Credit card fraud is any unauthorized use of a payment card, or the card details attached to it, to obtain money, goods, or services. That single sentence covers a wide range of tactics, from a physically stolen card to a synthetic identity built specifically to open new lines of credit. For fraud teams, the useful question is rarely “is this credit card fraud,” but rather which category it falls into, because the category determines how it gets detected and stopped.
What counts as credit card fraud?
Credit card fraud constitutes any transaction, application, or account action carried out using card information the true cardholder didn’t authorize, including unauthorized purchases on an existing account, new accounts opened in someone else’s name, and cards obtained or created using entirely fabricated identity details.
The Federal Trade Commission’s Consumer Sentinel Network, which collects consumer fraud and identity theft reports across the United States, recorded more than 1.1 million identity theft reports in 2024, and credit card fraud, including new and existing accounts, was consistently among the largest categories within that total. Fraud teams should treat that volume as a baseline expectation, not an anomaly: card fraud is a constant, evolving pressure on any business that accepts card payments.
Card-not-present versus card-present fraud
The industry separates credit card fraud into two broad categories based on how the transaction occurs.
Card-present (CP) fraud happens when a fraudster has the physical card, whether stolen, counterfeited, or skimmed at a point-of-sale terminal or ATM. EMV chip technology has significantly reduced this category in markets where it is widely adopted, since a cloned magnetic stripe cannot authenticate the way a chip can.
Card-not-present (CNP) fraud is any type of credit card fraud that doesn’t require a physical card being stolen, as the name suggests. It can happen online, over the phone, or by mail, where the merchant never sees or swipes the physical card. This is now the dominant category by volume for most digital businesses, since a fraudster only needs the card number, expiration date, and security code, not the card itself, to attempt a purchase. According to the Nilson Report, the leading trade publication covering the global payment card industry, worldwide payment card fraud losses totaled $33.41 billion in 2024, and the United States, which accounts for roughly a quarter of global card volume, absorbed close to 42% of those losses. Additionally, they projected earlier this year that fraud losses will reach $41.06 billion by 2030, which would tie it to total card volume of $70.731 trillion. Over the next 10 years, cumulative card fraud losses are projected to reach $407.60 billion.
Common types of credit card fraud
Fraud teams will encounter a few different recurring patterns, including:
- Stolen or lost card fraud: When a physical card is used without the owner’s knowledge, typically before the loss is reported.
- Card skimming and cloning: Involve capturing card data at a compromised terminal or ATM, then encoding it onto a counterfeit card or using it for CNP purchases.
- Account takeover: Happens when a fraudster gains access to an existing cardholder’s online account, often through credential stuffing or phishing, and either makes unauthorized purchases or adds a new card under their own control.
- Synthetic identity fraud: This occurs when a fraudster combines a real Social Security number with fake details like a fabricated name, date of birth, and address details to build a credit profile that passes standard identity checks.
- Card testing: A reconnaissance tactic, where a fraudster runs small, low-value transactions across many different cards, often stolen in bulk from a data breach, to confirm which numbers are still active before attempting larger purchases.
Why credit card fraud is costly beyond the direct loss
The direct dollar amount stolen is only a part of the cost. Every single fraudulent transaction that results in a chargeback carries a dispute fee, and repeated chargebacks often push a merchant over a card network’s allowable fraud threshold, risking the ability to process card payments at all.
Security.org’s 2026 consumer survey found that Americans’ experience of credit card fraud has continued rising year over year, and that nearly 80% of respondents believe fraud has increased in recent years, with 37% describing the increase as significant. That perception matters for fraud teams because it shapes customer tolerance. Consumers who already expect fraud to be common are quicker to dispute a legitimate charge that they don’t immediately recognize, adding first-party fraud (also known as friendly fraud), which are disputes filed by the actual cardholder, on top of true third-party fraud.
That combo puts pressure on fraud teams from two directions at once. Third-party fraud requires stronger detection at the point of transaction, while first-party fraud requires better documentation and representment processes to contest disputes that should never have been filed in the first place. Treating the two as the same problem, and applying the same controls to both, tends to produce worse outcomes than addressing each on its own terms.
How fraud teams detect and prevent credit card fraud
Detecting credit card fraud works best by combining several different layers together, rather than relying on any single check.
Address Verification System (AVS) and Card Verification Value (CVV) checks confirm that the billing address and security code match what the issuing bank has on file, catching a meaningful share of basic CNP fraud attempts.
Device and behavioral signals, such as device fingerprinting, typing patterns, and navigation flow, help distinguish a legitimate cardholder from someone using stolen credentials on an unfamiliar device.
Velocity checks flag unusual patterns, such as the same card attempting multiple purchases in a short window, or many different cards being tested against the same merchant account in rapid succession, a common sign of card testing.
Machine learning models, trained on historical transaction data, weigh all of these signals together to produce a risk score for each transaction, allowing fraud teams to approve low-risk purchases automatically while routing higher-risk activity to manual review or step-up verification, such as 3-D Secure or a one-time passcode.
No single control catches every pattern. The most resilient fraud programs layer these defenses and revisit them regularly, since fraud tactics shift as fast as the controls meant to stop them.
If your team needs help with identifying and stopping credit card fraud before it results in chargeback fees for your business, then consider using Sift. Request a demo today or check out our additional resources on payment fraud.
Frequently asked questions
What is the difference between credit card fraud and identity theft?
Credit card fraud is a form of identity theft that specifically involves the misuse of card account information, whether an existing account or a new one opened fraudulently. Identity theft is the broader category, which also includes things like tax fraud, medical identity theft, and government benefits fraud that have nothing to do with a credit card.
How is credit card fraud usually discovered?
Cardholders often notice it first, through an unfamiliar charge on a statement or a fraud alert from their bank. Issuers and merchants also run continuous transaction monitoring that can flag suspicious activity, like an unusual purchase location or a sudden spike in spending, before the cardholder ever sees it.
Can credit card fraud be fully prevented?
No single measure eliminates it entirely, but layered defenses like AVS and CVV checks, device and behavioral analysis, and machine learning based risk scoring, substantially reduce both the volume of fraud that succeeds and the manual review burden on fraud teams.
