Card fraud in Europe declined notably in 2021 amid the implementation of regulatory measures

• In 2021, card fraud as a share of the total value of payments using cards issued in SEPA was at its lowest level (0.028%) since the Eurosystem started to collect such information from card payment schemes in 2008
• After decreasing by 8% in 2020, the value of overall card fraud^[1] declined by 11%^[2] in 2021
• The value of card-not-present fraud declined by 12% in 2021 in light of the market-wide implementation of strong customer authentication
• Card-present fraud in the form of using counterfeit cards at shops and ATMs declined by 37% in 2020 and by 42% in 2021, as the global roll-out of industry standards almost eradicated such fraud
• For cards issued in SEPA, cross-border transactions accounted for 63% of the total value of card fraud in 2021

1 Introduction

In its role as overseer of card payment schemes operating in the euro area, the Eurosystem closely monitors developments in card fraud. Statistical information on the volumes and values of card transactions and corresponding fraud is collected on these schemes^[3] for all countries in the Single Euro Payments Area (SEPA) and in aggregate for all countries outside SEPA.^[4]

This report presents some general developments relating to card fraud in 2020 and 2021, in aggregated form without mentioning specific countries. Unless stated otherwise, the results presented are generally derived from “an issuing perspective”, which refers to payments made with cards issued within SEPA and acquired worldwide. As with previous analyses of the collected data, a few methodological issues continue to apply; these are detailed in the annex. Since these issues are limited to a few specific schemes and countries, they have been accepted for the present analysis.

2 Level of card fraud

The total value of transactions using cards issued in SEPA amounted to €5.40 trillion in 2021, of which €1.53 billion (0.028%) was fraudulent (see Chart 1a).

After both the value of overall card payments and the value of card fraud had shown similar year-on-year declines in 2020 amid the start of the coronavirus (COVID-19) pandemic (-6.9% and -7.7% respectively), this similarity ceased in 2021. The value of overall card payments recovered in 2021, increasing sharply compared with 2020 (+12.3%).

Meanwhile, the value of card fraud continued its steep decline in 2021, dropping by 11.2% compared with the previous year. Consequently, fraud as a share of the total value of transactions declined notably in 2021 to 0.028% (from 0.036% in 2020). This marked the lowest fraud share recorded since the start of data collection in 2008. For cards issued in the euro area, the value of fraud as a share of total card transactions in 2020 and 2021 remained below the respective share for cards issued in SEPA as a whole, at 0.034% and 0.026% respectively.

The total number of fraudulent card transactions declined in 2021 to 23.85 million (-7%), after having steadily increased in previous years (see Chart 1b).^[5] In relative terms, card fraud volumes as a share of the total number of card payments decreased from 0.026% in 2020 to 0.021% in 2021. Overall, fraud shares in terms of volumes continued to remain considerably below the corresponding figures for values in both 2020 and 2021.

Chart 1

Total value and volume of card fraud using cards issued within SEPA

3 Developments in card-not-present and card-present fraud

Card fraud in 2021 declined in terms of both card-present transactions (at Automated Teller Machines (ATMs) and Point-of-Sale (POS) terminals) and card-not-present (CNP) transactions (e.g. via the internet).

As in previous years, the vast majority of card fraud related to CNP transactions (see charts 1a and 1b). In both 2020 and 2021, CNP fraud accounted for approximately 84% of the total value of card fraud. This share had been growing steadily until 2020, in line with the continuously increasing importance of e-commerce and the use of card payments over the internet. The higher share also reflects the effectiveness of various fraud prevention measures in reducing card-present fraud at POS terminals and ATMs.

In 2021 the total value of CNP fraud amounted to €1.28 billion (see Chart 2), showing a strong decline compared with 2020 (-12.1%). The majority of CNP fraud continued to take place across borders (i.e. the transaction was acquired in a country other than the country where the card was issued), with the largest share relating to cross-border transactions within SEPA. The overall decline in the total value of CNP fraud was driven by a notable decrease in fraud among transactions acquired within SEPA (domestic and cross-border transactions combined). The value of fraudulent CNP transactions acquired outside SEPA increased in 2021.

The strong decline in CNP fraud for transactions acquired within SEPA in 2021 points to a beneficial impact of the Regulatory Technical Standards for strong customer authentication and common and secure open standards of communication (hereafter “RTS for SCA and CSC”) under the revised EU Payment Services Directive (PSD2).^[6] The market-wide implementation of these enhanced security standards by payment service providers ahead of 31 December 2020 seems to have notably increased the security of CNP transactions.

Chart 2

Value of CNP fraud by geographical breakdown

(total value of CNP fraud in EUR millions)

Card-present fraud committed at ATMs and POS terminals continued to decline in 2021 (-6.4%), following a decrease of 27.7% in the previous year. The value of ATM fraud amounted to around €74 million in 2021 (-4.3% compared with 2020); the value of card fraud at POS terminals amounted to €177 million (-7.2%; see Chart 3).

The decrease in the value of ATM fraud in 2021 was driven by a further strong decline in counterfeit card fraud (-67.3%), which only accounted for 3% of total ATM fraud. Similarly, the overall decline in card-present fraud at POS terminals in 2021 was due to a 38.9% reduction in counterfeit card fraud, while other types of fraud in card-present transactions increased in value and should be monitored closely in the coming years. This shows that the increased global roll-out and maturity of EMV terminals has been effective in reducing opportunities for committing magnetic stripe counterfeit fraud. Consequently, occurrences of fraud using counterfeit cards seem to be becoming less common, particularly with regard to ATM cash withdrawals.

Losses from lost or stolen cards continued to be the main type of card-present fraud, accounting for 88% of all ATM and 56% of all POS fraud in 2021. Only a minor share of card fraud conducted at ATMs was due to other types of card-present fraud, while these continued to play a more significant role at POS terminals.^[7]

Chart 3

Value of card-present fraud at ATMs and POS terminals by category

(total value of card-present fraud in EUR millions)

4 The geographical breakdown of card fraud

The majority of card fraud in both 2020 and 2021 continued to involve cross-border transactions. While cross-border card transactions represented 11% of the overall value of card payments in 2021, they accounted for 63% of the value of card fraud (see charts 4a and 4b).

In the years leading up to 2020, cross-border transactions both within and outside SEPA grew at a faster pace than domestic card payments, indicating that cardholders increasingly purchase goods and services across borders at physical or e-commerce merchants, as well as an increase in the cross-border issuing of cards. In 2020 the share of cross-border transactions in the overall value of card payments declined slightly, as they appeared to be more heavily impacted by the COVID-19 pandemic. In 2021 the value of card payments increased again across all geographical categories, with particularly strong growth in cross-border transactions acquired within both SEPA (+25.5%) and non-SEPA countries (+21.6%).

Chart 4

Value of card payment transactions and fraud by geographical dimension

Turning to the geographical breakdown for card fraud, the total value of domestic and cross-border fraud for transactions acquired within SEPA declined by 9% and 16% respectively in 2021 (compared with a decline of around 4% in both cases in 2020). Meanwhile, the value of fraud for transactions acquired outside SEPA increased by 6% in 2021, following a decline of around 30% in 2020. However, this increase was more than outweighed by the aforementioned general uptake in cross-border payments acquired outside SEPA. Consequently, relative fraud shares declined across all geographical dimensions in 2021.

The total value of fraud by issuing country declined in 2021 for 20 EU Member States, while increases for the remaining 7 Member States were minor. In relative terms, fraud shares in terms of value declined across 26 Member States. For the one remaining Member State, fraud as a share of the total value of card payments remained roughly unchanged between 2020 and 2021 and was already at a relatively low level (0.009%).

5 Outlook

The overall outlook for card fraud in Europe appears to have further improved. The market-wide implementation of the RTS for SCA and CSC appears to have strongly reduced the occurrence of card fraud in 2021, both in absolute and relative terms. A steep decline is registered in CNP fraud, due to the widespread adoption of the 3D Secure standard to support strong customer authentication, as required by the RTS for SCA and CSC. In addition, the global implementation of the EMV standard continued to reduce opportunities for card-present fraud using counterfeit cards.

Nevertheless, industry, regulators and consumers need to remain vigilant. 2020 and 2021 were exceptional years, with the COVID-19 pandemic and the related measures (e.g. lockdowns) having a notable impact on both card payments and fraud; among other factors, both international travel and the cross-border use of cards were limited by the pandemic. Furthermore, the aforementioned success of both industry and regulatory measures in reducing card fraud may shift the attention of fraudsters towards card holders, potentially further increasing fraud through social engineering (e.g. by manipulation of the payer) or the theft of physical cards.

Future analysis of newly available data – due to the recent change in the reporting framework – might provide an even clearer picture of emerging issues and offer further insights into the impact of the current implementation of PSD2-related measures.

ANNEX: Methodological considerations

Two methodological data issues already identified in previous analyses continue to apply, namely that some card payment scheme operators (i) allocate transactions with cards issued cross-border to the country of issuance as opposed to the location of the issuer, and (ii) allocate CNP transactions acquired cross-border by location of the acquirer instead of by location of the merchant. These divergences result in inconsistencies between data collected from the card payment schemes and similar data reported by payment service providers for ECB Statistical Data Warehouse purposes.

In addition, some adjustments have been made to data reported to avoid double counting domestic transactions where cards are co-badged. For a few countries, such as France, these adjustments may result in the under-reporting of total transactions and thus give a slightly over-estimated fraud rate.

Given that these inconsistencies are limited to a few specific schemes and countries, they have been accepted for this analysis.