Ask a European online store owner about strong customer authentication (SCA) and you will usually hear a complaint. The extra step at checkout, the bank app prompt, the one-time code: all of it gets blamed for abandoned carts. Payment providers sell exemptions as a feature, and many merchants ask for as many of them as they can get.
My view is that this gets the trade-off backwards. The most recent detailed fraud data from the European Banking Authority (EBA) and the European Central Bank (ECB), shows that online card payments are where fraud concentrates, that authenticated payments are defrauded far less often, and that the transactions that skip authentication are exactly where fraudsters aim. For most online stores, more SCA, applied well, is cheaper than less.
Key points
- Online is where card fraud happens. Remote card payments were about 28% of card payment value in the EU/EEA in 2024, but around 83% of card fraud.
- The remote fraud rate was 13 times higher than for in-person card payments by value (0.091% vs 0.007%), and 22 times higher by number of transactions.
- Skipping SCA doubles the fraud rate for card payments within the EEA. For payments to merchants outside the EEA, card payments without SCA had fraud rates three times higher than those with SCA.
- Card fraud losses rose 29% in 2024 to €1.329 billion, while total payment fraud in the EEA reached €4.2 billion, up from €3.5 billion in 2023.
- Exempted remote card payments had fraud rates of 0.01% to 0.17%, against 0.033% for all card payments. Fraudsters target the exemptions.
- Only 40% of electronic card payments by number were authenticated with SCA in 2024, mostly because contactless payments in shops are exempt. Online, the gaps are the exemptions merchants and providers choose.
- Card fraud rates vary more than fourfold across countries, from 0.013% in Poland to 0.057% in France.
Where the data comes from
The figures in this piece come from the 2025 Report on Payment Fraud, published jointly by the EBA and the ECB in December 2025. It is based on mandatory fraud reporting by payment service providers across the European Economic Area under the second Payment Services Directive (PSD2), and covers six half-year periods from 2022 to 2024.
Two definitions matter for online sellers:
- Remote payments are initiated through the internet or another device that can be used for communication at a distance. For cards, that is essentially ecommerce and in-app purchases.
- SCA means the customer proves who they are with at least two independent factors, such as a phone and a PIN or a fingerprint. PSD2 requires it for most electronic payments in the EEA, with a list of exemptions.
Online is where card fraud lives
Most card payments in Europe still happen in physical shops. In 2024, remote payments made up only about 28% of the value and 18% of the number of card transactions with EU/EEA-issued cards. Yet about 83% of card fraud, by value and by number, came from remote payments.
Remote card payments as a share of card payments and of card fraud, 2024
That imbalance produces very different risk levels. The annual fraud rate for remote card payments was 0.091% of value in 2024, against 0.007% for in-person card payments. Put simply, every €10,000 of online card sales carried about €9 of fraud, compared with less than €1 in a shop.
The reason is no mystery. Chip-and-PIN and contactless terminals made in-person card fraud hard. Stolen card details are useless at a terminal but still work online wherever nothing else is checked. The report finds that theft of card details was behind more than 56% of the value of remote card fraud in 2024.
For an online store, that means card fraud is not an edge case. It is a structural feature of the channel you sell in.
Authenticated payments are defrauded far less often
The core question is whether SCA works. The report’s answer is clear for card payments: fraud rates for transactions authenticated with SCA were consistently and substantially below those without it.
| Card payments, 2024 | Fraud rate without SCA compared with SCA |
|---|---|
| Merchant’s payment provider inside the EEA | About 2 times higher (value and volume) |
| Merchant’s payment provider outside the EEA | About 3 times higher by value, 4 times by volume |
Source: EBA and ECB, 2025 Report on Payment Fraud, section 4.2.
Geography amplifies the effect. Card fraud rates were about 17 times higher when the merchant’s payment provider was outside the EEA, where SCA may not be required, than for domestic payments. Around 30% of the value of fraudulent card payments in 2024 was linked to cross-border transactions outside the EEA.
Read together, these numbers tell the same story from two angles. Inside the EEA, where SCA is mandatory unless an exemption applies, fraud rates are low. Where the rule does not reach, fraud is much higher. The difference is not the card, the customer or the product. It is whether a second factor was checked.
Fraudsters aim at the exemptions
PSD2 lets payment providers skip SCA in defined cases: low-value payments, recurring payments, trusted payees, and remote payments judged low-risk by a transaction risk analysis (TRA). Some payments, such as those started by the merchant rather than the customer (merchant-initiated transactions, or MIT), sit outside the rule entirely.
For remote card payments without SCA in 2024, the report found:
- around 29% were exempted under transaction risk analysis
- around 22% were merchant-initiated transactions, the mechanism behind most subscription billing, which matters if you run one of the models we cover in our guide to platforms for subscription boxes
- around 26% were reported as outside the scope of SCA, a share the EBA says needs further investigation
The fraud rates on those exempted remote payments ranged from 0.01% to 0.17% of value, depending on the exemption, against an overall card fraud rate of 0.033%. In other words, the “low-risk” lane often carries more risk than the average card payment, not less. The report’s own reading is that fraudsters adapt their attacks to the transactions that commonly fall into exemptions.
There is also a volume signal. In 2024, about 17.06 million fraudulent card transactions were recorded out of around 111.05 billion card transactions. Card payments produced the largest number of fraudulent transactions of any instrument, and the report links that to fraudsters using low-value payments where SCA may not be applied.
The cost is rising, and it lands on someone
Total payment fraud in the EEA was €3.4 billion in 2022, €3.5 billion in 2023 and €4.2 billion in 2024, according to the EBA and ECB press release. Card payment losses alone rose 29% in 2024 to €1.329 billion.
| Card payment fraud, 2024 | Figure |
|---|---|
| Losses on cards issued in the EU/EEA | €1.329 billion (+29% on 2023) |
| Fraud rate by value | 0.033% |
| Fraud rate by number of transactions | 0.015% |
| Share of losses borne by cardholders | 38% |
| Remote share of card fraud | about 83% |
Source: EBA and ECB, 2025 Report on Payment Fraud.
Cardholders bore 38% of card fraud losses in 2024. The rest fell on payment providers and other parties. For online merchants, “other parties” often means chargebacks. When a payment is not authenticated with SCA, the merchant usually has much weaker protection against a fraud chargeback than when it is. Exemptions are not free convenience. They move risk, and frequently they move it to the seller.
Fraud rates differ widely by country
National card fraud rates in 2024 ranged from 0.013% of card payment value in Poland to 0.057% in France. Six countries were above the EU total of 0.033%: France, Hungary, Lithuania, Luxembourg, Spain and Denmark.
Card payment fraud rate by country, 2024
France stands out in absolute terms too. Its reported card fraud of €484 million was about 37% of the EU total, while Germany (€125 million) and Spain (€141 million) together accounted for about 20%. If you sell into France, card fraud is a bigger line item than in most of Europe, and authentication policy matters more. The same applies to any cross-border selling, alongside the logistics questions in our guide to international shipping and customs.
The case against
The objection to SCA is real, and it deserves a fair hearing.
- Friction costs sales. Every extra step in checkout loses some buyers. A redirect to a banking app, a code that does not arrive or an authentication that times out can end a purchase that would have been legitimate. Our guide to ecommerce conversion rate optimization covers how small losses at each step add up.
- The report does not measure lost sales. The EBA and ECB data shows fraud rates, not abandonment. It cannot tell you how many good customers gave up at the authentication step, so the full cost of SCA is not on the table.
- Exemptions exist for a reason. Regulators designed them to balance security with convenience. Payment providers that use transaction risk analysis must keep their fraud rates under set limits to qualify, so a well-run TRA program is not reckless.
- Some exemptions are low-risk. Secure corporate payment protocols showed fraud rates below the overall card rate across all periods. Not every exemption is a fraud magnet.
I accept all four points. But the friction argument is strongest for a store with almost no fraud exposure, and the data says online card payments are the most exposed channel in European payments. For the typical small store, the risk of a chargeback wave is a bigger threat to margin than a modest authentication drop-off.
What to do
The practical answer is not “authenticate everything” or “exempt everything”. It is to use SCA where the data says risk sits, and make it as smooth as possible.
- Leave SCA on by default for new customers. First orders, new cards and new devices are where stolen card details get used. Accept the extra step there.
- Make authentication painless rather than rare. Modern 3D Secure sends more data to the card issuer, which lets many payments pass with a quick biometric check in the banking app instead of a code. A smoother flow is a better fix for abandonment than skipping the check. Our overview of ecommerce checkout solutions compares the main options.
Use exemptions deliberately
Exemptions are a tool, not a default setting.
- Use transaction risk analysis only if your fraud is low. If your store already sees fraud above your provider’s average, a TRA exemption shifts more of that fraud onto you. Ask your provider which exemptions it applies on your behalf and who carries the liability for each.
- Flag subscriptions correctly. Recurring and merchant-initiated payments need SCA on the first payment and correct flagging afterwards. Payments reported as “outside scope” form a large group the EBA wants investigated, and incorrect flagging is one possible cause. If you run subscriptions, check this with your provider.
- Treat non-EEA traffic with extra care. The 17-times gap in fraud rates for payments outside the EEA is the strongest single finding in the report. If you accept cards from or through non-EEA payment providers, require authentication wherever it is available, and watch for card testing.
- Keep an eye on the cost per channel. Fraud losses, chargeback fees and dispute time belong in your payment cost, next to the provider fee. Our breakdown of payment gateway fees is a good starting point for the full cost comparison.
The bottom line
The checkout complaint about SCA is about friction you can see. The fraud it prevents is harder to see, until it arrives as a chargeback. The EBA and ECB data shows that online card payments carry 13 times the fraud rate of in-person ones, that skipping SCA at least doubles the risk, and that fraudsters deliberately aim at exempted payments. For European online stores, the smart move is not fewer authentications. It is better ones, applied where the risk actually is.