Stolen credit cards
This fact-check may be outdated. Consider refreshing it to get the most current information.
Executive summary
Stolen credit cards and card data remain a large, evolving economic crime: global card-fraud losses were reported at $34 billion in 2022 and are projected to reach roughly $43 billion by 2026 [1], while some industry trackers report large year-over-year spikes in 2024–25 including a 51% increase in credit card fraud in the first half of 2025 [2]. Consumers face low direct liability under U.S. rules (often $50 or $0 if reported promptly) but the broader social and business costs — merchant chargebacks, account takeovers, and new-account fraud — continue to climb and shift as fraud moves online [3] [4] [5].
1. The scale and shifting terrain of stolen-card crime
Losses attributable to card fraud are measured in tens of billions: global losses totaled $34 billion in 2022 and multiple outlets forecast about $43 billion by 2026, a signal that fraud is growing even as the mechanics evolve [1] [6]. That growth is driven in part by the proliferation of cards and digital wallets — an estimated 17.45 billion cards worldwide creates a large attack surface — and by the migration of fraud into card‑not‑present channels such as e‑commerce, where EMV-chip protections don’t apply [7] [5]. Industry trackers also reported rapid upticks in recent reporting periods, with some sources citing a 51% jump in credit card fraud in early 2025, reflecting either real escalation or improved reporting and detection [2].
2. How stolen card data is acquired and monetized
Stolen cards are obtained through data breaches, skimming/shimming devices, phishing and imposter scams, and account takeovers; captured data is often sold cheaply on darknet markets — one report estimates the cost of a stolen card on the dark web can be under $5 — which lowers the barrier for widespread resale and reuse [7] [8]. Breaches that expose names, numbers and expiry dates can fuel card‑not‑present fraud months or years after an intrusion, and security experts warn that access to payment processors or merchant systems can exponentially increase exposed records [4] [8]. New‑account fraud — using stolen personal information to open cards — has also risen, with over 400,000 reports in recent years, a reminder that identity theft often accompanies card theft [4].
3. Who ultimately pays: consumers, banks and merchants
Federal protections and card‑network rules generally limit consumer liability — federally the maximum unauthorized charge liability is commonly cited as $50 and can be $0 if a stolen card is reported before charges — placing most of the financial burden on issuers and merchants [3] [1]. But merchants bear heavy indirect costs from chargebacks, fraud-prevention tech and lost sales due to stricter checks; e‑commerce merchants in particular see major losses from card‑not‑present fraud [5]. Reports also highlight a practical gap: many victims don’t file police reports — one dataset says one in ten victims report incidents to police — which complicates enforcement and measurement [7].
4. Behavioral and systemic drivers: friendly fraud to automation
Not all “fraud” begins with a criminal; friendly fraud — consumers disputing legitimate purchases as undelivered or defective — accounts for a sizable share of chargebacks (about one-third in one analysis), blurring the line between abuse and criminal theft and inflating merchant losses [7]. At the same time, fraudsters automate testing of card numbers and exploit low-cost card data markets, scaling attacks in ways that make perimeter fixes insufficient without layered detection and identity proofing [7] [8].
5. What reporting misses and where to be cautious
Most sources are industry or consumer‑advice publishers; they compile FTC, Statista and private‑sector data but may also frame statistics to sell services or attract clicks, so narrative emphasis (e.g., ominous growth vs. protection afforded to consumers) can vary with the publisher’s angle [1] [6]. Public data gaps remain: precise real‑time breakdowns of losses by method, the share recovered, and law‑enforcement outcomes are inconsistently reported across these sources, limiting full accountability analysis [9] [8].
6. Practical implications and contested policy levers
The combined picture argues for layered defenses — rapid reporting, issuer monitoring, tokenization/virtual cards for online purchases, and merchant vigilance — while policy debates focus on incident transparency, stronger merchant accountability for data security, and better data sharing between private industry and law enforcement; the sources document the trends but diverge on which fixes will be most effective and which parties should bear new costs [5] [3] [1].