Payments Fraud in Croatia 2026: Card Growth, Transfer Losses and the Tourist-Booking Scam
Croatia's fast-moving card market now sits beside an instant euro-payment network. The combined system is convenient; the fraud is less uniform. Cards dominate reported fraudulent payment events, transfers dominate the value, and scams against tourist bookings and established online accounts increasingly target the person making the payment—not the payment technology alone.
Croatia's Payment Market: Card Spending Accelerates, and Every Euro Can Now Move Instantly
The euro area's newest member is no longer defined simply by an old cash economy. Its payment landscape is a combination of rapid contactless checkout, growing online transactions, strong tourism-related cross-border activity and bank transfers that can settle within seconds.
Croatia adopted the euro on 1 January 2023. By 2025, figures from the Croatian National Bank's card-statistics publication, reported by Hina, put transactions made with Croatian-issued cards at 922.3 million, worth €46.9 billion. Transaction count rose 8.1% from 2024 and reported value 13.3%. This broad card-activity aggregate should not be confused with retail purchases alone: it encompasses multiple types of card use.
The clearest checkout evidence is more specific. The HNB’s 2025 card publication puts contactless EFTPOS purchases at 653.84 million, about 94% of purchases of goods and services by number. Remote (card-not-present) transactions—initiated online or through other distance channels, domestic and international—reached 142.17 million worth €7.69 billion, up 36% in count and 41% in value. The HNB’s narrower internet-transaction measure is only about 9% of card transactions; the two use different scopes. These measures have different transaction populations; neither should be added to card-activity totals to create a new digital-payment share.
Croatian merchants also serve an important market beyond domestically issued cards. The same HNB publication shows that about 83% of card transactions accepted in Croatia, and 85% of their value, used Croatian-issued cards—so roughly one in six transactions at Croatian merchants involved a foreign-issued card. (The widely reported 118.5 million transactions worth €6.47 billion run the other way: Croatian cards used abroad.) Issuer geography is not the same as the cardholder's nationality, but these transactions help explain why hotels, travel companies, rental agencies and restaurants need well-documented cross-border payment and refund processes.
The payments infrastructure is catching up with the checkout. The state financial agency Fina describes EuroNKSInst as an around-the-clock instant euro-transfer service: domestic instant payments began in October 2020, cross-border euro capability followed in June 2023, and all banks enabled customers to initiate instant payments by October 2025.
For fraud analysis, that is the essential context: an in-store tap, an online card payment and an instant credit transfer expose different failure points, even when all are initiated from the same mobile phone.
Where Croatian Payment Fraud Sits: Many Card Events, Heavier Transfer Losses
The joint ECB/EBA country tables for 2024 offer a common basis for comparing fraudulent transactions by rail. The number of incidents and their monetary value tell different stories.
The Two Largest Fraud Rails, 2024
| Instrument | 2024 fraud events | Fraudulent value |
|---|---|---|
| Cards (issuer side) | 79,957 | €5,751,537 |
| Credit transfers | 4,923 | €12,572,657 |
| E-money | 5,315 | €220,908 |
| Cash withdrawals | 650 | €153,261 |
The ECB/EBA country tables report calendar 2024 transaction counts and values.
Chart percentages compare only the two largest rails; smaller instruments appear in the table but are excluded from the two-rail percentages. Fraud value is not necessarily final unrecovered loss.
The December 2025 joint ECB/EBA report records 79,957 fraudulent card payments worth €5.75 million and 4,923 fraudulent credit transfers worth €12.57 million for Croatia in calendar year 2024. Among these two payment rails, cards therefore accounted for approximately 94% of fraudulent transactions yet only 31% of fraudulent value.
Severity differs dramatically. Dividing reported fraudulent value by reported incident count gives about €72 per fraudulent card payment versus approximately €2,554 per fraudulent credit transfer. EU/EEA averages were €76 and €2,155 respectively. This arithmetic average is not the typical loss of an individual victim and should not be interpreted as the amount finally lost after recovery, refunds or liability allocation.
The same tables report a card-fraud value rate of 0.025%, below the EU/EEA total of 0.033% (by count, 0.011% against 0.015%), compared with 0.002% for transfers. These are shares of all legitimate-and-fraudulent payment value within each rail; the higher card rate does not contradict the larger absolute value of transfer fraud. Transfer payments move much greater underlying sums.
The same report shows who absorbs transfer losses. Across the EU/EEA, payment-service users bore around 85% of credit-transfer fraud losses in 2024, and Croatia is among the countries where the users’ share exceeded 80%.
Across all four reported nonzero rails shown in the table, fraud value amounted to approximately €18.70 million in 2024. It is tempting to call that a national consumer-fraud bill, but it is not. These are payment-service-provider statistics, not a comprehensive police count or a statement of victims' net losses. They do not count attempted fraud that failed before a payment was made.
Croatia in 2025–2026: Payment Fraud Rates Stay Low, but Scams Change Form
A simple upward or downward trend would obscure more than it reveals. New central-bank payment figures, police offences and CERT incident reports describe three separate systems—and they do not move in lockstep.
An October 21, 2026 review of Croatian National Bank statistics reports that the value-based fraud rate for cards remained 0.025% in 2025, while the transfer rate was 0.002%. The reported e-money fraud rate fell from 0.011% in 2024 to 0.007% in 2025. The HNB publication is the underlying source; this secondary account is used for the recent 2025 rates because the corresponding original statistical table was not independently retrieved for this edition.
On a common transaction-value denominator, a card-fraud rate of 0.025% represents €250 in fraudulent payments per €1 million of card-payment value. The corresponding transfer rate of 0.002% represents €20 per €1 million transferred. These rates are not the same as the percentage of customers victimized, and the numbers are rounded to published precision.
The Croatian Ministry of the Interior's annual 2025 review documented 2,161 cybercrime offences, down 9.6% from 2024; 76.6% of these were classified as computer fraud. Criminal-offence counts depend on reporting and classification, rather than the number and value of fraudulent payment transactions recorded by banks.
At the same time, Croatia's National CERT reported 1,513 cyber incidents for 2025, with reports up 35.9% year over year; phishing made up 32%, unwanted messages 19% and other financially motivated fraud 18%. Its October 2026 update logged 1,203 incidents through September, essentially unchanged from the corresponding nine months of 2025. Phishing accounted for 439 incidents (36%), unsolicited messaging 289 (24%) and other financially motivated fraud 224 (19%). Phishing’s share rose from 32% in 2025.
Different measurement systems explain the apparent contradiction. CERT logs incidents it receives or discovers, not all successful thefts. Police record offences under criminal law. Banks report payment fraud, including payment types and rates. Adding these counts together would double-count some activity while omitting other activity.
Three Lenses on the Threat
Separate definitionsCards 0.025%; transfers 0.002%. Rates are proportions of the value moving through each rail.
Criminal-law records; 76.6% categorized as computer fraud. This is not the same denominator as HNB reporting.
439 phishing and 224 other financially motivated fraud incidents; not a tally of net payment losses.
These measures come from HNB figures reported by Lider, the MUP annual review and National CERT's 2026 update.
Who Reports Computer Fraud in Croatia? An Age Signal Without a Risk-Rate Claim
Police information permits a more direct demographic measure than payment adoption statistics: the percentage of recorded computer-fraud victims older than 60. But it is a distribution of cases, not the probability that someone in an age group will be victimized.
In its 2025 victim figures released with a seniors-protection project, Croatia's Ministry of the Interior reported that people age 60 or older accounted for 591 of 1,680 recorded computer-fraud victims, or about 35%. A separate March 2026 media account of police figures reported 36% for 2025 and 40% for 2024. The official release supplies a clearer 2025 numerator and denominator, so this article uses 35% for that year. These are victims within one police offence category, not all fraud victims.
A 35% share of recorded victims is not a 35% chance of being defrauded. Without exposure and age-specific population denominators, it is not possible to conclude that a person age 60 or older faces a higher age-adjusted fraud rate. It cannot be compared directly with the ECB/EBA's card and transfer transaction totals.
The country-specific European Commission Consumer Conditions Survey, 2025 edition offers a complementary outcome-based indicator: 8% of respondents in Croatia said they had made an online purchase from a shop that turned out to be fake; 6% said they were tricked into an online recurring subscription. These self-reported categories should not be added as if the affected individuals were mutually exclusive.
For operators, the age data suggest a need for accessible confirmation channels and protective design, not age-based profiling. Fraudsters use authority, urgency and convincing stories with customers of every generation. A booking confirmation or banking-warning email should be understandable without demanding that the customer disclose credentials through a link.
Police-recorded computer-fraud victims age 60 or older
Track width represents 50%. The 2025 figure is from the Ministry's 591 of 1,680 victims; 2024's 40% is a police figure reported by Mirovina. Differences in reporting and definitions may affect a year-to-year comparison.
See the Croatian Ministry of the Interior and the European Commission survey.
From Booking Messages to Spoofed Bank Transfers: The Scam Routes That Matter
Croatia's tourism economy creates a distinct fraud surface: plausible reservation messages, high-value advance payments, foreign customers and third-party booking channels. The country's CERT identifies these mechanisms in its 2026 incident reporting.
Reservation Hijacking and Payment-Link Substitution
National CERT's accommodation scam warning describes messages containing genuine booking information used to persuade customers to provide card details or make additional payments. Its October 2026 update also notes more tourist-reservation fraud. A credible reservation number or property name is not proof that a new payment request is legitimate.
Invoice Redirection and False Beneficiaries
A fraudster persuades an employee to change the bank account on an otherwise legitimate supplier invoice, or impersonates a manager requesting an urgent payment. The resulting transfer can be authenticated by the rightful account holder; the failure lies in verifying the commercial instruction and beneficiary. The ECB/EBA warn that payer manipulation is growing despite strong customer authentication.
Account Takeover and WhatsApp Propagation
National CERT observed compromised messaging accounts being reused to contact a victim's existing network. Similar impersonation of Croatian public services, including e-Građani branding, can cause a user to hand over credentials or follow an attacker-controlled payment path. The social context increases apparent authenticity even when the sender is controlled by a criminal. National CERT.
Stolen Cards, Fake Shops and Unclear Subscriptions
Card-not-present businesses must distinguish unauthorized card use from disputes about a genuine order. Fake shops also harvest money and information from consumers; the European Commission's 2025 country survey found 8% of Croatian respondents had bought from a shop that turned out to be fake. That consumer outcome is not a measure of card-payment fraud volume. European Commission.
Instant Euro Payments and Beneficiary Verification: Faster Settlement, Better Warnings
October 2025 was a practical turning point for euro-area bank payments. Instant transfers became broadly available, and bank interfaces began checking whether the name of the intended payee matched the IBAN.
Regulation (EU) 2024/886 requires relevant euro-area payment service providers to receive instant euro transfers from January 2025 and send them from October 2025; it also introduces verification of payee for standard as well as instant euro transfers. The precise obligations depend on provider category and the regulation's transition provisions.
Croatia's own implementation is documented. Fina states that all banks enabled initiation of instant payments by 5 October 2025. Zagrebačka banka's customer notice and OTP's guidance describe payee verification: the payer receives an indication of whether the entered beneficiary name aligns with the destination IBAN.
Verification of payee is a meaningful defense against simple invoice interception and mistyped accounts. It is not a universal fraud filter. A criminal can still pressure a customer to transfer money to a real account controlled by the criminal or persuade the payer to disregard a mismatch warning. Businesses need out-of-band confirmation for changes to supplier details, independent authorization for high-value transfers and immediate escalation when a suspicious payment is discovered.
Nor is the existence of instant transfer confirmation sufficient proof of a genuine sale. Hotels and digital merchants should obtain reliable settlement information directly from their own bank or payment system, then reconcile it to the order reference and amount rather than accepting a screenshot or forwarded message.
The ECB/EBA's 2025 report describes strong customer authentication as effective against traditional unauthorized card fraud, while finding that fraudsters increasingly induce customers to authorize their own fraudulent payments. This is the limitation that merchant operations must address.
How Croatian Merchants Can Reduce Fraud Without Adding Friction to Every Sale
Control design should match how a transaction originates and where money moves. A booking operator exposed to compromised customer messages needs a different response from a supplier paying invoices or an ecommerce store fighting unauthorized card use.
Hotels, Rentals and Tourist Operators
Priority: Keep payment instructions in verified customer channels; avoid asking guests to re-enter full card credentials through a new message link. Authenticate updates to deposits or reservation details with a known contact path and retain a record of communication.
Online Card Merchants
Priority: Combine 3-D Secure with device, velocity, geographic and order-risk signals. Record delivery and service fulfillment, make refunds easy to understand and maintain defensible chargeback evidence; a successful authentication does not preclude a dispute.
Cross-Border Sellers
Priority: Assess foreign-issued card exposure, settlement currency, billing descriptors, refund routes and customer-support coverage. Segment card-origin risk from local and foreign customer demographics; issuer location does not establish citizenship.
Invoice and Supplier Payments
Priority: Quarantine changes to bank details. Verify them with a preexisting trusted phone number or known contact, require a second approver and retain evidence; a correct payee-name match alone cannot verify whether the supplier's instruction was legitimate.
Instant Transfers and Deposits
Priority: Reconcile deposits against a bank-origin settlement feed, not a message or screenshot. Use transaction-reference matching and daily exception reviews; establish escalation procedures for suspicious transfers while recovery options may still be available.
Recurring and Higher-Risk Businesses
Priority: Document billing terms, actual volumes, refund policies, fulfillment delays, dispute history and cross-border sales when seeking high-risk merchant account approval. Align monitoring and reserve planning with the real business model.
The strongest practical distinction is not between digital and traditional payments. It is between verifying that the customer authenticated a payment and verifying that the recipient and the commercial instruction are genuine.
Secure Payment Processing for Croatia-Exposed and Cross-Border Merchants
Merchant underwriting and fraud prevention should reflect actual order volume, customer geography, billing structure, delivery timing, refund procedures and chargeback history. Durango Merchant Services helps businesses assess underwriting issues, organize supporting documentation and pursue the right processing setup for their risk profile.