Payments Fraud in France 2026: Falling Card Fraud, Rising Transfer Risk
French card fraud has fallen to a record low. Transfer losses, meanwhile, have surged—an awkward reminder that fraud rarely disappears when a control works; it changes route.
France has spent years making card fraud harder, and the effort now shows up in the numbers. In 2025, French-issued cards carried more than €1 trillion of transactions, yet fraud fell and the overall card-fraud rate dropped to roughly €47 for every €100,000 spent—the lowest level recorded by the Banque de France's Observatoire de la sécurité des moyens de paiement (OSMP).
That is not the usual bargain associated with digitisation: more e-commerce, more mobile payments and more card transactions, but less fraud riding on top of them.
Fraudsters, unfortunately, are under no obligation to keep attacking the part of the system that has become harder to exploit. While card losses declined, transfer fraud jumped 37% to nearly €485 million, overtaking cards as France's largest source of payment-fraud losses.
The headline total is therefore almost a distraction. French payment fraud did not simply improve or deteriorate in 2025. It changed address.
Payment Fraud in France: A Stable Total Hides a Changing Risk Mix
France's aggregate fraud figure changed modestly in 2025. Its composition changed a great deal.
France processed roughly 35.6 billion non-cash payments worth €36.3 trillion in 2025, according to the OSMP. Total fraud rose 3.8%. In another statistical release, that might be the headline. Here it is closer to camouflage.
Cards generated about 91.5% of fraudulent transactions but only 34.9% of fraud losses. Transfers accounted for just 4% of fraud events but 39.1% of the money lost. Frequency and severity have parted company.
That distinction is more than accounting. One problem produces a great many fraudulent payments; the other can produce far fewer failures at far greater cost. A control system designed for the first can be badly matched to the second.
How France’s Fraud Loss Mix Has Shifted
Fraud value by payment instrument, 2024–2025.
Card Fraud in France Fell Even as Commerce Expanded
Internet-card fraud has roughly halved since 2020, even as French digital commerce kept expanding.
For once, the most interesting fraud number is falling. Internet-card fraud dropped from €249 per €100,000 in 2020 to €124 in 2025.
The steepest early decline coincided with Europe's rollout of Strong Customer Authentication. The EBA and ECB have since concluded that SCA materially reduced the forms of card fraud it was built to stop. France's more distinctive move came afterward.
Once broad authentication had squeezed much of the obvious weakness out of remote card payments, the OSMP went looking for the residue: transaction types and enrollment paths where fraud remained stubbornly expensive.
Internet Card Fraud in France Continued to Decline
Fraud per €100,000 of internet-card payments.
How France Targeted Fraud After Strong Customer Authentication
France did not invent 3-D Secure or Strong Customer Authentication. Its more distinctive contribution was what happened after those European controls were already doing their job: French supervisors kept asking where the remaining fraud was hiding.
Beginning in 2024, the OSMP targeted vulnerable remote payments outside 3-D Secure, scrutinised weak merchant-initiated transaction chains and tightened wallet-provisioning controls. Banque de France says those measures contributed to the subsequent improvement; the public data do not justify assigning them sole credit.
The results are at least consistent with that account. Merchant-initiated transaction fraud fell from roughly €314 per €100,000 in 2024 to €222 in 2025. Mobile proximity fraud fell to around €9 per €100,000 after stronger enrollment controls.
| Measure | Weakness addressed | Observed change |
|---|---|---|
| SCA migration | Remote authentication | Large decline in internet-card fraud after 2020 |
| Stronger wallet enrollment | Fraudulent provisioning | Mobile-payment fraud fell sharply |
| Non-3DS action plan | Residual remote exposure | Further decline in internet fraud |
| MIT remediation | Weak recurring-payment chains | MIT fraud fell materially |
Why Record-Low Card Fraud Still Leaves Expensive Weak Spots
A national fraud rate is an average, and averages are democratic in ways criminals are not. Ordinary proximity and mobile payments produced roughly €9–€11 of fraud per €100,000. Internet payments produced €124. Merchant-initiated transactions produced €222. MOTO reached €322.
Geography widens the gap. Domestic French transactions had a fraud rate of about 0.026% in 2025. Transactions elsewhere in the EEA were at 0.164%; those outside the EEA were at 0.376%.
France has not made stolen cards irrelevant. It has made many of the paths from stolen credentials to a successful fraudulent payment much harder to traverse.
Fraud Rates Vary Sharply Across French Card Transactions
Fraud per €100,000 by channel, 2025.
Transfer Fraud in France Is Becoming More Expensive
Transfer fraud rose from about €355 million in 2024 to €485 million in 2025. The tempting explanation is speed. The data point elsewhere.
Instant payments make an irresistible suspect. Their use is exploding, settlement is fast and stolen money can move quickly. The French figures, inconveniently, refuse to cooperate with that tidy story: instant-transfer usage surged while the fraud rate itself edged down.
The more revealing figure is that 61% of transfer-fraud losses were classified as détournement—diversion.
That is a different species of failure. The customer can be real, the device legitimate, the credentials correct and the authentication successful. The payment can still be wrong because the premise on which it was made was false.
The lie sits outside the credential.
Payer Manipulation and Transfer Diversion Drive the Risk
Share of 2025 transfer-fraud value.
Why Authentication Cannot Stop Authorized Payment Scams in France
France is getting better at establishing who is paying. Fraud increasingly exploits the reason the genuine customer is paying.
OSMP's proxy for fraud by manipulation rose from €269 million in 2021 to €516 million in 2025. At first glance that looks like an indictment of authentication. The components tell a less convenient story.
The strongly authenticated card component barely changed in 2025. The online-banking transfer component, by contrast, surged from €244 million to €376 million.
Authentication did not suddenly forget how to identify customers. The larger deterioration is occurring where legitimate account holders can be persuaded to use perfectly valid access in pursuit of a fraudulent instruction. The system can know exactly who is paying and still misunderstand what the payment means.
Most of France’s High-Value Fraud Problem Now Sits in Transfers
OSMP manipulation proxy, € millions.
Why the €516 million figure needs qualification
OSMP constructs this proxy from fraudulent strongly authenticated card payments and fraudulent online-banking transfers. It is not a transaction-by-transaction census of every manipulation scam, and it should not be treated as directly interchangeable with another country's APP-fraud statistics.
Fraud Demographics in France: Age Changes Exposure and Response
French evidence does not support a simple “older people are the main fraud victims” story. Recorded victimisation is concentrated among younger and middle-aged adults, while scam channels and reporting behaviour vary materially by age.
The strongest age signal comes from French public-safety data cited by the Banque de France's 2024 OSMP report. Victimisation rises sharply after age 18 and peaks among 20–24-year-olds at about 9 registered victims per 1,000 inhabitants. Adults aged 18–44 account for nearly 45% of registered fraud and payment-fraud victims even though they represent about 32% of the population.
A separate Cybermalveillance.gouv.fr / Ipsos survey published in 2025 shows how strongly the contact channel can differ by age. 29% of 18–34-year-olds said they had received a call from a fake bank adviser—nearly four times the rate among people aged 55–75. Younger adults were also less likely to escalate the incident: 17% said they alerted their bank or provider, compared with 34% of 55–75-year-olds.
These datasets measure different things: police-recorded victimisation in the first case and self-reported cyber-threat exposure in the second. They should not be combined into a single age-risk score. Taken together, however, they make one point unusually clear: age affects the route into fraud, not just the probability of being targeted.
Beneficiary Risk Is the Next Payment-Fraud Frontier in France
A fraudulent transfer needs a beneficiary. French controls are increasingly following the money to the receiving account.
If the payer is genuine and the authentication works, attention has to travel down the pipe. French authorities have become increasingly interested in comptes-rebond: accounts used to receive fraud proceeds and move them onward. ACPR research into institutions heavily exposed to such activity found suspicious incoming transfers increasing from roughly €457 million in 2022 to €661 million in 2023. Those figures are not national fraud totals; they are useful because they show where supervisors are looking next.
A French IBAN is an address, not a character reference.
Secure the payer
SCA and 3-D Secure establish who is attempting the payment.
Close weak channels
Non-3DS, MIT and wallet-provisioning controls target residual card exposure.
Check the beneficiary
Verification of Payee tests whether the name and IBAN align.
Share account intelligence
FNC-RF helps PSPs identify accounts suspected of involvement in fraud.
Verification of Payee and the 2026 FNC-RF arrived too late to explain the 2025 fraud figures. Their timing is useful for a different reason: they reveal where French regulators think the next perimeter has to be built.
Fraud Controls for French Merchants Should Follow the Transaction Type
France does not have one fraud problem. A merchant's exposure depends on the transaction, the channel, the geography and who controls the payment.
| Exposure | Control priority |
|---|---|
| Domestic e-commerce | 3DS/SCA and sound exemption handling |
| Subscription billing | Correct CIT-to-MIT authentication chain |
| MOTO | Additional transaction scrutiny |
| Cross-border commerce | Geographic and authentication controls |
| Supplier payments | Beneficiary verification and dual approval |
One French Market, Several Different Fraud-Risk Environments
A domestic authenticated card payment, a MOTO transaction, a non-EEA e-commerce order and a supplier transfer may share a country code while sharing very little else. For merchants, that makes fraud and chargeback controls a transaction-design problem rather than a country-average problem.
The success of French card controls is precisely why “more fraud prevention” is the wrong prescription. The control has to match the failure.
The practical mistake is to import a national average into a transaction-level decision. France's record-low card-fraud rate says something important about the system; it says much less about a MOTO sale, an overseas card-not-present transaction or a supplier transfer.
For years, the hard problem was proving that the person making the payment was really the customer. France has become rather good at that. The next problem is harder: sometimes it really is the customer—and the payment is fraudulent anyway.
Payment Processing in France: Build Controls Around the Transaction, Not the Average
Merchants operating in France face very different risk depending on acceptance mix, 3DS/SCA handling, recurring billing, cross-border exposure and beneficiary controls. The payment stack should reflect those differences.