Card Fraud in the United States 2026: Statistics, Online Attacks and Merchant Losses
America's cards are used more often than ever, but fraud does not follow a single path. Remote misuse, counterfeit credentials and account takeover produce different losses for merchants, issuers and cardholders. The latest research reveals where exposure is concentrated—and how much of it businesses actually carry.
Credit and Debit Cards Power Nearly Four in Five Noncash Payments
The transaction base is exceptionally large. Understanding its composition is a prerequisite to understanding fraud: a debit purchase at the counter, a credit-card ecommerce order and a recurring card-on-file charge may all use payment cards, but their economics and controls are not identical.
The Federal Reserve's July 2026 payment-system release estimates 187.7 billion card payments worth $11.50 trillion during 2024. Cards accounted for 79% of all core noncash payments by number, though only about 8% by value, because ACH and checks carry much larger average payments.
Debit accounted for 120.6 billion payments, roughly 64% of card transactions; credit accounted for 67.1 billion. By value the order reverses: credit cards carried $6.51 trillion against debit's $4.99 trillion. Credit-card payments increased more rapidly than debit-card payments over 2021–2024, the first such three-year interval recorded by the study in almost a decade.
Those numbers describe payment activity, not fraudulent transactions. Likewise, card spending is not interchangeable with the separate card-fraud denominator used by the Nilson Report: Nilson counts $13.01 trillion of U.S. card volume for 2023, while the Federal Reserve counts $11.50 trillion of card payments for 2024. Comparing the two without regard to year, card universe or transaction type would generate a superficially tidy but invalid fraud rate.
How Much Card Fraud? Two Useful Measures—and No Single Universal Rate
Total fraudulent transaction value conveys the scale of crime. Fraud loss rates express the exposure relative to a defined payment population. Both matter, but only if the denominator and scope travel with the number.
Industry research from the Nilson Report records $14.32 billion in fraud losses associated with cards issued in the United States in 2023, up from $13.61 billion in 2022. Measured against the $13.01 trillion of U.S. card volume Nilson reports, that works out to about 11 basis points, or 11 cents per $100 of card activity. This includes a broader card universe than the Federal Reserve's covered-debit-issuer dataset.
The Federal Reserve's December 2025 debit-card report, using 2023 transaction data, provides a sharper view of loss allocation. At debit-card issuers covered by the interchange-fee standard, fraud losses across transaction types amounted to 17.6 basis points of transaction value, equivalent to $17.63 per $10,000 of that covered payment volume. That is not a national credit-plus-debit card-fraud rate.
In those covered-debit transactions, merchants absorbed 49.9% of fraud losses, issuers 28.3% and cardholders 21.8%. The distribution is consequential precisely because fraud-loss incidence and who ultimately bears a loss are different measurements. It does not mean merchants paid 49.9% of all U.S. card fraud.
Card-Not-Present Fraud Persists Even as EMV Changes In-Store Risk
The chip helped change the economics of counterfeit payments at the terminal. Ecommerce, subscriptions, stored credentials and payment APIs have expanded a different attack surface—one that a chip alone does not protect.
In 2023, card-not-present (CNP) transactions accounted for 34.4% of debit and general-use prepaid transaction counts and roughly 47.5% of their value among covered issuers, according to the Federal Reserve. A remote card transaction was also larger on average: $63.96 versus $36.99 for a card-present transaction. These figures describe where debit purchases occur, not the fraud rate of each environment.
Research published by the Federal Reserve Bank of Kansas City on February 25, 2026 found that the value-based CNP fraud rate for non-prepaid debit cards increased between 2021 and 2023 on both dual-message and single-message networks. Over the same interval, card-present fraud decreased on dual-message networks but increased on single-message networks. The single-message CNP rate rose by more than 10 basis points and, for the first time, surpassed the dual-message rate.
In 2023, the card-present fraudulent-value rate was 14.2 basis points on dual-message debit networks compared with 5.1 basis points on single-message networks. Counterfeit fraud accounted for 8.0 and 2.2 basis points respectively, and lost-or-stolen fraud for 4.8 basis points on dual-message networks. These are network-specific rates using card-present transaction value as the denominator. They should not be confused with the aggregate 17.6-basis-point loss figure in Chapter 2.
The implications are practical rather than nostalgic. Card-present risk still needs attention, including fallback, stolen-card behavior and counterfeit-related disputes. Remote commerce requires additional monitoring for account takeover, credential compromise, high-frequency testing and customers whose transaction histories do not match the current order.
2021–23 CNP fraud-value rates rose on both network types in the Kansas City Fed analysis.
Card-present fraudulent-value rates declined over 2021–23 for dual-message debit.
Card-present fraudulent-value rates increased over the same interval for single-message debit.
Direct U.S. Card-Fraud Experience Rises With Age—but Exposure Is Not the Same as Loss
This is a rare national fraud-by-age measurement that actually asks about fraud involving a credit card, rather than substituting digital adoption, complaints volume or general scam exposure.
The Federal Reserve's May 2026 report on household economic well-being found that 16% of all adults reported experiencing fraud involving their credit card during 2025.
By age, the reported shares were 9% among adults 18–29, 13% among ages 30–44, 17% among ages 45–59 and 22% among adults 60 and older. These are percentages of all adults in each age group, not only credit-card owners or card-fraud complainants.
The pattern needs interpretation. The Fed notes that higher-income adults reported more credit-card fraud in part because they were more likely to own credit cards. Differences in card ownership and transaction activity can likewise influence age comparisons. These figures establish self-reported experience, but do not establish that an older credit-card transaction is inherently more likely to be fraudulent.
The same table shows that other, non-credit-card financial fraud was nearly flat across ages, at 7% to 9%, so the age gradient comes almost entirely from credit-card fraud.
Nor do these figures show who lost money. Many consumers do not ultimately bear the cost of an unauthorized credit-card transaction; the financial loss may be shifted, reversed or disputed. That distinction makes a chart of reported experience more defensible than an unsupported claim about age-specific card-fraud financial losses.
Five Different Card-Fraud Mechanisms—and Why a Single Filter Cannot Stop Them
Fraud often reaches the checkout at the end of an earlier compromise. The moment of authorization is crucial, but it may not be the moment at which the attacker gained control.
Stolen card credentials in ecommerce
Card details harvested from phishing, breached stores or compromised devices can be reused remotely. A payment may pass basic formatting and authorization checks without demonstrating that the genuine cardholder is buying anything.
Card testing and automated authorization bursts
Attackers submit repeated low-value or zero-dollar attempts to identify valid credentials. A high decline count can be an early operational signal even when little settled fraud has occurred. Visa and other providers explicitly monitor enumeration separately from ordinary disputes.
Customer account takeover
Stolen login credentials, password resets or compromised sessions let a criminal use cards already stored with the merchant. The checkout may look like a returning customer, which is why changes to login, device and fulfillment details can be more revealing than the card number alone.
Digital skimming and malicious checkout scripts
Injected scripts can capture data on the merchant payment page before a transaction is submitted. This is a site-integrity problem as much as a fraud-screening problem: a gateway cannot undo compromised input collection.
Lost cards, counterfeit information and terminal abuse
In-store fraud remains measurable despite EMV migration. In 2023, counterfeit fraud ran at 8.0 basis points of card-present value on dual-message debit networks and 2.2 on single-message networks, and lost-or-stolen fraud kept rising on both types; a reported in-store decline in one network category is not a guarantee for every physical merchant.
Mechanism descriptions and merchant attack examples are supported by Visa's merchant fraud overview and J.P. Morgan's July 2026 analysis of card testing. These are explanatory mechanisms, not a numerical ranking of U.S. fraud causes.
Fraud Screening Is a Stack: Identity, Authorization, Disputes and Website Integrity
2026 merchant risk management needs to distinguish technical defenses from card-network monitoring rules. The first helps prevent bad transactions. The second determines how excessive fraud and disputes affect processing relationships.
EMV 3-D Secure gives a card issuer additional transaction and device information and may enable frictionless or stepped-up authentication. As EMVCo explains, the goal is to distinguish a genuine buyer from an impostor without challenging every order. Merchants can also review DMS's practical guide to 3-D Secure 2.0. A 3DS signal may affect dispute liability when scheme conditions are met; it does not eliminate authorization failures or guarantee chargeback protection.
Visa's Acquirer Monitoring Program (VAMP) is especially relevant to ecommerce merchants. The Visa program fact sheet states that the U.S. excessive-merchant ratio threshold was reduced from 220 to 150 basis points effective April 1, 2026, with a minimum monthly count of 1,500 fraud and dispute events. Application depends in part on the acquirer's own status. That ratio combines defined fraud reports and disputes over settled transactions; it is not simply a merchant's chargeback percentage.
Visa also tracks enumeration activity, with a defined ratio threshold of 2,000 basis points (20%) and a minimum of 300,000 identified transactions in the month. This matters even if bots are declined: Visa's metric counts both approved and declined authorizations classified as enumeration.
Payment-page integrity is a separate control. The PCI Security Standards Council's SAQ A guidance explains a January 2025 change: PCI DSS v4.0's future-dated ecommerce requirements became mandatory on March 31, 2025, but payment-page script requirements 6.4.3 and 11.6.1 were removed from SAQ A and replaced with an eligibility criterion that the merchant's site is not susceptible to script-based attacks. The exact way a merchant validates compliance depends on its integration and assessment scope; use of a hosted payment component does not automatically remove every website-security obligation.
Finally, an unauthorized card-absent dispute is not the same thing as every unhappy customer. Visa's dispute-management materials describe condition 10.4 and evidence-related defenses. Merchants can pair that framework with DMS's chargeback-prevention guidance. Treat early fraud notifications, network-reported fraud, formal disputes and pre-dispute resolutions as distinct workflow states rather than one undifferentiated chargeback queue.
Build a Fraud Program That Protects Revenue, Not Just the Approval Queue
A merchant can reduce one loss measure while making another worse. Excessive screening rejects legitimate orders; weak screening invites disputes and scrutiny. The objective is to manage fraud, authorization and customer friction together.
Measure the entire funnel
Track attempts, approvals, declines, suspected fraud, confirmed fraud reports, disputes and settled transaction counts separately. Normalize by channel, payment method and transaction volume so a growth surge is not mistaken for a change in risk.
Apply proportionate friction
Use targeted 3DS and risk-based verification when the issuer and transaction support it. Keep false declines visible in reporting; a fraud rule that blocks real buyers has a measurable commercial cost even if no chargeback occurs.
Stop card testing early
Watch bursts of small authorizations, changing card numbers, repeated declines and suspicious device patterns. Coordinate with the processor; waiting for settled fraudulent orders can miss the first signal entirely.
Correlate order and delivery evidence
Retain authorized customer interactions, delivery confirmation, digital access logs and refund history where appropriate. Evidence should be tied to the dispute reason, not gathered only after a representment deadline arrives.
Audit payment-page dependencies
Review third-party scripts, change monitoring and hosted checkout integration scope. A compromised checkout can produce downstream fraud across many cards before the merchant's chargeback rate becomes conspicuous.
Explain risk before it escalates
Document sales model, recurring billing, fulfillment timelines, transaction amounts, refund practices, fraud controls and prior dispute history. These facts matter when a processor evaluates merchant risk or account continuity.
The right benchmark is not merely a lower fraud rate. It is fewer avoidable losses at an acceptable approval rate, with stronger evidence and fewer surprises for the acquiring bank.
Fraud Controls Matter. So Does a Stable Processing Account.
If recurring billing, ecommerce risk, dispute trends or prior processor treatment are affecting your business, DMS can evaluate your transaction profile, underwriting concerns and documentation before you seek or expand card acceptance. Approval decisions remain with the acquiring institution.