Demivolt logo

Card Fraud Prevention for Businesses in Lithuania

Published 23 October 2026

How Lithuanian businesses can prevent card fraud: current EU and Bank of Lithuania data, a layered control checklist, and how to set up cards and accounts safely.

Card Fraud Prevention for Businesses in Lithuania

Card fraud prevention for a business comes down to four things: limiting who can spend, limiting how much and where, checking every unusual payment before it leaves, and training people to refuse the scripts fraudsters use. Technology such as strong customer authentication helps, but regulators in Lithuania and the EU now say plainly that it is not enough on its own. This guide sets out the current numbers, the controls that work, and a practical setup for a company that pays and gets paid by card and by transfer.

DemivoltAdd Structure to Business SpendingDemivolt offers business cards, role-based user management and multi-account structures for companies managing card expenses and payments.Visit Demivolt

TL;DR

  • Card fraud in the European Economic Area (EEA) is still growing in value, and fraudsters are shifting from breaking authentication to talking legitimate users into approving payments.
  • Lithuanian banks registered more than 13,000 fraud cases worth about 20 million EUR in 2024, so this is a local risk, not an abstract one.
  • Layer your defenses: separate accounts, role-based access, per-card limits, payment checks, and written rules for staff.
  • Never share CVV codes or one-time codes, and never lend your company account to a third party for a fee.
  • Act in minutes, not hours: block the card, call your provider, and document what happened.

Table of Contents

What the data says about card fraud in 2025 and 2026

The most recent EU-wide picture comes from the joint EBA and ECB report on payment fraud. It shows that total payment fraud in the EEA reached 4.2 billion EUR in 2024. Card fraud accounted for 1.329 billion EUR of that, a 29% increase on 2023, and the fraud rate for card payments was roughly 0.033% of transaction value.

The ECB press release on the same report adds context: the overall payment fraud rate stayed stable at around 0.002% of the total value of transactions, while the absolute value of fraud rose from 3.5 billion EUR in 2023 to 4.2 billion EUR in 2024. In other words, the share of fraud is small, but the sums lost are large and still climbing.

For Lithuania, the Bank of Lithuania reports that the banking sector registered over 13,000 fraud cases totaling approximately 20 million EUR in 2024. The regulator also publishes a dedicated page on fraud in payments made with cards issued by Lithuanian payment service providers, which is worth bookmarking if your finance team reports on fraud trends.

Two points from the EBA and ECB material matter most for a company:

  1. Authentication works, so criminals go around it. Strong customer authentication remains effective for the fraud it was designed to stop. Fraudsters are adapting by manipulating genuine users into authorizing payments themselves.
  2. Geography changes the risk. According to the same report, fraud rates for card transactions can be roughly 17 times higher when the counterparty is outside the EEA, where SCA requirements do not apply. If your business sells to or buys from non-EEA counterparties, treat those flows as higher risk by default.

How card fraud actually reaches a business

It helps to separate the routes, because each needs a different control.

Stolen or leaked card data

Card numbers are copied through compromised websites, malware, careless storage in spreadsheets or shared chats, or an employee pasting details into an unverified form. The fraudster then uses the data for online purchases, especially where authentication can be skipped through an exemption.

Social engineering of your staff

This is the route the Bank of Lithuania keeps returning to. A caller poses as a bank, a courier or a supplier and asks for a code, a card number or a CVV. Lithuanian police and media have also described fraudsters who turn up in person to collect bank cards, one of the schemes that surfaces in the local public discussion of fraud prevention. The rule is simple: no genuine provider asks for your CVV or a one-time code to “confirm a payment received”. The Bank of Lithuania’s guidance for financial institutions names this request as a hallmark of phishing.

Authorized push payment scams

Here nobody steals anything. A finance employee is persuaded to approve a transfer to a “new supplier account” or an “urgent” invoice with changed bank details. Because the user authenticated the payment, SCA does not stop it. This is the category the EBA and ECB flag as growing.

Your account used as a mule account

A less obvious risk: someone offers your company a fee or commission to receive and forward money. The Bank of Lithuania warns that businesses accepting such offers can become unwitting accomplices, with legal and criminal consequences beyond lost funds or closed accounts. Its advice is to reject any offer of “easy money” or “fast enrichment” that involves your business account.

What strong customer authentication does and does not do

Under PSD2 and Commission Delegated Regulation (EU) 2018/389, electronic payments generally require strong customer authentication. Payment service providers may exempt low-risk transactions if they meet strict criteria, including fraud rates below set reference limits (for remote card-based payments up to 500 EUR, the reference fraud rate is 0.01%) and real-time risk analysis.

For your business, this has three practical consequences:

  • Authentication prompts on your cards are protection, not an inconvenience. Do not look for ways to bypass them.
  • Exemptions exist, so a payment that arrives without a prompt is not automatically legitimate. Fraudsters target transaction types that qualify for exemptions.
  • SCA protects the login and the payment moment. It does not protect against an employee who is convinced to approve the wrong thing.

A layered control framework for companies

The Bank of Lithuania’s position is that technical tools are necessary but insufficient. Effective prevention combines monitoring with organizational policy, verification of business partners and real-time detection of suspicious activity. Below is that principle turned into a working checklist.

Layer 1: Structure your accounts so one failure stays small

  • Separate operating, payroll and card-funding balances. If a card is compromised, only the balance funding that card is exposed.
  • Use a dedicated account for online and subscription spend. Marketing tools, SaaS subscriptions and ad platforms are frequent targets for stolen card data.
  • Keep client funds and your own working capital apart wherever your business model handles third-party money.

Multi-account structures make this practical. With a Demivolt business account you can open dedicated IBAN accounts and organize them by purpose, with client funds held in segregated accounts.

Layer 2: Control who can do what

  • Give each employee their own card instead of sharing one number across a team.
  • Assign roles: who can view, who can initiate payments, who can approve them.
  • Require two people for new beneficiaries and for any change to a supplier’s bank details.
  • Remove access the day someone changes role or leaves.

Role-based user management is the control that most directly addresses the push payment scenario, because it forces a second pair of eyes onto the transfer.

Layer 3: Limit the damage a stolen card can do

  • Use virtual cards for online purchases, ideally one per vendor, so a leak at one merchant does not expose everything.
  • Keep physical cards for in-person expenses and travel only.
  • Set spending caps and, where your provider allows it, restrict categories and countries.
  • Freeze cards that are not in use.

If you are designing a card setup for a team or a product, our card programmes page describes virtual and physical Visa business cards and the infrastructure behind them.

Layer 4: Verify before you pay

The Bank of Lithuania supports payee verification services, which check that funds go to the account holder you intend. It also stresses that this should be complemented by broader measures. Make verification a habit in your payment process:

  1. Confirm any new or changed bank details by phoning a number you already hold, never one from the email that announced the change.
  2. Compare the beneficiary name with the registered company name.
  3. Ask whether the beneficiary’s country matches where the business operates. The Bank of Lithuania treats a mismatch between the beneficiary’s residency and the business’s operating jurisdiction as an immediate red flag.
  4. Pause on urgency. Pressure to pay today is the most common feature of a payment scam.

For a deeper look at how verification technology is developing, see our news item on a payee verification platform’s Series A funding. For a practical step list, this guide to push payment fraud prevention steps covers the process side in detail.

Layer 5: Monitor behavior, not just identity

The Bank of Lithuania cautions against formal, box-ticking compliance. Checking an identity document once is not the same as understanding transaction patterns. Inside your company, that means reviewing:

  • first-time merchants and first-time beneficiaries,
  • payments just under approval thresholds,
  • unusual hours or unusual countries,
  • repeated small charges that look like card testing,
  • duplicate charges or long-pending transactions that you cannot explain.

Our explainers on why the same card payment can show twice and why a card payment stays pending help your team tell harmless authorization behavior from a genuine problem before they raise an alarm, or ignore one.

Layer 6: Train people with scripts, not slogans

Give staff short, concrete rules they can apply under pressure:

  • We never read out CVV codes or one-time codes, to anyone, for any reason.
  • Our bank never asks us to move money to a “safe account”.
  • We do not lend our company account for forwarding or receiving third-party funds.
  • Any request that combines urgency with secrecy goes to a second person.
  • Anyone can stop a payment without blame.

Run a short simulated call or fake supplier email twice a year. Teams that have rehearsed the refusal are far more likely to use it.

Payment channel risk: cards, SEPA and SWIFT

Fraud prevention is also about the channel. Instant, irrevocable transfers are harder to recall than card payments, which carry dispute processes. The published Demivolt fees below show what each movement costs, which matters when you decide where to route payments and when you build in a verification step.

Payment type Fee
SEPA In 0 €
SEPA Out 0.40 € per transfer
SWIFT In 25.00 €
SWIFT Out 30.00 €
Internal transfers between Demivolt accounts 0
Account opening, verification, monthly maintenance, closure 0

Because an outgoing SEPA transfer costs 0.40 €, a second-person approval or a call-back check is a small price compared with the risk of a mistaken or fraudulent payment. You can estimate your own volumes with the SEPA fee calculator. SWIFT payments cost more and often involve counterparties outside the EEA, which, as noted above, is where the EBA and ECB see much higher card fraud rates. Apply your strictest checks there.

Our perspective: fraud prevention is an operating design problem

We see the same pattern across the SMEs, e-commerce companies and cross-border businesses that open accounts with us. Fraud losses rarely come from a single missing tool. They come from a structure in which one person can see everything, approve everything and pay everything, using one account and one card.

Our perspective: fraud prevention is an operating design problem — overview diagram

That is why we build around structure first. Dedicated IBANs let you separate flows. Multi-account setups let you cap exposure. Role-based user management lets you split initiation from approval. Segregated client funds keep customer money out of operating risk. Onboarding is risk-based and compliant with EU requirements, because a provider that understands who its clients are is also better placed to spot the activity that does not fit.

We also think businesses should be skeptical of any single answer. The EBA and ECB data shows that fraudsters adapt to each new barrier. A control that works today will be tested tomorrow. Treat prevention as a routine of review: who has access, which cards are live, which beneficiaries are new, and which staff rules need rehearsal.

— dd

Set up a safer card and account structure with Demivolt

If you are starting from scratch or restructuring, here is a sequence that works for most SMEs:

  1. Open a business account with dedicated IBANs for operating, payroll and card funding.
  2. Define roles for your finance lead, your approvers and your card holders.
  3. Issue virtual cards per vendor or per team and keep physical cards for travel.
  4. Write the approval rules for new beneficiaries and changed bank details.
  5. Review access and card activity monthly.

Demivolt is a regulated European platform. Account opening, account verification and monthly maintenance carry no fee, and you get a dedicated client manager at no one-off cost. If you want to see how this fits your business, explore business accounts, review how payments work, or contact us to get started.

Fintech platforms and advisors building products for their own clients can also look at our Banking-as-a-Service offer and the partner and white-label models.

What to do if you suspect card fraud

Speed matters. Use this order:

  1. Block the card immediately through your app or your provider’s emergency line. Freeze rather than wait if you are unsure.
  2. Contact your payment provider and explain exactly what happened, in as much detail as you can. Do not leave out the part where an employee shared a code, as that affects how the case is assessed.
  3. Preserve evidence: screenshots, call logs, email headers, transaction references and times.
  4. Report to the police, and tell the Bank of Lithuania’s consumer-facing fraud resources if the case involves a scheme others should know about.
  5. Change credentials for any system the affected employee used, and review access rights.
  6. Review the control that failed and write the fix into your policy within a week.

Do not engage further with the fraudster, and do not pay any “recovery fee” to someone who contacts you offering to get the money back.

Red flags that deserve a second look

Signal Why it matters
A supplier changes bank details by email Classic push payment fraud setup
Beneficiary country differs from the supplier’s operating country Flagged by the Bank of Lithuania as a red flag
Someone offers a fee to use your company account Mule account recruitment
Caller asks for a CVV or one-time code Phishing, regardless of who the caller claims to be
Unexpected visitor collecting cards or devices In-person fraud described in Lithuanian media
Many small card charges in a row Possible card testing
Counterparty outside the EEA with an urgent request Much higher card fraud rates outside the EEA, per the EBA and ECB

If you follow the industry side of fraud and payments, these items give context: a fraud detection layer added to an AI payments platform, e-commerce merchants freezing fraud staff while technology budgets rise and a large fine over anti-money-laundering failures. The last one is a reminder that weak controls carry regulatory cost as well as direct loss.

FAQ

What is the most effective single step against card fraud for a small company?

There is no single step, but the closest is separating who can pay from who can approve, then giving each person their own card with limits. That alone reduces the damage from both stolen card data and a persuaded employee. Add a rule that bank detail changes are verified by phone.

Does strong customer authentication make my company safe from card fraud?

No. It is effective against the fraud it was designed for, but the EBA and ECB report that fraudsters are adapting, mainly by manipulating genuine users. Exemptions for low-risk payments also exist under the delegated regulation. Combine SCA with approval rules and staff training.

Should we use virtual cards or physical cards for online spending?

Virtual cards are usually the safer choice for online and subscription spend, because you can issue one per vendor and close it if it leaks without affecting other payments. Physical cards suit travel and in-person expenses. Limit each to the purpose it serves.

Can my company be held responsible if someone uses our account to move money?

It can face serious consequences. The Bank of Lithuania warns that businesses accepting offers to use their account for third-party transfers can become unwitting accomplices, with legal and criminal consequences. If you receive such an offer, decline it and consider informing your provider.

Who do we contact first if a card is compromised?

Block the card first, then contact your payment provider straight away. After that, report to the police and keep all evidence. Acting within minutes limits how many transactions can complete.

Sources

Related to this article

Business accounts

Business accounts, dedicated IBANs, payments, cards and currency for companies working directly with Demivolt.

Learn more
Demivolt | Blog – Card Fraud Prevention for Businesses in Lithuania