In 2025, the Police Crime Statistics of Germany (PCS) recorded 96,383 incidents of payment fraud using unlawfully obtained payment instruments, a 4.8% year-over-year increase. Computer fraud involving unlawfully obtained card details has risen sharply, with incidents up 177.4% between 2019 and 2025.

As a result, German companies face growing pressure to act. They must implement effective security measures to protect against financial loss and fraud while keeping customers safe. For these businesses, consistent safeguards are paramount to a secure, trustworthy payment process.

In this article, you’ll learn what online transaction fraud means and what types of fraud can affect German businesses. We’ll also explain what the best practices are when it comes to security and prevention, what role Strong Customer Authentication (SCA) can play, and how businesses can ensure security without sacrificing conversion rate.

Key takeaways

• Online transaction fraud is an umbrella term encompassing different kinds of fraud committed in the context of digital payment processes.
  
• Fraudulent actors gain access to personal information, financial data, or login details through methods such as identity theft, account takeover, phishing, or social engineering.
  
• Credit card, wire transfer, and direct debit fraud, as well as fraudulent orders, can lead to financial losses for businesses.
  
• Effective fraud prevention combines technical security measures with transaction monitoring, clear processes, and employee training.
  
• While Strong Customer Authentication (SCA) provides an additional layer of security, it cannot prevent online transaction fraud entirely.
  

What is fraud?

Fraud describes any willful deception or other dishonest act intended to procure a financial or other advantage for the perpetrator through unlawful means. Fraud can occur in many contexts and affect both businesses and private individuals.

Online transaction fraud refers to illicit activity committed through digital transactions. This includes unauthorized payments, misuse of stolen payment information, or the manipulation of payment processes. Fraudsters use various tactics to access confidential data or manipulate these workflows.

How do fraudsters commit online transaction fraud?

Often, fraudsters must obtain personal information, payment details, or login credentials before they can make an unauthorized purchase, manipulate a transaction, or commit another type of online transaction fraud. They use several methods to obtain these details.

Identity theft

Identity theft is when criminals misuse another person’s personal information to pretend to be that person. They can obtain these details through data breaches, phishing attacks, or social engineering. Criminals then use these stolen identities to open accounts, make unauthorized purchases, or perform other transactions.

This type of fraud particularly affects businesses that manage customer data and online accounts. Therefore, online retailers, financial service providers, and subscription providers must protect their own payment schemes as well as their customers’ personally identifiable information.

Account takeover

An account takeover occurs when a fraudulent actor gains access to a customer’s or business’s online account, often using stolen logins, phishing attacks, or data from previous security incidents. Once they have access, they can change delivery addresses, place orders, or view stored information.

Phishing and social engineering

Phishing and social engineering rely on deception, rather than a direct, technology-based attack. Scammers pretend to be a bank, retailer, or other trustworthy organization, and try to get customers or employees to disclose logins or sensitive details. They can then use the data to make unauthorized payments, take over accounts, or commit identity theft.

Chief executive officer (CEO) fraud

A special type of social engineering is so-called CEO fraud. In this case, scammers pretend to be a C-suite executive, line manager, or business partner. The aim is to get employees to make payments or reveal confidential information. Criminals often do this using fake or manipulated emails that, at first glance, appear to come from a known or trustworthy sender.

What types of online transaction fraud can affect German businesses?

Once fraudulent actors obtain payment information or account logins, they can use them to commit various types of online transaction fraud. Ecommerce scams play a role here, but the dangers go beyond simple online retail. Such activity can also target businesses and their customers during other payment processes. Below are some of the most common scam tactics:

Credit card fraud

Credit card fraud occurs when fraudsters use stolen card details to pay for goods or services. In ecommerce, this often takes the form of so-called card-not-present (CNP) fraud, where the payer doesn’t need a physical card. Criminals obtain these credentials through phishing, hacking, or other methods and use them to make unauthorized purchases.

Another form of credit card fraud is so-called card testing: criminals start with small transactions to test whether the stolen card details are still valid. If the payment goes through, they can make larger purchases. These schemes can affect both private individuals and businesses that accept credit or debit card payments, including online retailers and digital content providers.

Wire transfer fraud

Wire transfer fraud occurs when scammers try to trick businesses or their customers into making unauthorized wire transfers or altering an existing payment. This often involves fake invoices or payment requests. Another version involves manipulating business partners’ bank details to divert funds to an account controlled by an unauthorized third party.

Direct debit fraud

Criminals can also use direct debits to commit fraud. They can use someone’s account details to set up unauthorized direct debits. Businesses can be affected as both payers and payees. This kind of activity can cause financial losses for affected businesses, plus time and money spent on chargebacks, reviews, and processing customer queries.

Fraudulent orders

Fraudulent orders occur when someone purchases products or services using someone else’s payment details. They might be placed using stolen credit card details or a captured customer account. For businesses, the risk is delivering goods or rendering services when the person placing the order did not lawfully authorize the payment.

Chargeback fraud

Chargeback fraud refers to the misuse of chargebacks or refunds. This does not necessarily involve external actors: customers can also dispute a legitimate transaction, for example by telling the payment service provider (PSP) they did not authorize the payment or did not receive the product they ordered.

This can lead to financial losses for businesses, as they must refund the original payment amount and then incur extra fees and processing costs. The practice particularly affects online retailers and other businesses that accept payments via credit card or similar methods.

What risks are involved with different payment methods?

Beyond classic fraud tactics, businesses in Germany also need to protect themselves against payment default. This risk is shared differently among businesses, customers, and PSPs depending on the payment method. With some methods, payment is authorized and processed instantly; with others, businesses face a higher risk of default or fraud.

Purchase on account

Purchase on account—where businesses deliver goods or render services before receiving payment—is particularly relevant here. If an order was placed using a false identity, a customer account was misused, or the buyer cannot settle the invoice, the business can suffer financial losses after delivering the goods or rendering the service. This differs from payment-on-invoice and methods where funds are collected before or during the order process.

Prepayment, card payment, and direct debit

With prepayment, a business receives funds before supplying the goods or services. That significantly reduces the business’s risk of payment default. With cards, the charge is typically processed at the time of the sale. However, chargebacks or liability rules can mean that a payment initially confirmed later becomes a financial risk for a business.

With direct debits, businesses cannot be certain they will keep the funds after they are debited. While they initially receive the invoice amount, they must also consider that payments can be refunded under certain conditions. This is especially relevant for recurring payments or larger sums where the money has already been transferred.

Selection factors

The risks a payment method poses to a business extend beyond when the money arrives in its business account. The PSP’s terms and conditions, return policies, and who bears the financial risk if a payment is not authorized or honored all matter. Businesses need to factor these considerations into how they select and design their payment processes.

How can businesses in Germany identify and prevent fraudulent transactions?

Fraudulent transactions can have significant financial and reputational implications for businesses. Fraud prevention refers to everything businesses do to identify, prevent, and mitigate the impact of fraud. Early detection and prompt action are particularly valuable. An effective strategy for combating online transaction fraud combines technical security measures with clear internal processes, employee training, and continuous monitoring of transactions and accounts. Different strategies work in different situations, depending on a business’s model, payment processes, and risk profile.

• Implement robust security measures
  Modern safeguards help protect payment data, customer information, and systems against unauthorized access. They include multifactor authentication (MFA), encryption, and secure communication channels. Regularly updating software and systems helps close known security vulnerabilities.

• Train employees
  Because much fraud relies on deception and social engineering, well-trained employees contribute greatly to fraud prevention. Training needs to cover fraud patterns, warning signs, and how to handle confidential information securely. Employees also need to know who to contact if they spot suspicious activity and report incidents without delay.

• Monitor transactions and accounts
  Continuously monitoring transactions and accounts can help to flag unusual activity early. Modern detection tools can analyze transaction patterns and identify anomalies. Businesses in Germany can also implement transaction limits, velocity checks, or risk-based screening.

• Inform customers
  Customers can support prevention efforts. Businesses can share information on the latest fraud attempts, secure payment methods, and how to keep login details and personal data safe. Clear guidance on reporting suspicious activity helps businesses respond quickly to potential fraud.

• Verify customers
  Appropriate customer verification procedures can help protect against identity theft and account takeover. Depending on the business model, this could include identity verification, additional authentication, or risk-based screening. Credit information from credit reference agencies such as SCHUFA can also help businesses in the country assess default risk more accurately.

• Share information and experiences
  Scam tactics are constantly changing. Businesses can benefit from regularly talking to PSPs, financial institutions, professional bodies, and other relevant organizations. Updates on new fraud patterns, current threats, and appropriate prevention measures can help enhance existing security mechanisms.

• React quickly in case of fraud
  Despite comprehensive systems in place, fraud can never be fully prevented. Businesses in Germany still need to establish clear processes for handling suspicious transactions and confirmed fraud cases. This includes defining clear responsibilities, reviewing suspicious activity, and temporarily blocking payments or accounts where necessary.

What role do PSD2 and SCA play in fraud prevention?

In the European Union, the revised Payment Services Directive (PSD2) regulates online payment security. In Germany, the Payment Services Supervision Act (ZAG) implements major PSD2 provisions. One key security requirement is SCA.

What is SCA?

SCA requires the use of at least two independent elements from different categories:

• Knowledge: Something the user alone knows, e.g., a password or PIN.
  
• Possession: Something the user alone possesses, such as a smartphone or authentication device.
  
• Inherence: Something the user is, e.g., a biometric marker.
  

According to Section 55 of the ZAG, PSPs must require SCA whenever customers access a payment account online, trigger an electronic payment, or remotely perform an action that carries a risk of fraud or misuse.

That said, some payments are exempt from SCA requirements. Subject to specified conditions, these include small-value invoices and electronic remote payments that a transaction risk analysis categorizes as low-risk.

How can SCA protect against online transaction fraud?

SCA can help prevent fraudsters from using stolen passwords or login details to make payments. It strengthens defense against certain types of payment fraud.

Nevertheless, SCA cannot fully protect against online transaction fraud. Attackers can also try to get customers or employees to approve fraudulent transactions themselves.

How can businesses protect customers without sacrificing conversion rates?

Secure digital payments create a conflict of interest for businesses in Germany. While extra verification steps can reduce fraud risk, each stage in the authentication process slows checkout or makes it less convenient for customers. This can impact a business’s conversion rate, especially in ecommerce.

Businesses must therefore adopt a risk-based security strategy rather than a one-size-fits-all approach. SCA plays an important role here. Still, regulations exempt certain transactions, such as some low-risk payments. Businesses need to balance security with a smooth customer journey.

Businesses need to review their safeguards regularly and adjust them to their individual fraud risk, business model, and customer payment behavior. SCA shouldn’t be viewed in isolation; it needs to be used as part of a broader online transaction fraud strategy. This can include transaction monitoring, fraud detection, and other technical and organizational measures.

How Stripe Radar can help

Stripe Radar helps detect fraud and unlock growth, using AI trained on data from Stripe’s global network. Radar helps protect your business from fraud throughout the customer lifecycle before it affects your bottom line, while helping you approve more legitimate customers and payments.

Radar can help your business:

• Prevent fraud losses: Radar’s AI learns from more than $1.9 trillion in annual transactions across Stripe’s global network, helping it identify and block fraud patterns that individual businesses might not catch on their own.

• Unify protection across evolving fraud attacks: Radar brings protection against transaction fraud, account fraud, and customer abuse all into one solution, so you gain unified protection across major fraud types.

• Adapt as fraud evolves: Radar continuously adapts to changing fraud patterns, from first-party abuse to agentic transactions, helping protect your business against emerging threats.

• Work with your existing tech stack: Use Radar with Stripe payments with no integration required, or access Radar’s intelligence through programmable APIs, whether you process payments on Stripe or not.

Learn more about Stripe Radar, or get started today.

FAQs about online transaction fraud