Payment Fraud Statistics: AFP, FBI, FTC, UK and EU Data

The sources and what they measure
Business payments fraud: AFP surveys

Every figure on this page was checked against the original publisher's report or release, and each one is linked. Payment fraud numbers come from very different kinds of sources:

Surveys of businesses (AFP): the share of organizations that saw fraud.
Complaints and reports filed by victims (FBI IC3, FTC): money people reported losing. These figures are not verified and are not a survey.
Data reported by banks and payment firms (UK Finance, ECB/EBA): the value of fraudulent transactions in a country or region.

A percentage of organizations, a total of reported losses and a fraud rate measure different things, so don't compare them directly. Each section says what its number measures.

Key figures

76% of US organizations surveyed by AFP had attempted or actual payments fraud in 2025. Base: 465 treasury practitioners (AFP, April 2026).

$20.877 billion in losses was reported to the FBI's IC3 in 2025, from 1,008,597 complaints. Business email compromise accounted for $3.05 billion of that (IC3 2025 report).

£1.28 billion was lost to fraud reported by UK Finance members in 2025. £576.4 million of it was authorised push payment (APP) fraud (UK Finance Annual Fraud Report 2026).

€4.2 billion in fraudulent payment transactions was reported across the EU/EEA in 2024 (EBA/ECB 2025 Report on Payment Fraud).

The sources and what they measure

AFP 2026 Payments Fraud and Control Survey (Association for Financial Professionals, underwritten by Truist)

Period: activity in 2025. The survey was run in January 2026.
Who is counted: 465 treasury practitioners at US organizations.
What a figure means: the % of respondents' organizations that had attempted or actual fraud. It is not a loss amount.

AFP 2025 Payments Fraud and Control Survey

Period: activity in 2024. The survey was run in January 2025.
Who is counted: 521 corporate practitioners. The release doesn't state a geography.
What a figure means: same as above.

FBI IC3 2025 Annual Report

Period: calendar 2025.
Who is counted: complaints filed with the FBI's Internet Crime Complaint Center. They came from the US and more than 200 other countries. International complaints account for almost $1.6 billion of the reported losses.
What a figure means: reported losses in USD. Complainants may file more than once, and IC3 says losses are de-duplicated "as much as possible."

FTC Consumer Sentinel Network Data Book 2024 and FTC release of 25 March 2026

Period: calendar 2024 (Data Book) and 2025 (release).
Who is counted: fraud reports filed by consumers in the US.
What a figure means: reported consumer losses. The FTC says the data is "based on unverified reports filed by consumers" and "is not based on a consumer survey."

UK Finance Annual Fraud Report 2026

Period: calendar 2025, with comparisons back to 2020.
Who is counted: cases reported by UK Finance members (banks, card issuers and card acquirers) in the UK.
What a figure means: gross losses, before any money is returned. One case is one account or card, not one person.

EBA/ECB 2025 Report on Payment Fraud (EBA/REP/2025/40, December 2025)

Period: H1 2022 to H2 2024.
Who is counted: payment data that payment service providers report under PSD2, from the EU/EEA countries that reported the full time series.
What a figure means: the value of fraudulent transactions. A fraud rate is fraud value ÷ total transaction value.

Business payments fraud: AFP surveys

The AFP survey asks US treasury and finance staff whether their organization was targeted. Each percentage is a share of survey respondents. It counts both attempted and actual fraud, so it tells you how widely fraud is attempted, not how much money is lost.

2026 survey (activity in 2025, 465 respondents, US organizations), from the AFP press release of 14 April 2026:

76% of organizations experienced attempted or actual payments fraud in 2025.
Checks were the payment method most often targeted, cited by 58% of respondents. Next came ACH debits (30%) and wire transfers (25%).
74% were affected by business email compromise (BEC) in 2025.
17% use AI to combat payments fraud.
Losses (not just attempts) were reported by 48% of organizations with revenue under $1 billion and 66% of those with revenue over $1 billion.
72% of organizations that use checks plan to keep using them. Of those, 68% cited vendor requirements as a reason.

2025 survey (activity in 2024, 521 respondents), from the AFP press release of 15 April 2025:

79% of respondents said their organization was a victim of attempted or actual payments fraud in 2024. That is one percentage point lower than in 2023.
63% experienced attempted or actual check fraud.
BEC was the top route for attempted and actual payments fraud, cited by 63%. Within BEC, wire transfers were the most-targeted payment method (63% of respondents, up from 39%).
Vendor imposter fraud was cited by 45%, an 11-percentage-point rise from the previous survey.
Recovery: 22% of organizations recovered 75% or more of the funds lost to payments fraud in 2024, down from 41% in 2023. 58% recouped up to 75%, up from 29% in 2023.

The two editions surveyed different people (521 and then 465 respondents). The change from 79% to 76% is a change between two survey samples, not a measured trend for the same organizations.

Reported cybercrime and BEC losses: FBI IC3

The IC3 2025 Annual Report counts complaints made to the FBI's Internet Crime Complaint Center. The amounts are losses reported by complainants. They are not an estimate of all cybercrime.

Calendar 2025	Figure
Complaints received	1,008,597
Total reported losses	$20.877 billion (+26% from 2024)
Business email compromise: complaints	24,768
Business email compromise: reported losses	$3,046,598,558 (second-largest category, after investment fraud at $8.65 billion)
Credit card/check fraud: complaints and losses	18,774 complaints, $282,670,235
Cyber-enabled fraud	452,868 complaints (45% of all), $17.697 billion (85% of all losses)

For comparison, the IC3 2024 report recorded 859,532 complaints and $16.6 billion in reported losses for 2024. BEC accounted for $2,770,151,146 of that, from 21,442 complaints.

IC3 defines BEC as a scam "targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments." That definition describes the risk an accounts payable team faces every time it pays a supplier.

Reported consumer fraud: FTC Consumer Sentinel

The FTC counts fraud reports filed by consumers in the US. In the FTC's words, the data is "based on unverified reports filed by consumers" and "is not based on a consumer survey."

2025. In a release dated 25 March 2026, the FTC said it received 3 million fraud reports in 2025, with $15.9 billion in reported losses. Imposter scams were the most-reported fraud (more than 1 million reports, more than $3.5 billion lost). Investment scams had the largest losses, at $7.9 billion.

2024, from the Consumer Sentinel Network Data Book 2024:

2.6 million fraud reports. 38% of them said money was lost.
$12.5 billion in total reported fraud losses. The median loss was $497.
Bank transfers and payments had the highest total reported losses of any payment method, at $2.09 billion, followed by cryptocurrency at $1.42 billion. Credit cards were the payment method named most often in fraud reports.
Imposter scams: 845,806 reports, $2.95 billion lost.

UK fraud losses and APP scams: UK Finance

The UK Finance Annual Fraud Report 2026 covers fraud reported by UK Finance members in 2025. Losses are gross: "the total value of fraud including any money subsequently recovered by a bank." One case is one account or card, not one person.

UK totals for 2025 (change in losses against 2024):

Unauthorised fraud: £703.4m lost (−5%), 3,814,128 confirmed cases.
APP fraud: £576.4m lost (+19%), 248,070 confirmed cases.
Total: £1,279.8m lost (+4%), 4,062,198 confirmed cases.

In unauthorised fraud, the account holder doesn't authorise the payment: a third party makes it. In authorised push payment (APP) fraud, a person or business is tricked into authorising a payment to a criminal. Points from the same report:

APP losses on non-personal (business) accounts were £75.6m across 7,504 cases in 2025, down 11% from £84.9m.
£354.3m of APP losses was returned to victims in 2025, through bank refunds or recovery of funds. That is about 61% of losses.
Invoice and mandate scams, where a criminal poses as a genuine payee (such as a supplier) and redirects an invoice payment, cost £41.3m across 2,305 cases. UK Finance says this was its lowest loss total ever reported. £28.0m of that (68%) was on business accounts, across 1,217 cases. UK Finance notes that businesses "make genuine higher-value payments more regularly, making it harder to spot and stop a fraudulent one."

UK Finance revises earlier years. Its 2026 report shows APP losses of £484.0m for 2024, so use the latest report when you compare years.

EU/EEA payment fraud: EBA and ECB

The 2025 Report on Payment Fraud, prepared jointly by the European Banking Authority and the European Central Bank, analyses data that payment service providers report under PSD2. It covers 2022 to 2024 and the EU/EEA countries that reported the full time series.

€4.2 billion in fraudulent payment transactions in 2024, up €602 million (17%) from 2023.
Credit transfers: €2.5 billion of fraud in 2024, up 24%. The fraud rate was 0.001% of the value of credit transfers. "Manipulation of the payer" accounted for more than half of the value of fraudulent credit transfers.
Cards (issued in the EU/EEA): €1.3 billion, up 4%, with a fraud rate of 0.033%. Cards had the largest number of fraudulent transactions.
Who bore the loss: payment service users (customers) bore about 85% of credit transfer fraud losses in 2024, compared with 38% for card payments.
Cross-border cards: card fraud rates were about seventeen times higher when the counterpart was outside the EEA, where strong customer authentication may not be required, than for domestic transactions.

Worked example: turning a statistic into a control decision

Illustrative only. The business and its costs are hypothetical, and the UK Finance figures are averages.

A UK wholesaler gets about 30 requests a year from suppliers to change their bank details. Its finance lead wants to know whether a call-back check is worth the time. The check means calling the supplier on a number already on file, never one given in the request.

The size of one loss. In 2025, invoice and mandate scams on business accounts caused £28.0m of gross losses across 1,217 cases (UK Finance). £28.0m ÷ 1,217 ≈ £23,000 per case. UK Finance reports values to the nearest £0.1m, so this is approximate. Of that £28.0m, £10.6m was returned to business victims, which leaves about £17.4m, or roughly £14,300 per case after money was returned.
The cost of the control. Assume each call-back takes 10 minutes and staff time costs £30 an hour: 30 × (10 ÷ 60) × £30 = £150 a year.
Reading it correctly. The comparison doesn't tell the business how likely it is to be targeted. UK Finance publishes no rate per business, and an average hides very large and very small cases. What it does show is that one average loss of this type would pay for the call-back check many times over. That is enough to justify a control that costs £150 a year.

The same approach works with other figures on this page, as long as you keep the denominator in mind. AFP's 76% is a share of surveyed organizations that saw attempts. You can't multiply it by a loss amount to get an expected loss.

Frequently Asked Questions

What percentage of businesses experience payment fraud?

In AFP's 2026 survey of 465 treasury practitioners at US organizations, 76% said their organization experienced attempted or actual payments fraud in 2025. In the 2025 survey of 521 practitioners, the figure was 79% for 2024. These figures include attempts that didn't succeed. They are not loss rates.

How much money is lost to business email compromise?

Complainants reported $3,046,598,558 in BEC losses to the FBI's IC3 in 2025, across 24,768 complaints. That made BEC the second-largest loss category after investment fraud. In 2024, the figure was $2,770,151,146 from 21,442 complaints. These are reported losses, not an estimate of all BEC.

What is the most common payment method targeted by fraud?

In AFP's 2026 survey, checks were the most-targeted payment method for US organizations in 2025: 58% of respondents cited them, ahead of ACH debits (30%) and wire transfers (25%). In FTC consumer data for 2024, bank transfers and payments had the highest total reported losses, while credit cards were named most often.

How much is lost to APP fraud in the UK?

UK Finance members reported £576.4 million of authorised push payment fraud losses in 2025, across 248,070 cases. That was up 19% on 2024. £75.6 million of it was on business (non-personal) accounts, and £354.3 million in total was returned to victims.

How often do businesses recover money lost to payment fraud?

In AFP's 2025 survey, covering 2024, 22% of organizations recovered 75% or more of the funds lost to payments fraud, down from 41% in 2023. 58% recovered up to 75%.

How big is payment fraud in Europe?

The EBA and ECB reported €4.2 billion of fraudulent payment transactions across the EU/EEA in 2024, up 17% from 2023. Credit transfers accounted for €2.5 billion and cards issued in the EU/EEA for €1.3 billion. The overall fraud rate stayed at about 0.002% of total transaction value.

Was this article helpful?

Payment Fraud Statistics: What the Original Reports Say