Every time a card is swiped, tapped, or typed somewhere in the world, a fraction of a second is spent deciding whether the person behind it is real, and the stakes of getting that decision wrong now run into the tens of billions of dollars. Payment security and fraud prevention are the systems that protect money in motion, and they have become one of the most important and expensive parts of modern finance. Card fraud losses worldwide reached roughly $33.4 billion in 2024, and the United States, with about a quarter of global card spending, accounted for nearly 42% of those losses, according to the Nilson Report. For consumers and businesses, understanding how the defenses work is no longer optional.
What payment fraud actually looks like
Payment fraud is not one crime but several. Card-not-present fraud, where a stolen card number is used online without the physical card, is the dominant form in the United States. Account takeover, where a criminal gains control of a legitimate account, is rising fast. And authorized-push-payment scams, where a victim is tricked into sending money themselves, are the hardest to stop because the payment looks legitimate.
The shift toward online commerce reshaped the threat. As chip cards made it harder to counterfeit physical cards, fraud moved online, which is why the United States ranks first in the world for card-not-present losses, per the Nilson Report’s 2024 analysis. The defenses had to follow the fraud into the digital channel.
The human element is now central. As technical defenses improved, criminals increasingly target people rather than systems, using deception to get victims to hand over credentials or approve payments. That pattern is documented in this report on rising online fraud, and it is why education sits alongside technology in any serious defense.
The layers of defense
Modern payment security works in layers, on the theory that no single control is enough. Encryption protects data in transit. Tokenization replaces card numbers with substitutes that are useless if stolen. Multi-factor authentication confirms identity with something beyond a password. And real-time monitoring scores each transaction for risk before it is approved.
Each layer covers a gap left by the others. Tokenization stops stolen numbers from being reused, but it does not stop a deceived customer from approving a payment, so behavioral monitoring and customer warnings fill that gap. The strength of the system comes from the overlap, not from any one tool.
Trust infrastructure ties the layers together, verifying identities and securing the digital interactions behind every payment, a foundation explored in this look at the infrastructure behind trustworthy digital business.
The scale of the problem
The numbers explain why fraud prevention commands so much investment. The table below frames the global picture and the United States’ outsized share.
| Measure | Figure | Source context |
|---|---|---|
| Global card volume 2024 | $51.92 trillion | Nilson Report |
| Worldwide card fraud losses 2024 | ~$33.4 billion | Nilson Report |
| US share of fraud losses | ~42% | vs ~25% of global spending |
| Projected fraud by 2034 | ~$48.5 billion | Nilson Report forecast |
Source: Nilson Report, 2024-2025.
The mismatch is the striking part. The United States generates about a quarter of global card spending but nearly half of global fraud losses, a gap driven almost entirely by card-not-present fraud. That single fact is why US payment security is more advanced, and more expensive, than almost anywhere else.
What it means for consumers
For consumers, the headline is reassuring: in most card fraud, the cardholder is not liable, because the loss falls on banks and merchants. Chargeback rights let a person dispute a fraudulent charge, which is one reason cards remain popular despite the fraud around them.
The exception is the dangerous one. In authorized-push-payment scams, where a person is tricked into sending money over an instant rail, there is often no chargeback and no recovery, because the victim authorized the payment. That is why scammers work so hard to move people onto instant payments, and why the best consumer defense against this kind of fraud is skepticism, not technology.
What it means for businesses
For businesses, fraud is a direct cost and a design constraint. Merchants bear chargebacks on fraudulent card-not-present sales, pay for fraud-screening tools, and lose legitimate sales when those tools wrongly decline good customers. Balancing fraud prevention against customer friction is one of the hardest trade-offs in commerce.
The same artificial intelligence reshaping fraud detection is also used by large platforms to police financial crime in real time, an approach detailed in this look at how a major platform uses AI against financial crime. For most businesses, the practical path is layered defenses tuned to their own risk, accepting that perfect prevention is impossible and the goal is to keep fraud growth below transaction growth.
How the threat keeps shifting
Fraud does not stand still, and that is the central challenge for anyone defending payments. As chip cards shut down counterfeiting, fraud moved online to card-not-present attacks. As tokenization and authentication hardened those channels, criminals turned to deceiving people directly. Each defensive win pushes attackers toward the next weakest point, which is usually the human one.
This evolution is why the United States carries such an outsized share of losses. Its large, card-heavy, e-commerce-driven economy presents the richest target, and its fraud is overwhelmingly a card-not-present problem rather than a physical-card one. The Nilson Report projects losses climbing for years, which means the defensive investment is not a temporary expense but a permanent feature of doing business.
The same artificial intelligence that powers fraud detection is now available to fraudsters, who use it to craft more convincing scams and to automate attacks at scale. Staying ahead requires constant adaptation, and the firms and consumers who treat fraud prevention as a one-time fix rather than an ongoing practice are the ones most likely to be caught out.
Payment fraud will not be eliminated, only managed, and the measure of success is keeping losses growing slower than the payments they ride on. As fraud shifts from stolen cards to deceived people, the next decade of payment security will depend as much on protecting customers from manipulation as on protecting data from theft.
