Jennifer is a senior analyst in Javelin’s Fraud & Security practice. She analyzes data and trends and provides recommendations to financial professionals regarding best practices for fraud prevention and cybersecurity.
Foreword
This report, sponsored by CSG, explores how payments and transaction fraud are evolving across industries. As payment systems have become more complex, fraud risk has increased. This report further examines fraud detection gaps and why traditional monitoring methods often fail. Javelin Strategy & Research maintains complete independence in its data collection, findings, and analysis.
Overview
Organizations continue to underestimate their exposure to payments and transaction fraud. Organizations that rely on legacy systems—that don’t connect behavior across accounts or channels—may mistakenly think the risk is low because fraud is not visible. At the same time, AI is changing how attacks unfold, giving fraudsters the ability to automate attacks and quickly scale them.
This report aims to help organizations understand how payments and transaction fraud are evolving, where detection gaps typically form, why these gaps matter, and how AI-driven controls can strengthen risk decisions across the customer journey. It outlines current fraud typologies, demonstrates how industry priorities are shifting, and provides practical guidance on adopting tools that support more effective, efficient detection.
Executive Summary
Fraud risk has increased as payment systems have become more complex. Organizations now support card-notpresent transactions, ACH transfers, subscription billing, digital wallets, embedded payments, remote onboarding, and real-time payments across many different platforms. Each additional payment method and channel create new fraud vectors.
Fraud often goes undetected because many monitoring programs still focus on reviewing individual transactions. Risk signals can appear earlier through account access patterns, device activity, account changes, or other behavior across the customer life cycle. When these signals are viewed in isolation, suspicious activity may not become obvious until financial losses occur.
Fraud increasingly crosses payment types, accounts, and operational systems. Activity such as card testing, credential validation attempts, refund abuse, and coordinated disputes may involve multiple merchants, devices, or payment channels.
Fraud detection metrics do not always reflect actual fraud numbers. Many organizations track confirmed losses, decline rates, false positives, and alert volumes when evaluating their fraud programs. Those numbers only represent the activity current systems identify. Fraud that goes undetected can give organizations the false impression that fraud simply isn’t present.
Recommendations
Use behavioral and contextual signals alongside transaction data across payment channels. These signals should be evaluated before a transaction is completed, not just after it has been processed. A single transaction may appear legitimate when viewed on its own. Anomalies may appear in account activity, login patterns, device changes, or payment patterns across cards, ACH transfers, digital wallets, and other payment channels. Looking at these signals together makes it easier to identify patterns that fragmented monitoring systems often miss.
Apply fraud controls before money is moved. Changes in transaction limits, unusual credit utilization, rapid growth in merchant processing volume, or spikes in refund activity can indicate fraud. Reviewing these signals alongside transaction behavior can help organizations intervene before losses occur.
Partner with vendors who provide integrated, real-time fraud detection. Operating detection systems at scale requires constant updates, ongoing monitoring, and strong engineering support. Many organizations struggle to maintain this internally. Vendors that offer real-time monitoring, configurable controls, and fraud expertise can help organizations improve detection while reducing the workload placed on fraud teams.
The Current Fraud Landscape
Digital payments used to be simple—a customer made a purchase, the payment was processed, money moved from the customer’s account to the business, the transaction cleared, and the process was finished. Payments are now more complex. Organizations support card-not-present transactions, ACH transfers, subscription billing, digital wallets, embedded payments, remote onboarding, and real-time payments. Customers now make these payments through mobile apps, online marketplaces, healthcare portals, telecommunications billing systems, property management platforms, and government service platforms.
And with the complexity of payments, fraud losses continue to reach historic levels. In 2024, identity fraud and scams together cost U.S. consumers $47 billion.1 Because some of these losses were reimbursed by financial institutions and payment providers, the financial impact of fraud extends beyond consumers.
Fraud is no longer limited to unauthorized card transactions or a single account takeover. It can appear during identity verification, merchant onboarding, account activity, or transaction patterns that become suspicious only when viewed across multiple transactions.2
Fraudsters exploit system weaknesses and attempt to mirror legitimate customer behavior. They may manipulate identity information, use stolen payment credentials, rely on credentials obtained through social engineering, or exploit transaction processes through tactics such as card testing or refund abuse.
With scams, attackers often ask victims to use specific payment methods. A higher percentage of victims said scammers requested card payments. This is surprising, as consumers often associate scams with payment methods like cryptocurrency, wire transfers, or gift cards because those payments are frequently mentioned in scam warnings. Credit and debit cards, however, are widely used for everyday purchases and are accepted by most businesses. Because of that familiarity, consumers don’t typically view card payments as a scam red flag.
Scammers Seek Card Payments
Figure 1. Percentage of Victims Targeted by Scammers Seeking a Particular Payment Method
Source: Javelin Strategy & Research
Fraud Typologies
Several fraud typologies continue to affect digital payment environments.
Scams
Involve manipulating consumers into providing financial or personal information to the scammer or even authorizing a payment themselves (authorized push payment fraud). Verifying a customer’s identity does not always mean the transaction is legitimate. Tip: Using behavioral analytics can help determine if someone is in the midst of a scam when conducting transactions or accessing an account.
Card-not-present fraud
Occurs when stolen card information is used for online or remote transactions. Merchants typically verify that the card is valid, not that the person using it is the legitimate cardholder. Tip: Look for rapid repeated purchase attempts, inconsistent device or location data, unusual transaction timing, and spending behavior that does not fit the customer.3
First-party fraud
Occurs when a legitimate customer disputes or abuses a transaction they authorized. Because the accountholder completed the transaction, distinguishing fraud from a valid dispute can be difficult. Tip: Look for repeated disputes, conflicting claims, refund or charge-back abuse, and patterns that suggest intentional misuse.4
Account takeover fraud
Occurs when fraudsters gain access to an existing account without authorization and change identity elements to use the account further. Once inside the account, they may change settings, intercept authentication codes, lock the accountholder out, or initiate unauthorized payments.5 Tip: Looking at behavioral risk signals in context can help identify account takeover.
Synthetic identity fraud
involves creating a new identity using a combination of real and fabricated information. These identities may pass onboarding checks and build transaction history before being used for financial gain.6 Tip: Look for reused identity elements, inconsistent identity details, thin-file behavior, and signs the identity does not reflect a real person’s history.
These typologies often overlap. For example, a scam may lead to account takeover if a suspect deceives a victim into providing credentials or other personal information.
All organizations are affected by these fraud types. Your systems may not be set up to catch them.
Fraud Detection Gaps
Fraudsters continue to adapt. They understand detection thresholds and the fact that legacy detection systems are still being used. And they understand that many fraud programs operate in silos—silos between data, detection software, teams, and organizations. Because of this, fraudsters intentionally structure their activity to skirt detection, often operating just below thresholds known to trigger alerts. For example, synthetic identities may be created and left dormant while transaction history or credit relationships are established. Or fraudsters may test stolen login credentials or run small authorization requests, using low-dollar transactions and varied timing to determine which accounts or cards remain active.
AI has only accelerated this problem. Fraudsters can now automate attacks en masse to businesses of all sizes. AI gives fraudsters the ability to quickly test controls and adapt, making it difficult for static rules and manual reviews to keep up.
Fraud tactics often look similar across industries, but fraud controls vary from one organization to another. The approach usually depends on the type of business, the regulations involved, customer expectations, how much risk the organization is willing to accept, and the resources available to manage fraud. Financial institutions operate under strict regulatory oversight. Healthcare providers, utilities, and government entities often face additional reputational pressure because of the public trust associated with their services. As a result, there is no single industry standard for things like detection thresholds, alert review processes, investigation workflows, staffing structures, or technology investments.
Unfortunately, some organizations still only review transactions, rather than investigate earlier behavior or account activity (like credential compromise, account manipulation, device or location changes, and unusual login behavior). Programs that fail to look at risk signals across the customer life cycle see activity that does not appear clearly fraudulent until financial losses occur. Fraud risk can emerge at any time in the account life cycle. The key is to detect fraud before the payment occurs.
Fraud programs typically track confirmed losses, decline rates, false positives, and alert volumes. When those numbers stay within expected ranges, organizations may assume fraud is contained. But these metrics reflect only what current detection systems are catching, not activity that stays below thresholds, doesn’t match existing rules, crosses payment types, or includes related transactions or behaviors that were treated as separate events. Using risk signals tied to behavior, device, and cross-channel activity can help organizations spot low-dollar transactions, repeated attempts spread across accounts, and coordinated fraud, all before losses appear.
Just because fraud has not been detected does not mean there was no fraud.
Consumer experiences also show how long fraud can remain undetected. Misuse of customer information can go undetected for days or even years. The longer it takes to detect this misuse, the more likely it is that losses occur. When losses occur, customers may close their account. Nearly 30% of fraud victims are more likely to close the account where the fraud occurred.
Misuse of Information Can Go Undiscovered for Long Periods of Time
Figure 2. Percentage of Consumers Who Discovered the Misuse of Their Information, by Time Until Discovery
Source: Javelin Strategy & Research
To try to more effectively detect fraud, many organizations simply piecemeal solutions, adding new fraud tools on top of legacy systems. As a result, card transactions may be reviewed in one system, ACH transfers in another, merchant onboarding somewhere else, and money-laundering detection in a completely separate system.
When activity is reviewed this way, patterns are harder to recognize. Traditional legacy systems that rely on static, single-rule monitoring are no longer effective at preventing modern fraud. High false positive rates can often result, creating a burden on fraud operations and forcing an organization to be reactive. And when fraud analysts only review single transactions, they often miss context and history, causing them to either decline legitimate transactions or let fraud through. Both outcomes can erode customer trust, cause customer attrition, taint company reputation, and affect the business’ bottom line (see Javelin’s Foolproof Payments: How AI is Revolutionizing Payment Fraud).
Building fraud platforms in-house can seem appealing. But operating those systems at scale requires significant engineering support. Systems must stay operational, security requirements must be maintained, detection models require ongoing updates, and organizations must keep pace with regulatory requirements surrounding fraud and antimoney laundering.
Fraud Defenses Require a Layered Approach
Effective fraud defense depends on how well systems work together, not just how many tools are in place. Realtime transaction monitoring includes looking at context such as transaction velocity, device information, location consistency, merchant history, and patterns in customer behavior.
The speed with which a team investigates and responds to alerts often determines whether fraud is stopped.
When an alert is generated, there should be no confusion about who reviews it, who makes the decision, and how it moves from investigation to resolution across fraud, compliance, product, and engineering teams. Emerging agentic AI approaches are starting to support this process by helping prioritize alerts, triage cases, guide investigations, and route decisions more dynamically, which can reduce response times when used with clear oversight. Detection systems need to adapt to new threats, but they also need to remain transparent, explainable, regularly tested, and aligned with governance expectations.
HIGH-RISK USE CASES
Several detection use cases are particularly relevant for organizations dealing with payments fraud. Common fraud tactics include card testing, large-scale credential validation attempts, refund manipulation, misuse of merchant accounts, and coordinated dispute activity.
Card testing: Attempting high volumes of low-dollar transactions to identify active card numbers. Fraudsters use multiple merchants, devices, or IP addresses to avoid triggering simple velocity thresholds.
BIN attacks: Generating card numbers that share the same Bank Identification Number (BIN), which identifies the issuing bank, and then testing those numbers to identify valid cards linked to that issuer.
Refund manipulation and dispute abuse: Intentionally exploiting refund policies, charge-back processes, or promotional offers. While not every dispute is fraudulent, repeated behavior across accounts, merchants, or time frames may signal deliberate misuse.
Merchant misuse: Sudden increases in processing volume, abnormal refund rates, rapid credit growth, or unusual changes in merchant payouts may indicate misuse of payment systems.
These behaviors rarely occur in isolation. A compromised account may later be used for refund abuse. A synthetic identity may later be used as a mule account to move funds across networks. Merchant credit issues may overlap with suspicious transaction activity that raises AML concerns. Fraud increasingly crosses payment types, accounts, and internal teams, which is why detection cannot rely strictly on transaction reviews.
FRAUD PROGRAM DESIGN
Fraud management has expanded beyond reviewing individual transactions. Fraud leaders now need to look at how detection systems, processes, and teams work together as part of a broader risk framework.
Fraud detection cannot rely on rules alone. AI and machine learning models (used in conjunction with dynamic rules) can help identify behavior that is difficult to capture with fixed rules, allowing analysts to focus on higher-risk activity. But models aren’t set-and-forget tools. Teams should monitor model performance and adjust models as fraud tactics change. Detection systems must also handle high transaction volumes without slowing decisioning. This allows teams to respond faster to new fraud patterns, reduce operational friction, and adjust controls without needing major system changes. Each team should understand their role when an alert is generated and how the issue is resolved. Regular review and testing help ensure the controls remain effective as risk evolves.
Early risk signals can identify emerging fraud before losses occur. Sudden increases in transaction limits, unusual credit utilization, rapid growth in merchant processing volume, or spikes in refund activity can reveal fraud patterns that are not visible when transactions are reviewed individually.
Fraud cannot be viewed in isolation. Detection programs need visibility across payment types and internal teams. Because fraud doesn’t operate within a single payment rail, ACH, card, digital wallet, online, and in-person transactions should be reviewed together. And since fraud and money laundering often overlap, fraud monitoring should also align with AML oversight. Looking across accounts, merchants, payment channels, and time frames can provide a holistic view of customers and merchants.
As fraud tactics change, the way an organization designs its systems and manages fraud operations affects how well it can respond. When fraud is treated as a risk that affects the whole organization, not just the fraud team, organizations are more likely to recognize the threats they actually face.
The Federal Reserve’s FraudClassifier7 and ScamClassifier8 models reflect industry recognition that standardized terminology improves how fraud and scams are classified and reported. Using these models can assist teams with classifying identity fraud and scams independently of payment type, payment channel, or other payment characteristics. And they help organizations better understand fraud trends.
Consumer perspectives also provide insights into how fraud prevention measures are experienced in practice. Consumers believe customer service support and tools that allow you to verify the authenticity of bank correspondence are the most useful in fraud prevention. In contrast, a smaller percentage of consumers think payment delays and holds are helpful with fraud and scam mitigation.
Consumers Think Payment Holds and Delays are Less Helpful in Fraud Prevention
Figure 3. Percentage of Consumers Who Think Various Measures Will Be Very Useful in Minimizing Fraud or Scams
Source: Javelin Strategy & Research
Fraud prevention decisions affect both fraud risk and customer experience, and organizations must be up for the challenge of balancing both. Consumers may view certain controls as inconvenient, but organizations are responsible for reducing loss, protecting consumers, and meeting their regulatory obligations. By deploying a strategically layered program, fraud leaders can strengthen detection capabilities, mitigate emerging threats, and prevent losses.
Methodology
The Javelin Identity Fraud Study provides businesses, financial institutions, government agencies, and other organizations with an in-depth and comprehensive examination of identity fraud and the success rates of methods used for prevention, detection, and resolution.
Survey Data Collection
This ID fraud survey was conducted online among 5,010 U.S. adults over the age of 18; this sample is representative of the U.S. Census demographics distribution. Data collection took place Nov. 10-Dec. 3, 2025. Data is obtained using 18-plus U.S. population benchmarks on age, gender, race/ethnicity, household income and region from the most current CPS targets with a variance of +-2% points. Due to rounding errors, the percentages on graphs may add up to 100% plus or minus 1%. To preserve the independence and objectivity of this annual report, the sponsors of this project were not involved in the tabulation, analysis, or reporting of final results.
Margin of Error
The ID Fraud Study estimates key fraud metrics for the current year using a base of consumers who have experienced identity fraud in the past six years. Other behaviors are reported based on data from all identity fraud victims in the survey (i.e., fraud victims experiencing fraud up to six years ago) as well as total respondents, where applicable. For questions answered by all 5,010 respondents, the maximum margin of sampling error is +/-1.4 percentage points at the 95% confidence level. For questions answered by all identity fraud victims, the margin of sampling error is +/- 3.0 percentage points at the 95% confidence level.
Endnotes
1 Javelin Strategy & Research, “2025 Identity Fraud Study: Breaking Barriers to Innovation.” Published March 25, 2025; accessed March 12, 2026
2 FedNow, “Fraud and instant payments: The basics.” Published 2026; accessed March 6, 2026
3 FraudNet, “Best Tools for Card-Not-Present Fraud Detection.” Published Nov. 13, 2025; accessed March 9, 2026
4 Javelin Strategy & Research, “A Line in the Sand for First-Party Fraud: From Identity to Intent.” Published March 26, 2026; accessed March 26, 2026
5 Javelin Strategy & Research, “Account Takeover: Static Authentication Enables Access Without Confirmation.” Published June 17, 2025; accessed March 9, 2026
6 Javelin Strategy & Research, “New-Account Fraud: Old Problem, New Challenges.” Published Sept. 29, 2025; accessed March 11, 2026
7 Federal Reserve, “FraudClassiferSM Model.” Published 2026; accessed March 10, 2026
8 Javelin Strategy & Research, “Battle of the Budget: Prioritizing Scam Classification for Future Cost Savings.” Published Feb. 27, 2025; accessed March. 9, 2026
About CSG
CSG is a global provider of customer engagement, revenue management, and payments solutions that help companies deliver seamless digital experiences. The company works with organizations across industries including telecommunications, healthcare, financial services, utilities, and technology to simplify billing, manage payments, and strengthen customer relationships. Through its CSG Forte platform and broader payments capabilities, CSG helps businesses process and manage digital payments while reducing risk and improving operational efficiency. Headquartered in Denver, Colorado, CSG supports thousands of organizations worldwide with technology designed to streamline complex customer interactions and payment workflows.
