UK Payments Fraud Nears £1.3 Billion as Firms Shift from Prevention to Resilience

UK payments fraud costs close to £1.3 billion a year, even as banks prevent more attempted fraud than criminals take. With artificial intelligence helping attackers scale, resilience is becoming as important as prevention.

Payments firms can block billions in attempted fraud and still face losses approaching £1.3 billion. That gap points to a hard limit in a strategy built around stopping every attack: criminals change their methods faster than any single control can be redesigned. My read is that the sector needs to judge its defences by whether they can contain losses and keep payments working under pressure, as well as by how much fraud they prevent.

That is the argument from Scott Dawson, chief executive of DECTA UK, part of payment technology provider DECTA. Dawson has more than 20 years of experience in payments and leads the company’s UK strategy, with a focus on growth and small and medium-sized businesses. The views here are his own.

Fraud losses persist alongside prevention

UK Finance’s latest fraud report records nearly £1.3 billion in losses across more than four million cases in one year. That equates to roughly eight incidents a minute, or £18.57 per UK resident. At the same time, the banking sector prevented £1.68 billion in attempted fraud before money moved. The figures describe both the scale of the effort and the limits of prevention: significant sums are intercepted, but substantial losses still reach victims.

Attackers are also expanding their reach with artificial intelligence. Dawson points to cloned voices, scripts adapted for different countries and access to British victims through global platforms. These tools allow criminals to operate at greater scale. For payments businesses, that makes a fixed set of controls vulnerable to being outpaced as fraud patterns shift.

One example is the movement between fraud types. When firms strengthen controls against authorised push payment fraud, attackers can redirect activity toward high-volume, lower-value attacks on remote purchases. A prevention-first approach can treat each change as a separate gap to close, with zero fraud as the implicit destination. Dawson argues that a more durable approach treats shifting attacks as a permanent operating condition and builds systems to limit the damage.

That change in perspective matters commercially as well as operationally. A payments business that can keep serving merchants through disruption may be better positioned to retain their confidence. The aim isn’t to accept avoidable losses; it’s to make sure one attack or failure doesn’t disable the wider operation.

Designing for disruption

Dawson draws a parallel with climate adaptation. The UK Climate Change Committee’s assessment, A Well-Adapted UK, published in May 2026, says the country was built for a climate that has already changed. It advises planning for roughly 2°C of warming by 2050, treating that level as a floor rather than a target, because further warming is already locked in.

The broader lesson is a shift from relying mainly on prevention to preparing for conditions that can no longer be avoided in the near term. Dawson sees the same need in payments: fraud cannot realistically be eliminated, but losses can be managed, and services can be designed to withstand attacks. That calls for layered controls, real-time monitoring, behavioural signals and systems that can continue processing when circumstances allow, rather than shutting down at the first sign of trouble.

In practice, resilience starts with understanding dependencies. Firms need to know which parts of their technology stack can fail without taking the rest offline. They also need to set an acceptable loss level for each product and plan how to keep taking payments if a provider, network or power grid becomes unavailable. Those choices make resilience an operational capability that can be assessed and built, rather than a broad promise to prevent all fraud.

A blackout in Spain and Portugal on 28 April 2025 showed what those preparations can mean for merchants. The grid collapse left payment terminals unable to connect to acquirers and ATMs out of service. In some shops, cash became the only working payment option. Merchants with offline capability, backup power, cash in their tills and staff trained to respond were able to keep trading. Those reliant on a continuously available power supply and cloud services had fewer ways to operate.

The episode offers a practical test for payments providers: what happens when several dependencies fail at once? A system designed only for normal conditions may leave merchants unable to take money precisely when they need alternatives. Planning for outages can mean having fallback options and clear procedures ready before a disruption arrives.

Stress tests already have a precedent

Extreme heat has exposed similar assumptions in UK infrastructure. On 19 July 2022, temperatures in eastern England rose above 40°C for the first time since records began. Supermarket chillers and freezers struggled beyond their specified operating limits. Google and Oracle also powered down parts of their London data centres to protect servers from overheating, causing some websites and services to go dark.

These examples underline the cost of designing around historical conditions that no longer hold. A facility can be well resourced and still be vulnerable if its operating assumptions are outdated. Payments firms face their own version of that problem when controls, infrastructure and continuity plans are built around an attacker or outage profile that has already changed.

Dawson’s comparison also challenges the idea that refusing to adapt is a sign of seriousness. In climate planning, declining to prepare for heat does not reverse warming. In payments, pursuing a zero-fraud goal without building operational resilience can leave firms less prepared for attacks that get through. Prevention remains necessary, but it cannot carry the whole burden.

Adaptation requires an honest view of what a business can and cannot control. For payments leaders, that means measuring prevention while also asking how much service can continue during an attack, how quickly losses can be contained, and whether merchants know what to do when their usual payment routes fail. Fraud and outages will keep testing those plans. The firms best placed to withstand that pressure will be those that have made resilience part of how their services are designed and operated.