Executive Overview
Card fraud is steadily migrating away from the physical card and toward the digital identity that provisions, authenticates and authorises it. This report tracks that migration across ten related attack patterns, and argues that the underlying detection question has changed as a result.
The Shift From Card Compromise to Identity Compromise
Tokenisation and network-level protections have made the raw card number a less durable fraud asset than it once was. In response, attack effort has moved upstream — toward the digital identity, device and authentication layer that controls how a card is provisioned, added to a wallet, or authorised for a transaction in the first place.
Typology Deep-Dive
- Card-not-present (CNP) fraud — remains the largest single category, increasingly executed via distributed, low-value testing rather than concentrated high-value attempts.
- Account takeover — credential theft or SIM-swap-enabled access used to reach card controls, statements, or provisioning flows.
- Credential compromise — phishing or malware-led capture of login credentials rather than card data directly.
- Digital wallet provisioning abuse — adding a stolen or synthetic card to a wallet via a compromised account.
- New-device activity — a card provisioned or used from a device with no prior relationship to the account.
- Token-related fraud — attacks targeting the tokenisation and de-tokenisation process itself rather than the underlying PAN.
- Merchant compromise — a breached or complicit merchant as the point of card-data capture.
- OTP and social-engineering bypass — the customer coaxed into sharing an OTP rather than it being technically intercepted.
- Refund abuse — manipulating the refund path following a card transaction (see the Merchant Fraud Intelligence Report for the merchant-side view).
- Card-to-UPI interactions — funds or credentials moving between card and UPI rails within a single fraud journey.
Key Intelligence Question
Is the fraudster stealing the card, or stealing control of the customer's digital identity? Framing every card-fraud investigation around this question changes where controls are placed — from the payment authorisation step alone to the onboarding, authentication and provisioning steps that precede it.
Detection Signals
- A burst of small-value authorisation attempts across multiple unrelated merchants in a short window.
- A new device or app installation followed shortly by card provisioning into a wallet.
- Authentication anomalies — repeated biometric failures falling back to OTP.
- A card added to a wallet and used for a high-value transaction shortly after onboarding.
- Geolocation mismatch between app registration and first transaction.
BANKiQ Perspective
As card fraud shifts from the card to the identity behind it, detection has to shift with it — from monitoring the payment step alone to monitoring the onboarding, authentication and provisioning steps that now carry a growing share of the actual attack surface.
Sources & References
- Reserve Bank of India — Regulatory Guidance & Statistics
- National Payments Corporation of India (NPCI)
External links open in a new tab. Referenced for authoritative context; BANKiQ is not affiliated with the linked bodies.