whether the payment was made in person or remotely; and whether a stolen credential can be used repeatedly before it is blocked.
Those nuances are important when studying the annual fraud numbers. The UK-issued-card statistics below include fraudulent use both inside the UK and overseas. They are not restricted to transactions acquired by UK merchants.
Five Different Frauds Behind One £594.9 Million Headline
The 2026 UK Finance report separates five types of unauthorized card misuse. Remote purchase dominates incident volume, but lost and stolen cards, account takeover, counterfeit cards and intercepted mail remain financially material.
The UK Finance Annual Fraud Report 2026 reports 3,775,687 confirmed cases of unauthorized fraud on UK-issued cards in 2025, representing £594.9 million in gross fraud losses. The total was broadly flat in value from £592.5 million in 2024, despite an 11% rise in reported card-fraud cases. The figures count compromised cards or accounts, not unique people.
Remote purchases contributed 3,196,962 cases and £423.5 million: approximately 84.7% of card-fraud cases and 71.2% of card-fraud losses. Lost and stolen cards accounted for 449,189 cases and £109.8 million. Card identity theft—third-party applications and takeover of existing card accounts—accounted for 103,171 cases and £54.0 million.
Counterfeit card fraud accounted for only £4.7 million, but rose from its previous-year level, while card-not-received fraud generated £2.8 million in recorded losses. The smaller categories should not disappear merely because their share of the total is low: each calls for a different intervention at the issuing bank, point of sale, card-delivery process or online account.
UK Finance's loss values are gross of subsequent recoveries. They do not mean cardholders personally lost that amount, and they do not mean the same sum was charged back to merchants. Equating those three measures would distort the underwriting and operational implications.
Bars use independent 0–100% scales within their own measures. Values and percentages are rounded; source category values sum to approximately £594.8m, compared with the published £594.9m total.
Remote-Purchase Cases Climbed 13%; Losses Rose Only 3%
The crucial 2025 pattern is not simply that online card fraud rose. The number of compromised-card purchases increased much faster than their collective value, reducing the average loss per case.
UK Finance recorded 2,830,293 remote-purchase card-fraud cases in 2024 and 3,196,962 in 2025. Over the same years, gross loss value moved from £412.5 million to £423.5 million. These comparable figures come from the same 2026 report: older editions contain some revised 2024 figures, so mixing editions can produce false growth rates.
The average confirmed remote case was therefore approximately £146 in 2024 and £132 in 2025. Over a longer horizon, UK Finance reports that the average value has declined from approximately £300 in 2016. Far more small attempts can burden customer-support teams, fraud analysts and dispute operations even when the aggregate money lost changes relatively little.
The report also identifies £250.8 million in fraud from online / ecommerce card transactions in 2025. Importantly, this is a subset of the £423.5 million remote-purchase figure, not an additional loss total. Remote purchase also includes telephone and mail-order fraud. Similarly, £46.8 million in contactless fraud is a place/method-of-use view and should not be added to the five fraud-type categories above.
The fraud rate by turnover changed much less than the case total: the industry reported a 0.057% card-fraud-to-turnover ratio in 2025, down from 0.060% in 2024. This measures loss value relative to card turnover, not the proportion of fraudulent transactions by count.
Card-Fraud Victimization Is Measurable—But Not the Same as a Fraud Case Count
Household surveys measure affected people; the industry series counts compromised cards and accounts. Read together they describe reach and severity, but they cannot be merged into one population rate.
The FCA's Financial Lives 2024 survey estimated that 6.5% of UK adults had experienced unauthorized use of a card during the preceding 12 months. Within that survey, 4.0% reported unauthorized debit-card use and 2.1% unauthorized credit-card use. The instrument-based percentages are not exclusive categories that can be added to recreate the total.
Among respondents who had experienced card fraud, 84% said they had recovered all their money, 3% some of it, 3% were still reclaiming it, and 10% said they lost money because they could not recover it or did not attempt recovery. Those are outcomes among card-fraud victims, not among all UK adults or transactions.
A separate Which? survey reported in June 2026 found 14% of UK adults experienced card fraud during the preceding two years, compared with 20% of 25–34-year-olds. The longer two-year recall period means this should not be directly compared with the FCA's one-year prevalence figure.
The strongest age conclusion is narrower than a claim that one generation is universally most vulnerable: the Which? survey found higher recalled card-fraud experience among people aged 25–34 than its overall sample. We do not have a nationally consistent 2025/26 all-age set of actual card-fraud financial-loss rates and therefore do not invent such a chart.
Criminals Steal Credentials, Then Exploit the Gaps Between Identity and Authorization
The modern card-fraud chain combines conventional credential theft with social engineering capable of bypassing one-time codes, device enrolment and poorly coordinated account security.
Remote-purchase fraud begins when someone obtains a usable card credential or access to an account and initiates purchases without the genuine customer's permission. The card may have been compromised in a data breach, through malware, by phishing or from an intercepted communication. Not every remote incident is the result of a merchant data breach, and bank-issued cards can be attacked through several routes.
The Home Office's July 2026 unauthorized-fraud call for evidence emphasizes account takeover, automated attacks and social engineering that circumvents multi-factor authentication. The industry reports criminals persuading victims to disclose one-time passcodes, which can then be used to register compromised cards in digital wallets or approve fraudulent transactions.
Card ID theft involves both opening an account using stolen personal information and taking over an existing card account. UK Finance recorded 82,030 account-takeover cases within the identity-theft category in 2025, representing £37.8 million; third-party application fraud accounted for another 21,141 cases and £16.1 million. These are components of the £54.0 million Card ID theft total, not additional fraud categories.
At the physical end of the market, lost or stolen cards can still be used for contactless or PIN transactions, while criminals use distraction, theft and ATM card-entrapment. Counterfeit card fraud is smaller partly because chip-and-PIN adoption restricts magnetic-stripe clones, but UK-issued credentials can still be exploited overseas where adoption and fallback standards differ.
For merchants, the key distinction is between detecting a suspicious transaction, identifying a compromised account, and collecting enough evidence to establish what happened. A successful authorization confirms a payment-processing decision, not necessarily the lawfulness of the underlying purchase.
Phishing, malware, data theft, lost cards or intercepted messages create an opening.
Fraudsters may seek OTPs or abuse device and account-recovery workflows.
Online, phone or in-person activity moves through authorization.
Banks and merchants investigate, refund, contest or absorb losses under applicable rules.
Strong Authentication Reduces Risk, but It Does Not Eliminate Chargebacks
Security, legal reimbursement and network dispute liability occupy different layers of a card transaction. A merchant needs to understand all three.
The FCA's Strong Customer Authentication guidance explains how UK payment-service providers apply extra customer verification to eligible electronic payments under the Payment Services Regulations and technical standards. Online payments may use risk-based exemptions, and an authenticated flow can still be abused if a criminal manipulates the customer or takes over the account.
EMV 3-D Secure offers a structured way for the merchant, issuer and card network to communicate identity and transaction context. Visa's 3-D Secure guidance explains that qualifying successful authentication may shift liability away from the merchant. That protection is conditional, depends on transaction and network rules and does not apply to every dispute reason.
When the genuine cardholder reports an unauthorized payment, the FCA's May 2026 consumer guidance explains refund timing and the limited circumstances in which a bank may refuse reimbursement. However, a consumer refund is not automatically the final loss borne by the card issuer. Network chargebacks, representment, merchant terms and settlement procedures determine how particular losses are allocated.
Fraud prevention therefore needs to extend beyond authentication. Tokenization limits the circulation of raw card data; velocity and device checks help detect automated attacks; strong account recovery reduces takeover; and order-level verification can stop goods or services being released after a suspicious authorization. None of these measures can justify treating every declined purchase as a fraud attempt.
Tracking only chargeback percentage also misses early indicators. Businesses should maintain separate measurements for suspected attempts, approved transactions, confirmed unauthorized payments, disputes by reason code, fraud write-offs, representment outcomes and falsely declined genuine orders. A documented chargeback-prevention process should sit alongside those controls.
Reduce Fraud Cost Without Rejecting Legitimate Customers
A strong fraud program considers approval rates, actual losses, operational burden and customer experience—not just a declining fraud percentage.
Screen unusual combinations
Use device, IP and order-velocity signals alongside address changes, basket contents and fulfillment risk. Review combinations of anomalies instead of treating a single proxy as proof of fraud.
Protect the enrolment path
Monitor account changes and suspicious device registrations. Use properly implemented 3-D Secure 2.0 when eligible and verify that the merchant's network and acquiring arrangement supports the relevant liability conditions.
Separate misuse from dissatisfaction
Record initial customer consent, renewal terms, service delivery, cancellation requests and refund handling. Unauthorized-card claims are not the same as product or billing complaints.
Preserve proof of performance
Document beneficiary identity, booking changes, delivery milestones and services provided. Set additional review for abrupt high-value or last-minute changes before an irreversible release.
Use separate denominators
Measure fraud per approved transaction, gross and net losses per sales value, dispute rates, false declines and manual-review costs. Do not confuse the bank-industry 0.057% turnover ratio with a merchant's own risk.
Make account risk legible
Maintain clear records of transaction size, monthly volume, fulfillment terms, prior processor action and chargeback causes. Those records support high-risk merchant account underwriting reviews and realistic processing decisions.
Review Your Card-Processing Risk Before It Becomes a Processing Problem
Card-fraud exposure, chargeback patterns, billing practices and order fulfillment all affect how a merchant account is evaluated. DMS helps businesses assess their underwriting profile, identify documentation gaps and pursue payment-processing approval based on their actual operating model. Merchants selling across borders can also review DMS' international merchant account guidance.