Online card fraud cost businesses an estimated $23 billion last year. Phishing and social engineering continue to be primary triggers for the credential theft that enables it.
Key Takeaways
- 36% of breaches in the 2024 Verizon DBIR involved web application attacks (common vector for card theft via skimming or form compromise)
- 33% of card fraud attempts are attributed to card testing/credential stuffing patterns in 2023 across online channels (industry threat intel summary)
- 28% of consumers said they had experienced at least one type of fraud in the past year in the 2024 LexisNexis “Risk of Fraud” consumer survey
- 8.0% of consumers reported credit card theft/fraud as the type of fraud they experienced most frequently in the 2023/2024 UK Chartered Trading Standards Institute (CTSI) consumer report (ATM/card-related theft category)
- 31% of fraud cases involved fraudsters using stolen identity or false credentials (ACFE Report to the Nations 2024)
- 24% of organizations reported increased customer churn after a data breach (affects payment brand and customer trust)
- $1.2 million average annual cost of chargebacks for merchants with $10–50 million in revenue (chargeback management industry estimate)
- €1.7 billion total chargeback-related losses in Europe (payments industry estimate reported in trade publications referencing card networks)
- $23.0 billion estimated losses worldwide from online card fraud in 2023 (Nilson Report estimate as cited by multiple trade sources)
- $5.2 billion global fraud detection and prevention market size in 2023 (industry market research estimate, payment fraud applications)
- $7.7 billion global payment security market size in 2023 (industry market research estimate for card payment security controls)
- 2FA reduces account takeover success rates by 50% to 99% (NIST Special Publication 800-63B referenced by NIST guidance)
- 39% of organizations reported using API security controls to reduce fraud and account compromise exposure
- 23% of organizations in a 2023 survey reported using tokenization for payment data to reduce card theft impact
- 32% of consumers reported that they were tricked by phishing or social engineering attempts (common precursor to online card theft)
Online card theft is driven by phishing and credentials, causing billions in losses, churn, and chargeback disputes.
Related reading
01 · Category
Attacker Methods2 stats
01
36% of breaches in the 2024 Verizon DBIR involved web application attacks (common vector for card theft via skimming or form compromise)
02
33% of card fraud attempts are attributed to card testing/credential stuffing patterns in 2023 across online channels (industry threat intel summary)
Interpretation
Attacker Methods Interpretation
For the attacker methods behind online credit card theft, web application attacks account for 36% of 2024 breaches while 33% of 2023 online card fraud attempts show card testing and credential stuffing patterns, indicating that criminals are largely exploiting both compromised forms and automated credential probing.
02 · Category
Fraud Prevalence3 stats
01
28% of consumers said they had experienced at least one type of fraud in the past year in the 2024 LexisNexis “Risk of Fraud” consumer survey
02
8.0% of consumers reported credit card theft/fraud as the type of fraud they experienced most frequently in the 2023/2024 UK Chartered Trading Standards Institute (CTSI) consumer report (ATM/card-related theft category)
03
31% of fraud cases involved fraudsters using stolen identity or false credentials (ACFE Report to the Nations 2024)
Interpretation
Fraud Prevalence Interpretation
For the Fraud Prevalence angle, the data suggests online credit card theft is a persistent issue, with 8.0% of UK consumers reporting it as the most frequent fraud and 31% of fraud cases involving stolen identities or false credentials, reinforcing that identity misuse is a key driver.
03 · Category
Impact & Cost3 stats
01
24% of organizations reported increased customer churn after a data breach (affects payment brand and customer trust)
02
$1.2 million average annual cost of chargebacks for merchants with $10–50 million in revenue (chargeback management industry estimate)
03
€1.7 billion total chargeback-related losses in Europe (payments industry estimate reported in trade publications referencing card networks)
Interpretation
Impact & Cost Interpretation
Under the Impact & Cost framing, the damage from online credit card theft is both immediate and expensive, with 24% of organizations seeing increased customer churn after breaches and merchants facing about $1.2 million in average annual chargeback costs, while Europe totals €1.7 billion in chargeback-related losses.
04 · Category
Market Size6 stats
01
$23.0 billion estimated losses worldwide from online card fraud in 2023 (Nilson Report estimate as cited by multiple trade sources)
02
$5.2 billion global fraud detection and prevention market size in 2023 (industry market research estimate, payment fraud applications)
03
$7.7 billion global payment security market size in 2023 (industry market research estimate for card payment security controls)
04
$8.8 billion global identity verification market size in 2023 (used to stop account takeover and card theft)
05
$3.7 billion global bot management market size in 2023 (online card theft via bots/automation)
06
$3.4 billion global chargeback management software market size in 2023 (relevant to card fraud disputes)
Interpretation
Market Size Interpretation
For the Market Size perspective, the scale of online credit card theft is reflected in the $23.0 billion worldwide losses in 2023, while the surge in related spend shows growing defensive demand with fraud prevention at $5.2 billion and payment and identity security rising to $7.7 billion and $8.8 billion respectively.
More related reading
05 · Category
Detection & Prevention3 stats
01
2FA reduces account takeover success rates by 50% to 99% (NIST Special Publication 800-63B referenced by NIST guidance)
02
39% of organizations reported using API security controls to reduce fraud and account compromise exposure
03
23% of organizations in a 2023 survey reported using tokenization for payment data to reduce card theft impact
Interpretation
Detection & Prevention Interpretation
For Detection and Prevention, the clearest trend is that stronger controls can sharply cut online credit card theft risk, with 2FA reportedly reducing takeover success by 50% to 99% and a meaningful share of organizations adopting measures like API security (39%) and tokenization (23%) to limit fraud and compromise.
06 · Category
Customer & Behavior6 stats
01
32% of consumers reported that they were tricked by phishing or social engineering attempts (common precursor to online card theft)
02
24% of consumers reported using the same password across multiple sites (increasing the likelihood of credential reuse leading to card theft)
03
56% of consumers said they have experienced unauthorized transactions or fraud on their payment accounts (global consumer survey; affects card theft remediation behavior)
04
38% of consumers reported that they did not recognize a charge and initiated a dispute (chargeback behavior relevant to online card theft)
05
58% of consumers report they frequently shop on mobile devices (mobile-first fraud attack surface)
06
1 in 3 consumers reported having their card details stolen at least once in their lifetime (survey-based statistic; impacts prevalence)
Interpretation
Customer & Behavior Interpretation
From a customer and behavior angle, the data shows that risky habits and experiences cluster together, with 32% tricked by phishing and 24% reusing passwords, while 56% report payment fraud and 1 in 3 have had card details stolen at least once.
07 · Category
Threat Techniques1 stats
01
In the 2024 ENISA Threat Landscape for 2024, phishing remains one of the most common cyber threats in Europe, reflecting its continued use to obtain credentials enabling online payment fraud.
Interpretation
Threat Techniques Interpretation
In the 2024 ENISA Threat Landscape, phishing continued to be one of Europe’s most common cyber threats, underscoring that this threat technique remains a leading driver of online credit card theft attempts.
08 · Category
Controls & Mitigation2 stats
01
In the 2023 ISO/IEC 27002 guidance update, authentication controls are emphasized as key measures to prevent unauthorized access that can lead to payment fraud and card theft.
02
In the U.S. Federal Trade Commission (FTC) 2024 data spotlight, imposter scams and phishing-related fraud are among the top reported fraud types, indicating the control focus areas relevant to stopping card theft through credential compromise.
Interpretation
Controls & Mitigation Interpretation
The 2023 ISO/IEC 27002 guidance update stresses authentication controls as the key way to prevent unauthorized access, and the FTC’s 2024 spotlight shows phishing and imposter scams are among the top reported fraud types, reinforcing that stronger authentication and anti-phishing measures are central to effective online credit card theft controls and mitigation.
report visual · Key figures
Where online card theft starts: common attack and fraud patterns
Most online payment fraud is driven by credential compromise and testing (web app attacks, phishing/social engineering, and card testing/credential stuffing), which then leads to unauthorized transactions and chargeback disputes.
36%
36% of breaches in the 2024 Verizon DBIR involved web application attacks (common vector for card theft via skimming or
32%
32% of consumers reported that they were tricked by phishing or social engineering attempts (common precursor to online
33%
33% of card fraud attempts are attributed to card testing/credential stuffing patterns in 2023 across online channels (i
56%
56% of consumers said they have experienced unauthorized transactions or fraud on their payment accounts (global consume
38%
38% of consumers reported that they did not recognize a charge and initiated a dispute (chargeback behavior relevant to
source-verifiedverizon.com · wombatsecurity.com · microsoft.com · aite-novarica.com · consumerfinance.gov2024
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Daniel Varga. (2026, February 13). Online Credit Card Theft Statistics. Gitnux. https://gitnux.org/online-credit-card-theft-statistics
MLA
Daniel Varga. "Online Credit Card Theft Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/online-credit-card-theft-statistics.
Chicago
Daniel Varga. 2026. "Online Credit Card Theft Statistics." Gitnux. https://gitnux.org/online-credit-card-theft-statistics.
Sources & references
26 datasets cited across this report · attribution is report-level
+3 additional datasets cited (not shown individually)