Cyprus payment fraud losses rise to €3.7m

The value of fraudulent payments in Cyprus rose 16 per cent year on year to almost €3.7 million during the second half of 2025, even as the number of cases fell 5 per cent to around 14,000, according to the Central Bank of Cyprus (CBC). Despite the increase in value, payment fraud remained relatively low both in absolute terms and as a share of total transactions. Fraud rates for most payment instruments were also below the euro area average. The only exception was credit transfers measured by value, where the fraud rate in Cyprus was slightly higher than the corresponding euro area rate. E-money and card payments recorded the highest fraud rates overall, both in Cyprus and across the euro area. The CBC said the higher value of fraudulent transactions partly coincided with a broader expansion in payment activity in Cyprus, meaning some of the increase may reflect the growing amount of money moving through the country’s payment system. Across the euro area, around nine million fraudulent transactions were recorded during the second half of 2025, broadly unchanged from the corresponding period of 2024, while their value increased 8 per cent to €1.9 billion. Card payments continued to generate most fraud cases in Cyprus, accounting for 93 per cent of the total, with approximately 13,000 fraudulent transactions recorded. Their share was considerably higher than the euro area’s 79 per cent, reflecting the greater use of cards in Cyprus. The number of fraudulent card payments nevertheless declined marginally from the corresponding period of 2024, while the euro area recorded a small increase. Credit transfers accounted for the largest share of the value of fraud, reaching €2m, 56 per cent of the total. Fraudulent card payments followed at €1.6m, 43 per cent, while all remaining payment instruments together accounted for less than €60,000. The value of fraudulent credit transfers increased by around 15 per cent in both Cyprus and the euro area. The value of fraudulent card payments, however, rose by about 20 per cent in Cyprus, while declining marginally across the euro area. No fraudulent transactions were reported involving direct debits or cheques, while fraud connected with money remittances accounted for a negligible share of both the number and value of cases. Although cards accounted for most incidents, Cyprus recorded the highest average value per fraudulent credit transfer in the euro area during the second half of the year. Each fraudulent credit transfer was worth an average of €6,300, more than three times the euro area average of €1,800. It was also higher than the €4,500 average value of credit transfers generally in Cyprus. The average credit transfer across the euro area stood at €6,100, meaning fraudulent credit transfers in Cyprus carried an unusually high average value despite their relatively low frequency. The CBC said this meant that “even a limited number of fraudulent transactions can be associated with substantial financial losses”. Customers and businesses carried most of those losses. In cases involving credit transfers, payment service users have historically borne an average of around 95 per cent of total reported losses, with payment providers and other parties absorbing only a small proportion. The distribution was different for card and electronic money fraud, where other parties involved in the transactions carried the largest share of the losses. Fraudulent card and e-money payments were also considerably smaller, averaging around €100 per transaction and remaining broadly in line with the euro area. Payer manipulation remained the dominant type of credit transfer fraud, accounting for 70 per cent of cases. This involves fraudsters using social engineering to deceive account holders into transferring money to accounts under their control. The remaining 30 per cent involved unauthorised payments, including transactions made using stolen or compromised banking credentials. Unauthorised transactions were even more dominant in card and e-money fraud, accounting for 97 per cent of fraudulent card payments and 90 per cent of e-money cases. These generally involved the misuse of stolen payment information. The CBC said the differences required separate responses. Credit transfer fraud increasingly calls for measures addressing social engineering and authorised push payment scams, while card and e-money fraud requires stronger protection of payment credentials and authentication systems. Instant credit transfers presented another area of concern. Their fraud rate by value was, on average, twice as high as that of conventional credit transfers in Cyprus. A fraudulent instant transfer was worth an average of €3,400, more than double the €1,500 average for instant transfers generally. Although instant payments still accounted for a very small proportion of fraudulent and overall credit transfers, their growing use warrants closer attention because transactions are completed within seconds and opportunities to recover the money are limited. Verification of Payee became mandatory for euro area payment service providers in October 2025. The service checks whether the recipient’s name matches the international bank account number, or IBAN, before a payment is completed, reducing the risk of fraud and misdirected transfers. However, its introduction came towards the end of the period covered by the report, meaning its effect was not yet visible in the data. Online transactions remained the main route for card fraud. Payments made at physical points of sale accounted for 70 per cent of card transactions by number, with online payments representing the remaining 30 per cent. Online payments nevertheless accounted for 60 per cent of the total value of card transactions in Cyprus, compared with 40 per cent for purchases made at physical terminals. Fraud was distributed far more unevenly. Only 4 per cent of fraudulent card transactions by number and 6 per cent by value involved physical points of sale. Online payments generated 96 per cent of card fraud cases and 94 per cent of their value, confirming that transactions made without the cardholder being physically present remain the main channel for card fraud. Credit cards were also more exposed than debit cards. Their fraud rate was approximately 1.5 times higher, both by number and value, which may partly reflect the higher credit limits and larger transactions typically associated with credit cards. Strong Customer Authentication (SCA) was associated with substantially lower fraud rates. In Cyprus, the fraud rate for card payments without SCA was almost four times higher by number and nearly three times higher by value than for transactions where SCA was applied. SCA requires customers to verify their identity using at least two independent elements, such as a password, possession of a mobile device or a biometric characteristic. However, SCA is not compulsory for every transaction, including certain low-value payments and cases where the other payment service provider is located outside the European Economic Area. Cross-border payments were another major source of risk. Although most payments in Cyprus involved domestic transactions, the majority of fraudulent activity across credit transfers, cards and electronic money involved payments sent to accounts held outside Cyprus. The number of fraudulent cross-border card transactions was approximately 15 times higher than the domestic total, reflecting the added difficulty of detecting, investigating and recovering funds when payments move between jurisdictions. The CBC also pointed to Cyprus’ national digital financial education portal, MoneyPedia, which provides information about common scams and ways of recognising and avoiding them.