For calendar 2025, the Bank of Greece's May 2026 review counted 363,101 fraudulent card transactions worth €22.60 million. Its October 2026 review reported 9,830 fraudulent credit transfers totaling approximately €17 million for the same year. These figures refer to detected and recorded fraudulent payment transactions—not necessarily losses finally borne by victims.

The 2025 card picture was flat value, not decline. The card-fraud count fell 9% from 2024, but the value held at €22.6 million in both years. The channels moved in opposite directions: POS fraud value fell 28%, while remote card-fraud value rose 4%.

Across these two selected payment rails only, cards account for approximately 97.4% of incidents and 57.1% of fraudulent value. Credit transfers represent only 2.6% of incidents but roughly 42.9% of value. The average recorded fraudulent transfer was about €1,730, compared with around €62 for a fraudulent card transaction. These averages are derived from rounded reported values; they are not a typical victim's final loss.

That contrast should not be mistaken for a cross-rail fraud-rate ranking. Banks execute transfers with legitimate average values much greater than everyday card purchases. The Bank of Greece reports a 2025 card fraud-to-transaction ratio of 0.013% by count and 0.019% by value, versus credit-transfer ratios of 0.00129% and 0.00135% respectively. Denominators differ dramatically between rails.

The European Union Agency for Fundamental Rights (FRA) survey published in May 2026 asked respondents whether they had ever been tricked through email or instant messaging into making payments, transferring money or disclosing personal information. Greece had a reported 11% lifetime victim-experience rate, compared with 24% across the EU. The sample comprised 26,453 respondents EU-wide. This outcome covers more than financial loss: someone tricked into disclosing data also qualifies.

The age information in that FRA publication is EU-wide, not a Greece-only cross-tab. Across the EU, 30% of respondents aged 25–39 reported experiencing the specified online fraud, while the reported rate among people aged 55 and older was 19%. The report observes that older respondents have lower use of the email and messaging channels in scope, which partly affects the raw differences. It would be incorrect to assign 30% or 19% to Greek residents of those ages.

A separate Greek survey by the research institute of the Hellenic Confederation of Commerce and Entrepreneurship (ΕΣΕΕ) for Visa, reported by Enikonomia and Capital.gr in November 2025, adds a direct money-loss measure: two in ten of those who had fallen victim to online fraud lost money. Of those, 33% lost up to €50, 30% lost €50–199, 12% lost €200–499 and 16% lost more than €500. The same survey found that 56% of respondents continue to shop online as before, rising to 74% among people aged 17–24. Those shopping figures describe behavior, not fraud-loss incidence by age.

The defensible inference for merchants is that fraud affects acquisition and retention as well as immediate payment security. A victim who has been tricked may stop buying from unfamiliar sellers, become more sensitive to authentication interruptions or demand clearer return procedures. The data do not justify labeling Greek seniors or Greek teenagers as the most financially vulnerable group.

Under Regulation (EU) 2024/886, euro-area payment service providers generally had to be able to receive euro instant transfers by 9 January 2025 and send them by 9 October 2025, subject to the regulation's scope and exceptions. The accompanying verification-of-payee requirement seeks to warn users when a recipient name does not match the account identifier before payment authorization.

Greece's local rollout went further for merchants. The Independent Authority for Public Revenue (AADE) states that from 1 December 2025, acceptance of account-to-account instant payments such as IRIS was mandatory for business-to-consumer transactions, with technical acceptance routes through POS equipment or electronic invoicing service providers. The rule addresses availability and integration of the payment method, not a guarantee against fraud.

The Bank of Greece reports 79.5 million IRIS interbank transactions in H1 2026, up 54% from 51.6 million in H2 2025. Most were person-to-person transfers. An increasingly familiar payment rail can be convenient for legitimate customers and criminals alike; faster settlement means there is less time to reverse an erroneous destination.

The bank's 2025 fraud analysis attributes 64% of fraudulent transfer cases to payment orders issued by the fraudster after obtaining sensitive data, and 36% to manipulation of the legitimate payer. This refers to the bank's classified transfer-fraud incidents, not the entire universe of Greek scams, and should not be compared directly with the EBA's EU-wide classifications.

On 30 June 2026, DIAS connected IRIS to the EuroPA alliance, linking it with Bizum in Spain, MB WAY in Portugal and BANCOMAT Pay in Italy. The first phase covers person-to-person transfers by mobile number only; business and retail interoperability is a 2027 objective. Cross-border IRIS checkout is therefore planned rather than live, but the direction strengthens the case for clear receiving-merchant identity, carefully documented beneficiary changes and transparent customer confirmation.