Payments Fraud in the United States 2026: Cards, Scams and the Cost of a Trusted Transaction
America has a vast card economy, a high-value ACH system and an increasingly industrialized scam economy. The most revealing 2026 evidence is not one national fraud number: it is the widening gap between what payment rails record, what victims report and who ultimately bears the cost.
A Card Economy That Moves Most of Its Money Through Accounts
America's largest payment rail depends on the unit of measurement. Cards dominate transaction counts; ACH dominates dollars. The distinction defines both payment risk and the practical limit of any single fraud statistic.
The Federal Reserve's 2025 Payments Study, released in July 2026, estimates 236.6 billion noncash payments worth $140.01 trillion in 2024, covering card payments, ACH transfers and checks. Of those transactions, 187.7 billion were card payments, 39.7 billion were ACH and 9.2 billion were checks. Wire transfers are excluded, while cash usage is tracked separately. Consequently, these figures must not be described as the entire U.S. payments universe.
Cards accounted for around 79% of the number of noncash transactions but only about 8% of their value. ACH accounted for 74% of payment value, at $104.06 trillion. Within cards, debit volumes reached 120.6 billion and credit volumes 67.1 billion—yet by value credit cards carried $6.51 trillion against debit's $4.99 trillion. This is an economy in which small purchases move through cards while payroll, supplier settlement, consumer bill payments and many higher-value transfers operate through bank accounts.
The Federal Reserve’s 2026 Diary of Consumer Payment Choice examines households, rather than the payment-industry universe. It found that debit and credit cards together made up about two-thirds of consumers' 2025 transactions, while cash accounted for roughly one in eight (about 6 of every 47 monthly payments). It is a useful behavioral complement, but not the same statistical denominator as the 236.6 billion payments above.
Digital wallets complicate how an observer labels the purchase. A tap using a phone can be a card transaction, and a bank-authenticated transfer can still originate with a deceptive invoice. Risk classification should begin with the underlying payment instrument, transaction context and dispute rights—not the appearance of the checkout button.
Three Data Systems, Three Different Answers to “How Much Fraud?”
The Federal Reserve records payment-system fraud within defined networks. The FTC collects consumer scam reports. FBI IC3 collects complaints about internet-enabled crime. Their numbers overlap, but they are not interchangeable.
In March 2026 testimony, the FTC said consumers had filed about 3 million fraud reports documenting $15.9 billion in 2025 losses, versus approximately 2.6 million reports and more than $12 billion in 2024. The largest 2025 loss category was investment fraud at $7.9 billion, while impostor scams generated over $3.5 billion.
The FBI's 2025 IC3 annual report recorded 1,008,597 complaints and $20.877 billion in reported internet-crime losses, 26% higher than in 2024. Within that broader population, the FBI separately identifies 452,868 cyber-enabled fraud complaints with $17.697 billion in losses. These are overlapping cuts within IC3, not additional amounts to stack on top of its overall total.
By contrast, the Federal Reserve's December 2025 biennial debit-card report analyzes transaction fraud for 2023. In its covered-issuer sample, fraud losses represented 17.6 basis points of covered issuers' debit transaction value, equivalent to $17.63 per $10,000 transacted. This is a payment-system fraud loss rate, restricted to covered issuers and debit transactions. It is not a 2025 U.S.-wide card, credit, ACH or wire fraud rate.
The composition of losses is as revealing as their total. For 2023 fraudulent debit transactions in the covered sample, merchants absorbed 49.9% of reported fraud losses, issuers 28.3%, and cardholders 21.8%. The merchant share reached 65.1% for card-not-present fraud specifically. Those proportions describe allocated losses in the source's specified population, not a universal chargeback liability rule.
Scam Losses Rose as Remote-Card Fraud Maintained Pressure
The strongest 2026 signal is the escalation of manipulated payments, while the most recent published debit-card risk analysis shows an older, still-relevant shift toward remote transactions.
The FTC's consumer-reported losses reached $15.9 billion in 2025, up about 27% from the $12.5 billion reported for 2024. The agency documented more than $3.5 billion of impostor-scam losses, many beginning with fake security alerts, financial-institution impersonation or instructions to move money to protect an account. Impostor scams were the most-reported fraud category for the fifth straight year. Its June 2026 update says people reported impostor scams more often than any other fraud category.
Another $2.1 billion was reported lost in 2025 to scams where the initial contact occurred on social media, according to FTC research published April 2026. These are contact-channel observations; they do not establish which final payment instrument was used, and do not imply that social platforms processed the money.
For the FBI, investment fraud caused $8.65 billion of reported losses in 2025 and business email compromise (BEC) caused $3.05 billion. Their prevalence varies enormously by measurement: phishing generated 191,561 complaints but only $216 million in losses, while BEC's 24,768 complaints produced $3.05 billion. These FBI categories are an alternative classification to the FTC categories, not parts of an additive nationwide reconciliation.
The Kansas City Fed’s February 2026 analysis describes a different but important trend: among non-prepaid debit transactions, card-not-present fraud rates increased on both dual-message and single-message networks through 2023. The card-present rate fell for dual-message networks between 2021 and 2023, but rose for single-message networks. The single-message card-not-present rate rose by more than 10 basis points and, for the first time, exceeded the dual-message rate. A merchant shouldn't mistake this 2026 publication date for 2026 incident data.
For businesses, the convergence of these risks is operational. A remote ecommerce order can be fraudulent despite strong checkout controls; conversely, a completely legitimate bank transfer can carry funds to a criminal because the payer's invoice and beneficiary record were changed before authorization.
More Than a “Seniors Are Vulnerable” Story
Older adults tend to report larger losses when harmed, but the relationship between fraud reporting, actual monetary loss, and exposure differs by age. The U.S. has unusually useful direct age-level loss data.
The FTC's October 19, 2026 report, Protecting Older Consumers 2025–2026, presents median losses from consumer fraud reports for 2025. Among loss-reporting consumers, median losses rose from $305 at ages 20–29 to $1,000 at ages 70–79 and $2,000 at ages 80 and over. An FTC median describes the midpoint of reported losses for people in the age group who lost money; it is not an incidence rate or the average loss of every American in that age group.
Risk is not simply higher at every age. The FTC also found that adults 60 and older reported losing money to fraud at a 14% lower population-adjusted rate than adults aged 18–59, despite experiencing larger median losses among those who did lose money. Older adults also reported avoiding a loss at higher population-adjusted rates: 74% of their fraud reports involved no monetary loss. Even so, reported losses among adults 60 and older rose to about $3 billion in 2025, from $2.4 billion, with a median loss of about $900. Taken together, these figures argue against broad age-based stereotypes.
The FBI's 2025 IC3 figures provide a second and distinct view. The 201,266 complaints from people aged 60 and older documented $7.75 billion in reported losses, more than any other listed age group. People aged 40–49 generated 167,066 complaints and $2.96 billion in reported losses. These are complaint totals, not per-capita victimization rates, and unknown-age complaints mean the age subtotals do not exhaust the FBI's total.
The fraud type also matters. The FTC found older adults were 324% more likely than younger adults to report losing money to tech-support scams, while younger adults' losses were spread more across other scam types. Payment controls should therefore respond to the transaction and deception mechanism rather than treating date of birth as a fraud score.
Five Ways the Fraud Enters the Payment Chain
Each mechanism compromises a different control. Treating all of them as “unauthorized transactions” obscures both cause and responsibility.
Stolen card details and automated account testing
Fraudsters submit stolen credentials against ecommerce checkout, run enumeration attempts, or exploit established customer accounts. Card authentication, the authorization decision and the actual buyer’s identity are related but not identical. The Fed’s newest detailed debit data show that card-not-present fraud rates remained a major challenge through 2023.
Business email compromise and beneficiary substitution
A genuine invoice may be altered by a compromised mailbox, or a believable message may impersonate a finance executive. Employees approve payment willingly, but to the wrong recipient. FBI IC3 recorded more than $3 billion in BEC losses in 2025.
Bank security alerts and “safe account” instructions
Fake investigators or security teams persuade consumers to move funds themselves. A successful account login or one-time code may validate the instruction but cannot establish the caller’s legitimacy. The FTC's 2025 impostor-scam losses exceeded $3.5 billion.
Investment deception through messaging and social networks
Criminals buy advertising, impersonate acquaintances or cultivate trust before showing fictitious investment returns. The money can subsequently move by bank transfer, card, payment app or cryptocurrency; the social channel describes the origin of contact, not the payment rail.
First-party disputes, refund friction and descriptor confusion
Not every chargeback is an outside criminal using stolen credentials. Subscription misunderstandings, delayed fulfillment, unrecognized descriptors and refund disputes can create losses and network-monitoring exposure even when initial authentication was valid. DMS’s chargeback-prevention guide covers the evidence and customer-service practices that reduce avoidable disputes.
A useful fraud-control architecture begins before funds move, continues through authentication and beneficiary verification, and remains active during fulfillment and disputes.
2026 Moved Prevention Responsibilities Further Upstream
Nacha expanded ACH fraud-monitoring duties. Visa tightened merchant monitoring. Neither change turns every suspicious payment into a legally proven fraud, and both require operational discipline rather than a checkbox.
ACH monitoring. Nacha’s risk-management amendments took effect in two phases during 2026. The March 20 phase applied to all originating depository financial institutions (ODFIs), large non-consumer originators and related service providers, and large receiving depository institutions (RDFIs). The remaining covered non-consumer originators, third-party participants and RDFIs entered the second phase with a practical compliance date of June 22, 2026, following the June 19 holiday.
The changes direct covered parties to establish risk-based procedures reasonably intended to identify ACH entries that are unauthorized or authorized under false pretenses; relevant procedures must be reviewed at least annually. These requirements are not the same as a guarantee that all ACH credits will be automatically screened in real time, and they do not apply identically to consumer originators.
Card network thresholds. Under Visa’s published VAMP fact sheet, the U.S. excessive-merchant VAMP ratio threshold declined from 220 to 150 basis points on April 1, 2026, with the fact sheet additionally identifying a minimum 1,500 combined fraud-and-dispute count for the specified region. The VAMP ratio is count-based: relevant fraud and dispute events divided by settled transactions, subject to Visa's eligibility rules and exclusions. Threshold monitoring should be checked against acquirer communications and current Visa rules for the account in question.
Network monitoring is not synonymous with the legal burden of proof in an individual card dispute. A merchant can have a strong antifraud program and still breach a network ratio because of unclear recurring billing, weak customer service or a wave of refund-related disputes. Merchants need event-level diagnostics, not only a monthly overall chargeback percentage. DMS’s Visa VAMP explainer adds merchant-facing context on the count-based formula.
Loss allocation. The Federal Reserve's debit issuer evidence shows that merchants bore a substantial share of covered-issuer card-not-present fraud losses in 2023. Its 2026 Kansas City Fed analysis reinforces that payment security and allocation trends vary by card-present versus remote transactions and by dual-message versus single-message debit networks. A single generalized U.S. card-fraud statistic would erase those differences.
Enforcement and reporting. The FTC and FBI continue to publish consumer and internet-crime intelligence, but neither is a transaction-reconciliation feed for a payment processor. Merchants should maintain their own authorization, decline, fraud, fulfillment, dispute and refund records, preserving the distinct dates, populations and event definitions.
Six Controls Worth Prioritizing Before Another Fraud Report Arrives
U.S. merchants should connect checkout defenses to finance-team procedures and post-sale dispute records. Different attack surfaces demand different stop points.
Card-Not-Present Checkout
Priority: Monitor fraud-coded authorizations and disputes by device, BIN, geography, account age and fulfillment timing. Use risk-based 3-D Secure and keep delivery evidence. Distinguish account takeover from first-party return and refund disputes.
ACH-Paying Businesses
Priority: Review responsibilities under the 2026 Nacha rules with your ODFI and vendors. Monitor unusual beneficiary changes and payment velocity; build a record of reviews, interventions and annual control updates.
Accounts Payable
Priority: Verify bank-detail changes out of band with known vendors, use segregation of duties and require additional approval for unusual large transfers. Do not let an apparently legitimate email thread defeat the payment approval chain.
Subscription and Membership Merchants
Priority: Keep recurring pricing, cancellation terms and the descriptor clear before authorization. Track service complaints and customer-initiated disputes separately from unauthorized activity so Visa monitoring does not become a surprise.
High-Risk and Cross-Border Sellers
Priority: Document monthly volume, average ticket, return policy, fulfillment timing, sales geographies, chargeback history and previous processing treatment when preparing to secure a high-risk merchant account or international merchant account. Controls should be demonstrable to underwriting.
Risk Reporting and Escalation
Priority: Publish an internal dashboard that separates attempted fraud, unauthorized cleared transactions, confirmed chargebacks, refund disputes, net merchant losses and employee-authorized payments to scammers. Reconcile each event to source systems and preserve timestamps.
Secure Payment Processing Without Losing Sight of Fraud Exposure
Card disputes, ACH risk, payment holds and underwriting documentation become harder to manage as sales channels expand. Durango Merchant Services evaluates how your business sells, bills, fulfills orders and handles disputes before helping you establish an appropriate processing arrangement.