Payments Fraud in the UK 2026: Card Fraud at Scale, APP Scams at Higher Cost
The UK’s payments system is increasingly digital, but the fraud problem has split into two economies. Criminals make millions of unauthorised card transactions, while a smaller number of manipulated bank payments consume a disproportionate share of lost funds.
The UK is a card market built over several layers of digital payment.
The plastic card, mobile wallet and bank-transfer interface can look similar to customers. They are not the same payment rail, and their fraud and dispute characteristics differ accordingly.
UK Finance’s August 2026 payment-markets report counted 49.7 billion UK payments in 2025. Cards accounted for 64% of transactions. Debit cards remained the most common method, while cash made up just 8%, compared with 45% in 2015. The long retreat of cash has slowed, but it has not reversed.
Contactless payments, whether by a plastic card or a mobile device, reached 19.2 billion transactions—39% of all payments. More than six in ten adults—about 37.6 million people—were registered for at least one mobile wallet. Crucially, contactless is an initiation method, not an additional payment rail to add to card usage; many of those taps ride on cards already counted in the 64%.
Account-to-account payments expanded too. Faster Payments and other remote banking payments reached 6.2 billion in 2025, up 10% from the previous year. Businesses increasingly use those rails for routine transfers, creating a different vulnerability from an online card checkout: a genuine account holder can authorise payment to the wrong beneficiary.
For merchants, the immediate question is not simply whether a payment is digital. It is whether the transaction is card-present, card-not-present, or an account transfer; who can reverse it; what evidence establishes the order was genuine; and whether beneficiary details can be manipulated before settlement.
Millions of unauthorised cases; hundreds of millions lost to authorised scams.
The most useful national split is not simply card versus transfer. It is whether the payer authorised the transaction. The distinction explains the gap between incident counts and financial severity.
UK Finance’s Annual Fraud Report 2026 (full report) recorded £1.28 billion in payment-fraud losses during 2025, up 4%, across approximately 4.06 million cases. Unauthorised fraud accounted for 3.81 million cases and £703.4 million in losses. By contrast, authorised push-payment (APP) fraud involved 248,070 cases and £576.4 million in losses.
That produces an arresting asymmetry: unauthorised activity accounted for about 94% of cases but only 55% of losses. APP represented around 6% of cases and 45% of losses. The averages were approximately £185 per unauthorised case and £2,324 per APP case. These are derived arithmetic summaries of industry totals, not measures of the typical individual victim’s net loss after reimbursement.
Online remote-purchase card fraud remained the dominant unauthorised category, with 3.2 million cases and £423.5 million in losses. The scale reflects how stolen credentials, compromised one-time passcodes and account-takeover methods can be exploited against ecommerce transactions. It does not mean all UK cardholders or merchants face the same probability of loss.
APP fraud is structurally different. A criminal persuades the customer or business to transfer money. A bank can correctly authenticate that customer and still execute a transaction that benefits a fraudster. That is why beneficiary verification, payment-purpose warnings and transaction-level behavioural indicators sit alongside—and not beneath—strong login controls.
Unauthorised losses fell while social-engineering losses climbed.
The headline fraud total rose in 2025, but the direction of travel differed materially by technique. More attempted transactions were blocked, even as criminals became more effective at persuading people to move money themselves.
Down to £703.4 million, despite cases rising 11%.
Up to £576.4 million; cases rose 7%.
Stopped before loss—about 70p of every £1 of attempted unauthorised fraud.
Criminal activity did not shift neatly from one rail to another. Remote-purchase card fraud losses rose 3% and cases 13%, while lost-and-stolen card fraud fell 2% by value. Remote banking fraud losses fell 27% even though incident counts rose 11%. Contactless losses increased 8% but remained far smaller than remote-purchase losses. These movements argue against treating every digital checkout as if it had the same risk.
The sharper change occurred within APP scams. Purchase fraud generated 71% of APP case counts but £118.1 million in losses. Investment scams accounted for £221.5 million in losses—up 40%—across 14,893 cases, themselves up 26%. The former is a high-volume deception market, the latter a lower-frequency and higher-value loss mechanism. Romance scams rose 23% to £39.2 million across 6,335 cases, while bank-and-police impersonation losses fell 12% and case counts fell 11%.
The geography of initiation matters. UK Finance attributes 66% of APP cases to online origins and 17% to telecommunications. Yet telephone-originated cases accounted for 28% of APP losses compared with 32% for online origins. That difference underscores the danger of interpreting contact volume as financial severity.
One more dataset puts the social harm in perspective: the ONS survey released on 22 October 2026 estimated 4.5 million fraud incidents in England and Wales in the year ending June 2026, up 11% from 4.1 million. That survey measures broader victim-experienced fraud across a different geography and methodology. It is not a more recent replacement for UK Finance’s UK-wide payment-loss total.
Older victims remain prominent in identity fraud, but faster growth is appearing among younger adults.
The UK offers more demographic evidence than many European markets. The limitation is comparability: national victim surveys, industry risk filings and reimbursement data all measure different populations.
Cifas’s first-half 2026 Fraudscape update reports more than 220,000 fraud-risk filings in the National Fraud Database. Identity fraud accounted for 59%, or nearly 130,000 filings. The largest concentration of identified identity-fraud victims was among people aged 61 and over, but the sharpest year-on-year growth was among people aged 21–30: identity-fraud cases in that group increased 32%.
Another category tells a different story. Nearly 13,000 cases concerned money muling, up roughly 70%; 57% of those recorded cases involved people under 30, including 17% under 21. These are mule-account misuse cases, not counts of young people losing money as scam victims. Their importance lies in the infrastructure of fraud: criminals need receiving accounts, and younger account holders appear heavily represented in the recorded misuse group.
The ONS Crime Survey for England and Wales offers a population-based view. Its year-ending March 2026 survey estimated that 7.8% of people aged 16 and over experienced fraud during the preceding year, while the year-ending June 2026 update estimated 4.5 million incidents. The survey measures broader fraud, not exclusively payments. Neither Cifas counts nor an industry loss total should be divided by the UK adult population to infer an age-specific payment-fraud rate.
The Home Office’s 2026–2029 Fraud Strategy also notes that the largest proportions of fraud victims lie in the 45–54 and 55–64 brackets, while the risk to younger people has been increasing disproportionately. It does not provide, in that summary, a uniform 2026 UK payment-fraud loss rate for every age cohort.
The operational conclusion is more nuanced than a single vulnerable-age stereotype: credential theft, account misuse, investment persuasion and social-engineering entry points affect different populations in different ways. Payments firms need to distinguish victim risk from the behaviour of mule accounts and confirmed perpetrators.
The fraud chain begins before the payment instruction reaches the bank.
The UK data identify several pathways that look credible to either the customer or the institution until the payee, order or underlying identity is examined more carefully.
Remote card credentials and one-time passcodes
Stolen card details can be used at an online checkout, while compromised one-time passcodes can support wallet enrollment or fraudulent purchases. A successfully completed authentication step does not automatically establish that the legitimate cardholder initiated the order.
Investment and purchase manipulation
Fake investment opportunities and marketplace purchases lead users to initiate apparently legitimate bank transfers. By the time the paying bank sees the instruction, the persuasive work may already have taken place on a platform, by phone or in private messages.
Invoice interception and supplier-detail changes
Compromised email or impersonated suppliers can replace bank details on an otherwise genuine invoice. A legitimate payer sends money on schedule, but it reaches an account controlled by a criminal. Business accounts lost £75.6 million to APP fraud in 2025—down 11%, while personal-account losses rose 26% to £500.8 million—so firms remain a meaningful target even as the growth is concentrated among consumers.
Account takeover and mule networks
Criminal networks combine stolen identities, compromised accounts and recruited payment receivers. Cifas’s 2026 data show fast growth in account misuse, while its identity-fraud and takeover filings make clear that screening at account opening is only one stage of the problem.
The UK is testing prevention and reimbursement as complementary policy tools.
Reimbursement is important for consumers, but it is not evidence that a merchant can safely relax its own acceptance, fulfilment or beneficiary controls.
The Payment Systems Regulator’s mandatory APP reimbursement regime took effect on 7 October 2024 for in-scope Faster Payments scams, with a maximum reimbursement amount of £85,000 under the relevant regime. The rules focus on qualifying consumers and certain small organisations; they do not automatically reimburse every corporate payment or commercial dispute.
The PSR’s dashboard updated 30 July 2026 found that 88% of the value of eligible reported APP scam losses, or £316 million, had been reimbursed in the 18 months from 7 October 2024 to 31 March 2026. In Q1 2026, 89% of eligible claim value was reimbursed and 82% of claims were closed within five business days.
UK Finance separately reported £354.3 million reimbursed to APP victims during calendar 2025, or 61% of its wider reported APP loss total. Those figures are not inconsistent: the PSR dashboard covers eligible Faster Payments claims over a different observation window, while UK Finance tracks a broader range of payments, cases and accounts. Comparing the percentages without their denominators would make a policy look either more or less effective than the evidence justifies.
Beneficiary name checking is another part of the control architecture. In October 2026 the PSR removed the scheduled expiry of its Confirmation of Payee direction, retaining broad requirements for account-name checks. In its July 2026 consultation, the regulator said more than 320 payment providers offer the service and more than two million checks are completed every day. A name match can reduce certain errors and impersonation scams, but it cannot verify that an underlying investment, marketplace listing or invoice is genuine.
The policy direction is toward stronger identification of suspicious payees and behaviour before funds leave the account, with reimbursement remaining a safety net for qualifying victims rather than the main fraud-prevention strategy.
Build controls around the fraud pathway, not just the payment button.
A UK merchant’s priorities should reflect whether it sells by card, takes transfers, uses recurring billing, or carries large fulfilment and refund exposure. The appropriate operational checks are different.
Screen the whole order
Combine transaction risk, 3-D Secure and account signals with shipping-address changes, velocity and customer history. Retain proof of customer communications, fulfilment and delivery; authentication alone cannot resolve every chargeback.
Freeze unexpected bank changes
Verify changed supplier or customer bank details through a trusted pre-existing channel. Use second-person approval for high-value payments and treat urgency or secrecy as risk signals, not instructions.
Make billing recognisable
Use clear descriptors, transparent renewal and cancellation language, prebilling communications where appropriate and prompt support. Avoid letting preventable confusion become a dispute or fraud allegation.
Keep customers in trusted flows
Do not redirect customers to unverified account numbers in chat. Authenticate payment instructions and warn users when a familiar seller’s payment details unexpectedly change.
Separate fraud and dispute metrics
Track authorisation declines, confirmed fraud, chargebacks, refunds, dispute outcomes and exposure by channel separately. DMS’s chargeback-prevention guidance is a practical companion to the reporting model. A decline in reported card-fraud value is not proof that APP manipulation has diminished.
Document the actual business model
Explain products, fulfilment windows, processing volumes, refund policies and prior chargeback experience consistently. This helps determine which acceptance controls and payment terms are realistic for the business. For cross-border sales, review DMS’s international merchant-account guidance as well.
Secure payment processing with a clearer fraud and chargeback strategy.
Whether your business sells online, charges customers repeatedly or handles higher-value orders, we can review the acceptance model, underwriting concerns and payment controls relevant to your processing application.