We Expected a Surge in CNP Fraud

It’s not that I’m disappointed that CNP fraud didn’t surge with the EMV chip rollout, but it certainly wasn’t what I expected. My favorite research at the Kansas City Fed (who here can introduce me to Fumiko Hayashi?) published another paper of great interest on the  Curious Case of U.S. Card-Not-Present Fraud (not it’s actual title, which instead is “Card-Not-Present Fraud Rates in the United States After the Migration to Chip Cards,” which is very thoughtful but not as fun).

By way of background for anyone new to the industry, the U.S. was late to the game in rolling out the requirement for EMV chip support at retail terminals in 2015. So, we had a lot of data from other countries to indicate what would probably happen: when it got harder to conduct fraud at the point-of-sale in person, the fraudsters would shift online.

Fraudsters are clever and know how to hustle, so fraud has shifted, but not in the way we expected.

If you’ve ever tried to explain why a magstripe still works on a U.S. card in 2025, you already know: America’s EMV migration was long, patchy, and full of loopholes you could drive a fleet of skimmers through. While Europe, Australia, and Canada saw sharp CNP fraud spikes post-EMV, the U.S. story was very slow on the take because fraudsters follow the path of least resistance.

March of (Credit Card Authorization Technology) Progress

According to the Kansas City Fed, CNP transaction fraud rates rose modestly between 2013 and 2015. Dual-message networks (Visa, Mastercard, Discover) saw rates creep up from 14.3 to 16.9 basis points. Single-message networks (your STAR, NYCE, and PULSE types) jumped from 2.1 to 8.5 basis points, but then… didn’t keep climbing.

That’s weird. In payments, weird usually means “there’s nuance.” So let’s get into it.

Why Didn’t Fraud Explode Here Like It Did Elsewhere?

1. Card-present fraud isn’t low:  EMV helped, sure, but the lack of PIN requirements at the point of sale in the U.S. left just enough softness in the system that fraudsters didn’t have to migrate online immediately.
2. We already had digital defenses: We weren’t starting from zero on CNP fraud tools when the chip cards finally showed up. Tokenization, real-time machine-learning risk engines, behavioral biometrics, etc.; if it’s got a buzzword, we already use it. Thanks, Stripe and friends.
3. We learned from everyone else’s experiences:  Being late to the chip card party meant we could look at the UK’s 2008 or Australia’s 2014 spike and say, “Maybe we shouldn’t make the same mistakes.” Credit where it is due: merchants, networks, and issuers did respond more proactively here.

Sponsored by Burgopak Packaging

Packaging For Better.

The physical card has become not just a bank card, but a membership card. In the absence of a handshake, the way it is presented through packaging fundamentally defines the first “hello and welcome to the club." Unboxing your product for the first time marks the beginning of an important relationship and it should be the moment you reward people for making the right choice: for choosing you. 

Burgopak is offering CardsFTW readers a free packaging consultation. Just mention CardsFTW in the contact form on their website - burgopak.com

Meanwhile, CNP Volume Exploded

While the fraud rate growth was modest, the volume of CNP transactions skyrocketed. Dual-message networks saw CNP debit volume balloon from $360B in 2011 to $1.8T by 2021—yes, trillion with a T. Single-message networks grew more slowly, from $26B to $85B over the same period, but that’s still a 3x increase.

If you’re looking for the fraudster’s side hustle playbook, just follow the money.

Who Eats the Fraud Cost?

The real fun is the breakdown of who gets left holding the bag when a CNP transaction goes sideways.

That cardholder card is looking suspicious.

• Issuers: For dual-message networks, issuer losses have stayed almost suspiciously consistent, around four basis points, for the past decade. They’ve gotten good at chargebacks, fraud detection, and passing the cost downstream.
• Merchants: Here’s where the pain lives. Losses jumped from 10 bps in 2011 to 15 bps in 2019, before settling back to 13.4 bps in 2021. You're the fraudster's favorite customer if you’re not using 3D Secure, address verification, and device fingerprinting by now.
• Cardholders: The good news is that consumers don’t pay much of the cost. The bad news is that “not much” is rising, from 0.4 bps in 2011 to 1.8 bps in 2019. The implication? Either people are getting better at missing the fine print, or issuers are quietly cost-shifting.

What’s Next?

The CNP fraud problem isn’t going away. It’s just evolving. The steady rise in volume means even small percentage losses stack up fast, and fraudsters are nothing if not adaptable. We’ve seen them turn return fraud into a Shopify playbook. Imagine what they’ll do when they get bored of BIN attacks and move on to faster LLM-driven synthetic identities.

Here’s where the industry should be focusing next:

• Raise the bar on merchant auth:  If your checkout still runs without 3DS2, device intelligence, or risk-based step-up, you’re just daring a botnet to test your defenses.
• Continue reducing friction for good actors:  The trick isn’t just stopping fraud, it’s doing it without torching conversion rates. Real-time decisioning is table stakes. If you’re still batch processing, you’re toast.
• Monitor cardholder behavior changes: Higher cardholder loss rates could mean people are falling for more scams or disputing fewer charges. Either way, the root cause matters, especially if you’re an issuer trying to minimize downstream service costs.
• Consider liability reform:  This data could preview the next round of policy fights. As fraud costs shift and certain actors eat more than their share, expect more public-private tension over who pays, when, and why.

Fraud doesn’t disappear, it just migrates. EMV may have locked the front door, but CNP fraud snuck in through the window and brought cookies. The good news? The U.S. didn’t get slammed as hard as it could have. The bad news? A new wave of AI-powered fraud is already showing up at every entrance. Batten down the hatches!

Southwest Bags Fees: Just a Credit Card Play?

I’m not usually one for reposting my social media (which, to be clear, is only LinkedIn) on my newsletter, but this recent post got a lot of attention:

#creditcards #rewards #southwest #tanstaafl | Matthew Goldman | 13 comments

My new theory is that Southwest Airlines created a checked bag fee not for the direct revenue of $35 per bag, but to en…

LinkedIn •Matthew Goldman

My new theory is that Southwest Airlines created a checked bag fee not for the direct revenue of $35 per bag, but to entice people to sign-up for a JPMorganChase Southwest Airlines Visa card that includes a free checked bag.

I have no idea what’s going on with Southwest Airlines, which used to be my favorite. I think I’ve flown Southwest more than 300 times. I have always loved the no-assigned seats and limited fees. I never check bags, so that part wasn’t important to me, but I think the airline is making a massive mistake in becoming just like its competitors.

Putting your CEO's name on the card is a choice.

Along those lines, they have introduced a $35 per bag checked baggage fee and, just like their competitors, enabled free checked bags as a perk on their credit card. Savvy fliers know that airline cards are for more than just earning points, and that cards bring other perks, from earlier boarding to free bags. 

Like I said above, I think this might just be a play to drive credit card revenue with Chase. It's not a bad move, but I think Southwest is going to struggle mightily post-change and will turn into something that looks a lot like American or United, but with a very weak international footprint and nary a lounge in sight.

CardsFTW

CardsFTW, released weekly on Wednesdays, offers insights and analysis on new credit and debit card industry products for consumers and providers. CardsFTW is authored and published by Matthew Goldman and the team at Totavi, a boutique consulting firm specializing in fintech product management & marketing. We bring real operational experience that varies from the earliest days of a startup to high-growth phases and public company leadership. Visit www.totavi.com to learn more.