Australia's CNP Fraud Statistics and Authentication

Australia’s CNP fraud statistics, the card-not-present (CNP) figures published by the Australian Payments Network (AusPayNet), tell two different stories at once. Fraud on Australian cards used with Australian merchants is at record-low rates. Fraud on Australian cards used with overseas merchants runs more than ten times higher. The gap between the two says a good deal about where authentication is being applied, and where it is not.

What the latest CNP fraud statistics show

AusPayNet publishes fraud statistics twice a year. At the time of writing, the latest releases cover calendar 2024 and the 12 months to 30 June 2025 (FY25).

Measure	Calendar 2024	FY25 (July 2024 to June 2025)
Total card fraud on Australian-issued cards	$913 million, up 20%	$854 million, down from $868 million
Overall card fraud rate	78.8 cents per $1,000	71.8 cents per $1,000, down from 77.6 cents
Domestic CNP fraud	$362 million; rate a record low 97 cents per $1,000	$312 million, down from $351 million; rate a record low 75 cents per $1,000
Overseas CNP fraud	$454 million, up 25%; $12.08 per $1,000	Rate $10.75 per $1,000, down from $12.45
Overseas share	3% of card spend; 50% of all card fraud	More than 10 times the domestic CNP rate

Sources: AusPayNet calendar 2024 release; AusPayNet FY25 statistics and FY25 snapshot.

Reading the gap

Calculated from AusPayNet’s FY25 figures, the overseas CNP fraud rate ($10.75 per $1,000) was about 14 times the domestic rate (75 cents per $1,000). AusPayNet attributes the low domestic rate to its CNP Fraud Mitigation Framework, the use of strong customer authentication and members’ wider efforts, and notes that overseas CNP transactions sit outside Australia’s regulatory framework.

In authentication terms, the domestic framework links a merchant’s fraud performance to an obligation to authenticate, and domestic participants are bound by it. Overseas merchants are not, so many Australian cards are used overseas without EMV 3D Secure (EMV 3DS) authentication ever being requested. Our article on the RBA review feedback covers the policy options that submissions raised to close that gap.

The FY25 overseas rate fell from the previous year, which is encouraging, but a single year is not yet a trend. Calendar 2025 figures had not been published at the time of writing.

What issuers can act on from the CNP fraud statistics

Split your own CNP fraud into domestic and overseas, and overseas into authenticated and unauthenticated, to see where your exposure actually sits.
Tune Access Control Server (ACS) rules for cross-border requests that do arrive with authentication, since those are the overseas transactions you can influence directly.
Review authorisation strategy for unauthenticated cross-border CNP payments, balancing fraud against declining genuine travellers and online shoppers (how issuers should use 3DS results at authorisation).

What merchants can take from them

For Australian merchants, the domestic numbers are a reminder that the CNP Fraud Mitigation Framework sets thresholds above which merchants must authenticate, and that domestic CNP fraud is falling as authentication is applied. Keeping authentication data complete and well integrated is how merchants stay on the right side of those thresholds without unnecessary friction (how merchants should measure 3D Secure performance).

Frequently asked questions

How much CNP fraud is there in Australia?

AusPayNet reported CNP fraud on Australian-issued cards of $816 million in calendar 2024, 90 per cent of all card fraud. In FY25, domestic CNP fraud was $312 million.

Why is overseas CNP fraud so much higher?

AusPayNet notes that overseas CNP transactions sit outside Australia’s regulatory framework. Overseas merchants are not bound by the domestic CNP Fraud Mitigation Framework, so authentication is often not requested.

Is the CNP Fraud Mitigation Framework working?

AusPayNet points to record-low domestic CNP fraud rates in both calendar 2024 and FY25 as evidence of its effect, alongside strong customer authentication and members’ own efforts.

When will the next CNP fraud statistics be published?

AusPayNet publishes twice a year. Calendar-year figures have typically been released between August and September; at the time of writing, calendar 2025 figures had not yet been published.

Does EMV 3DS help with overseas CNP fraud?

Only when the overseas merchant requests authentication. When it does, the Australian issuer’s ACS can assess and challenge the transaction; when it does not, the issuer is left with its authorisation decision.

Acting on the data

GPayments provides ActiveAccess for issuers and ActiveServer for acquirers, PSPs, and merchants. To discuss what your own CNP fraud picture says about authentication, contact GPayments.