The fraud epidemic by the numbers
Card fraud isn’t slowing down. It’s accelerating, and the United States sits at the center of it. Global losses hit $32.4 billion in 2021. By 2026 that figure reaches $43 billion. Look further out and projections put global losses at $397.4 billion within the next decade. These aren’t abstractions. That is money leaving the economy, and disproportionately leaving merchants who carry the downstream costs.
America is the fraud capital
46% of worldwide fraud occurs in the United States. Nearly half of all global losses concentrate in one country. Within the US the burden is uneven, and it tracks where card volume is dense:
| State | Card fraud rate |
|---|---|
| California | 45% |
| Florida | 44% |
| Georgia | 42% |
| Alabama | 42% |
| Maryland | 40% |
The lowest rates sit in Kansas, Maine, Massachusetts, Illinois and Oklahoma. If you run a business on either coast, you operate in the hot zone.
Online and keyed sales carry the risk
Online sellers have seen a 140% increase in fraud attacks over the past three years. Card-not-present transactions, online checkout, phone orders and manually keyed sales, now account for 65% of all fraud losses. The reason is structural. A keyed sale has no chip verification, no PIN entry and no visual confirmation that the person holding the card is the person named on it. Fraudsters know that and work it.
Who gets hit and how much
The anatomy of a fraudulent charge
The median fraudulent charge is $79, up 27% from $62 a year earlier. Small amounts, deliberately. Here is how fraudulent transactions break down by size:
| Transaction amount | Share of fraud cases |
|---|---|
| Less than $50 | 33% |
| $50 to $99 | 22% |
| $100 to $299 | 24% |
| $300 to $999 | 15% |
| $1,000 or more | 6% |
55% of fraudulent transactions are under $100. Fraudsters keep charges small on purpose, hoping they slip past a busy merchant and a cardholder who isn’t looking. It’s a volume game, and the chargeback is what eventually reveals it.
The victim profile
- People aged 30 to 39 report the most fraud, nearly 111,000 cases a year
- People 80 and older report the fewest, just over 2,000 cases
- 65% of cardholders have been a fraud victim at least once
- 21% of cardholders saw two or more fraudulent charges in a single year
And 22% of cardholders never review their statements at all. One in five people never checks whether a charge is legitimate. That is 22% of your customers who won’t catch fraud until it arrives as a chargeback on your account.
What merchants actually pay
Here is the multiplier nobody prints on a receipt: every $1 lost to fraud costs a merchant $3.75. That figure includes the chargeback fee, administrative time, lost merchandise and the interchange you already paid on the sale. Sell a $100 item to a fraudster and you aren’t out $100. You’re out $375.
That is before the fraud exposure priced into your rates. Processors build projected fraud losses into the interchange you pay on every transaction, fraudulent or not. Whether a given sale turns out to be stolen, you are subsidizing industry-wide losses through a line you can’t itemize on your statement.
The chargeback cascade
One in three consumers commits friendly fraud, about 33% of people who should contact a retailer for a refund instead file a chargeback with their card issuer. Some genuinely believe the product never arrived or was defective. The intent may be innocent. The result isn’t.
You lose the sale. You lose the product. You pay a chargeback fee, typically $20 to $100. Your chargeback ratio rises, which can push the account into a higher-risk category with elevated rates. And 48% of consumers say protecting them from fraud is the merchant’s job in the first place.
The system is built so merchants absorb the loss while processors collect the fee on the sale and again on the reversal.
The breach reality
Up to 80% of credit cards in circulation have been compromised by a hack or data breach. Eight in ten. If that sounds impossible, look at the scale of individual events:
| Breach | Year | Cards compromised |
|---|---|---|
| Heartland Systems | 2009 | 160 million |
| Capital One | 2019 | 106 million |
| TJX | 2006 | 94 million |
| TRW / Sears | 1984 | 90 million |
| Home Depot | 2014 | 56 million |
With 17.45 billion credit, debit and prepaid cards circulating worldwide, the dark web works as a clearinghouse for stolen data. A full card number costs less than $5. Add the cardholder’s Social Security number and date of birth and the price climbs to roughly $100. Fraud runs as a business with almost no overhead.
Cyberattacks lead the way
Last year saw 1,613 reported cyberattacks affecting 188.9 million people. Phishing, malware, ransomware and unsecured cloud accounts drove most of them. Human or system error accounted for just 179 incidents and physical breaches for 51. Digital attack is the primary vector, and it keeps getting more sophisticated.
EMV’s unfinished decade
The EMV liability shift took effect in 2015. A decade later only 75% of US merchants are EMV compliant. One in four American businesses still hasn’t adopted the chip standard that became normal years ago. Those merchants carry full liability for card-present fraud at their terminals, and processors made certain of that.
For merchants who did adopt the chip, EMV genuinely cut counterfeit card fraud. Fraudsters simply moved to card-not-present channels where the chip protects nothing. The dollars keep climbing either way.
What actually helps
59% of cardholders have fraud alerts enabled. Of those, 38% were notified within minutes of an attempted fraudulent charge and another 46% within hours. Real-time alerts work. They catch fraud before it becomes a chargeback. The catch for you is that they sit on the customer’s side of the transaction. You can’t make a cardholder watch their account.
What you can control is your transaction security, your fraud detection tooling and your processing costs. That last one is where a statement audit earns its keep, because fraud protection is the justification most often attached to rates that never came down.
What this means for your statement
Fraud statistics tell one story. Your statement tells another. The fees buried in your rates, often justified by fraud protection, network security and risk mitigation, may be costing you more than the fraud itself, and unlike the fraud, those are negotiable.
Before you accept a rate increase or a new equipment bundle, put the statement next to the numbers above and ask what you are actually paying for. If you’d rather have that read by someone who does it for a living, send us a statement and we’ll show you where the downgrades and markup sit. No obligation and no pressure.
Check your own effective rate before you compare anything else. One number, one statement, and the fraud conversation stops being theoretical.
