Most fraud reports lead with one number: losses, by value, often as a share of volume. It is counted precisely because the evidence arrives on its own, as chargebacks, claims and write-offs. The cost on the other side arrives quietly. A good customer who is declined, challenged twice or held for review rarely complains in a way that reaches the report. Some try again, some pay with another card, and some leave. A programme judged on losses alone drifts towards refusing more, and its report keeps improving while it does.
Measure fraud and friction together
A fraud rate that falls while good customers are turned away is a loss that does not show on the fraud report.
The one-number trap
Losses matter, and in many markets they are small as a share of value. The European Banking Authority and the European Central Bank put the payment fraud rate in the European Economic Area at around 0.002% of the value of transactions, while total reported fraud rose to EUR 4.2 billion in 2024 from EUR 3.5 billion in 2023. For credit transfers, payment service users bore about 85% of the losses in 2024, mostly through scams that led them to send the payment themselves. A rate that small can still mean large sums, and it says nothing about the customers who were stopped on the way.
Merchants increasingly report it this way. The Merchant Risk Council's 2026 Global eCommerce Payments and Fraud Report, as summarised by Visa Acceptance Solutions, found that payment success rate and revenue rank as the top two of 14 payment measures for merchants worldwide, and that false positives continue to rise even as overall fraud declined for a second year. In the Council's 2025 survey of 1,082 merchant professionals, merchants put the share of annual e-commerce revenue lost to payment fraud at 3.2% globally. The loss figure and the success rate describe the same decisions, so they should be read together.
A scorecard with both sides
Show these measures together, for the same period and the same customer segments, every time the fraud figures are presented.
- Fraud losses
- By value and by count, split by type: card not present, account takeover, scams the customer authorises, first-party misuse.
- Approval or payment success rate
- The share of genuine attempts that complete, measured from the customer's first try.
- False positives
- Good payments declined or held, estimated as described below, with the value they carried.
- Step-up rate and completion
- How often customers are asked to prove who they are, and how many finish. A step-up that customers abandon works like a decline and should be counted as one.
- Manual review
- Share of payments sent to review, time to a decision, and how often reviewers overturn the system.
- Customer contacts
- Calls, chats and complaints that follow a decline or a challenge.
- Good customers lost
- Customers whose activity falls away in the months after a decline, compared with similar customers who were approved.
Estimate false declines honestly
A declined payment never shows what would have happened, so false declines cannot simply be counted. Three kinds of evidence, used together, give a defensible estimate.
The first is a small controlled group. Approve a small, random share of the payments the system would have declined, within limits your risk appetite sets in advance: low amounts, familiar products and a cap on total exposure. Their outcomes show how many declines fell on good customers. It is the only direct measure, and it stays cheap while the limits are firm.
The second is retries that later succeed. When a declined customer pays successfully soon afterwards with the same card, account or device, the first decline was probably wrong. Count these, and allow for fraudsters who also retry.
The third is customer contacts. A decline followed by a call or chat from the account holder is strong evidence of a good customer, and the reasons they give show where rules are drawn too broadly.
Credit teams know this problem as reject inference. A model that learns only from approved loans never learns whether the declined applicants would have repaid, so it can lock in yesterday's decisions. The remedies carry over: controlled exploration within risk appetite, and a holdout group that reveals the system's real effect.
Allow for outcomes that arrive late
Fraud outcomes take time to appear. Chargebacks can arrive weeks after the payment, and scam victims often report only once they realise what happened. A week that looks clean today may look different two months from now.
Show each period with its maturity: how much time has passed, and what share of its eventual losses has usually been reported by that age. Compare this month's early figures with last year's figures at the same age, and mark recent periods as provisional on every chart. Base threshold decisions on mature periods and use recent ones as early warnings.
Put fraud and growth on one page
Fraud teams are usually rewarded for lower losses and growth teams for more approved customers, and each can improve its own number at the other's expense. Agree a single view instead: a curve of expected fraud losses against approval rate for the current strategy, showing where each proposed change would move the business. A change that moves along the curve is a choice of appetite and belongs to both teams. A change that shifts the curve, catching more fraud at the same approval rate, is a genuine improvement and should be proven on past payments before it goes live.
Set targets on that curve, such as a ceiling on fraud losses with a floor on approvals, segment by segment. New customers, cross-border payments and high-value orders each deserve their own targets, since one blended rate hides where the friction sits. The method applies to issuers and marketplaces in the Gulf as much as anywhere else.
Count the full cost of each decision
For each response (approve, decline, step up, review or hold) add up the fraud that gets through, reviewers' time, the cost of each step-up message or call, the margin lost when a good customer abandons, contacts and complaints, and reimbursements where the rules require them. According to UK Finance, banks reimbursed GBP 267.1 million of authorised push payment fraud in 2024, around 59% of the money stolen that way. The same report says the industry prevented GBP 1.45 billion of unauthorised fraud, equivalent to 67p in every GBP 1 attempted. Prevention figures like these belong next to losses, provided the friction that paid for them is reported too.
Then judge any change at the level of the decision, against a control: a holdout group in which the current process continues for a share of cases. Report the change in outcome per decision multiplied by volume, with every cost above included.
Where to start
Questions to ask your team or vendor
- What share of our declines is tested or reviewed later, and how do we estimate false positives?
- How long until a month's fraud outcomes are mostly reported, and do our reports mark recent periods as provisional?
- What happens to a good customer after a decline: do we track retries, contacts and drop-off?
- How many customers abandon a step-up, and do we count them as declined?
- Can each rule or model change be run on past payments first, with its effect on both fraud and approvals shown?
- What does each response cost us in full, people included?
Practices to adopt
- Report fraud losses and good-customer friction side by side, every time.
- Estimate false declines with a controlled group rather than guesses.
- Treat recent results as provisional until outcomes mature.
- Set targets as a trade-off both teams agree.
- Measure the full cost per decision.
Mantika Argus answers each payment with approve, decline, step up, review or hold, and when in doubt it asks the customer rather than refusing.
Sources
European Banking Authority and European Central Bank, joint report on payment fraud, press release of 15 December 2025 (EEA fraud rate around 0.002% of value; EUR 4.2 billion in 2024 and EUR 3.5 billion in 2023; for credit transfers, users bore about 85% of losses in 2024)Visa Acceptance Solutions, Why payment success rate is now a fraud metric, citing the Merchant Risk Council 2026 Global eCommerce Payments and Fraud Report (top two of 14 measures; false positives rising as fraud declines for a second year)Merchant Risk Council, 2025 Global eCommerce Payments and Fraud Report (survey of 1,082 merchant professionals, October to November 2024; 3.2% of e-commerce revenue lost to payment fraud)UK Finance, Annual Fraud Report 2025 press release, 28 May 2025 (calendar 2024: GBP 267.1 million of APP fraud reimbursed, around 59%; GBP 1.45 billion of unauthorised fraud prevented by the industry, 67p in every GBP 1)