FY25 Payment Fraud Snapshot

3 February 2026

By Toby Evans, Head of Economic Crime, AusPayNet and 
David McGregor, Security Standards Manager, AusPayNet
 

The challenge of overseas card fraud

The FY25 Payment Fraud Statistics highlight a global challenge demanding industry attention. Spending online with overseas merchants (amounting to around $434 million in FY25) accounts for only 3 per cent of total Australian card spending, but it accounts for 52 per cent of all fraud on Australian-issued cards. Concerningly, evidence continues to indicate that card fraud enables higher-value scams, reinforcing the important role the Australian Government’s Scams Prevention Framework must play in mitigating this threat.
 

The offshore fraud gap

Encouragingly, the data shows that Member efforts have led to overseas card-not-present (CNP) losses plateauing from FY24. The overseas fraud rate fell from $12.45 in FY24 to $10.75 per $1,000 spent in FY25.

However, this is still more than 10 times higher than domestic CNP fraud. In FY25, domestic CNP fraud declined from $351m in FY24 to $312m, resulting in a record-low domestic fraud rate of 75 cents per $1,000 spent.

This disparity stems from a structural gap in industry controls. Through self-regulation, the payments industry in Australia successfully enforces obligations on domestic issuers, acquirers and merchants. The low domestic fraud rate illustrates the effectiveness of AusPayNet's CNP Fraud Mitigation Framework (CNP Framework), the use of strong customer authentication (SCA), and other efforts by our Members to reduce overall card fraud losses despite card spending increasing.

However, the CNP Framework cannot mandate compliance with such controls on overseas merchants and acquirers. This gap creates a significant arbitrage opportunity for criminals, who exploit weaker security standards in foreign jurisdictions.
 

How stolen card credentials enable higher-value scams

Recent analysis by our Members revealed that over 50 per cent of overseas CNP fraud originates from US-based merchants, with Ireland representing the second-highest source. Three merchant categories dominate the fraud landscape: advertising services, direct marketing and subscription services, and other business services.

The security failures in these merchant categories were stark. SCA was absent in nearly all fraudulent transactions, while the Card Security Code was not used in one-third of high-risk transactions. Most concerningly, 94 per cent of advertising services fraud involved recurring payments, suggestive of account takeover and credential compromise.

This data strongly supports what many in the payments industry have suspected: criminals are leveraging compromised payment credentials to establish the infrastructure used to perpetrate scams, particularly publication of fraudulent advertisements. A recent Reuters report^[1] suggested Meta earns US$7 billion in advertising revenue each year from scam advertisements. Westpac reported that half of their customer scam losses originate on digital platforms^[2], while UK data reveals 66 per cent of their scam cases are enabled by online platforms^[3].
 

A path forward

Overseas fraud presents a complex challenge. While requesting SCA intervention by overseas acquirers is unlikely to succeed, potential solutions include requiring issuer authentication step-ups for overseas merchants. And, while the chargeback regime does not provide digital services platforms sufficient economic incentives to mitigate fraud and scams, the Scams Prevention Framework and supporting industry codes can provide the necessary leverage for these platforms to take action and work collaboratively with our industry to mitigate this threat.
 

Conclusion

Card fraud demands a coordinated response that drives domestic improvements and mitigation of overseas vulnerabilities that are facilitating higher-value scams. Success requires industry collaboration, regulatory engagement, and a willingness to challenge existing frameworks that criminals have learned to exploit. The financial and reputational cost of inaction is simply too high.
 

* Card present fraud is the sum of lost/stolen, never received, fraudulent application, counterfeit/skimming and ‘other’ categories. 

* The payment fraud statistics in this blog post are sourced from the Reserve Bank of Australia and AusPayNet data. 

You can find the FY25 payment fraud statistics on our website.  

^[1] Horwitz, J (2025), 'Meta is earning a fortune on a deluge of fraudulent ads, documents show ', Reuters.

^[2] Thornhill, J (2025), 'Australia outperforming global peers in scam prevention ', Westpac.

^[3] UK Finance (2025), 'Over £600 million stolen by fraudsters in first half of 2025  ’, Media Release, 24 October.