Which? reports card-not-present fraud hit record case volumes and losses in 2025

Card-not-present fraud, meaning unauthorised remote purchases made over the internet, phone or mail order, reached record case volumes in 2025, according to a Which? report published on 18 June 2026. Case volume rose 13% year-on-year to 3.2m, and losses rose 3% to £423.5m¹.

Which? describes card-not-present fraud as having "long been the main culprit" and says online security checks such as one-time passcodes and banking app verification briefly deterred fraudsters before volumes climbed again¹. The report states that 14% of UK adults have been affected by card fraud in the past two years, rising to 20% among 25-to-34-year-olds, based on a survey of 2,079 members of the public conducted online in March 2026¹. Among those affected, 25% cited fake adverts on social media, 21% search engines and 18% phishing emails, while 25% said they did not know how the fraud occurred¹.

The report also points to the role of overseas firms in processing online card fraud. It says 75% of card-not-present fraud linked to online sales was processed by overseas merchant acquirers in 2024, the financial firms that enable businesses to accept credit and debit cards, and that UK Finance told Which? this increased to 77% in 2025¹. Reports estimate that 142m stolen card records were posted for sale on the dark web in 2025¹.

Which? traces the shift to remote fraud to the launch of Chip and Pin in 2006, after which criminals turned to using stolen card details remotely, helped by the growth in online shopping¹. It notes that the Home Office recently announced plans to repeal technical standards for strong customer authentication to "support the adoption of new technologies" and enable firms to apply "proportionate, risk-based measures for low-risk transactions"¹.

Why it matters for households

The figures cover fraud on cards in 2025, so they describe losses already incurred rather than a change taking effect from a future date. The survey finding that 14% of UK adults have been affected in the past two years indicates how widely card fraud is spread across households, with a higher share among 25-to-34-year-olds at 20%¹.

For anyone whose card details are used remotely, the report says refunds are not guaranteed where banks and other payment firms treat a payment as authorised, including cases where consent was obtained through misleading adverts or other tactics¹. It also sets out how details can be compromised without the cardholder's involvement, including data breaches, skimming devices at ATMs, and malware on browsers, websites and point-of-sale systems¹. The report lists five tactics it says cardholders may encounter: Sim swap, cloning, subscription scams, digital wallet scams and SMS scams¹.

The share of online card-not-present fraud processed by overseas merchant acquirers, 77% in 2025, is relevant to where a disputed payment is handled, because the firm processing the transaction may sit outside the UK¹. Which? reports that scammers obtain a series of merchant accounts across different markets and switch between them to avoid hitting thresholds that might lead to them or their acquirer being banned¹.

What happens next

The Home Office has announced plans to repeal the technical standards behind strong customer authentication, according to the report, which says the change is intended to support new technologies and allow proportionate, risk-based measures for low-risk transactions¹. No date for that change is given in the report.

Which? says banks are using machine learning models to assess the likelihood that transactions are safe and to detect suspicious activity as it happens, and quotes Jim Winters, Nationwide's director of economic crime, on monitoring test transactions¹. It also quotes Mike Nathan of LexisNexis Risk Solutions saying cybercriminals are "channel agnostic" and attack the whole ecosystem¹. Further detail on how firms will apply the proposed risk-based measures has not been reported.