FRAUD IN CARD PAYMENT SYSTEMS: TYPES, THREAT ANALYSIS, AND PREVENTION STRATEGIES

Öz

Abstract Aim: This study aims to systematically classify the fraud types encountered in card payment systems in the banking sector, to analyse their threat levels, and to develop a multi-layered prevention framework. Data and Method: This study employs a qualitative descriptive research design. Primary data are drawn from the report published by the Banks Association of Turkey (TBB, 2015), supplemented by peer-reviewed articles, EBA and BIS reports, and PCI-DSS/EMV standards. Findings: Four main fraud categories are identified: ATM fraud, card fraud, merchant fraud, and ancillary fraud. Skimming and malware-based ATM attacks pose the highest impact. EMV adoption reduces card cloning but displaces fraud toward CNP channels. Conclusion: A single-layer defence is insufficient. Effective prevention requires coordinated investment in technology, regulatory compliance, personnel training, and customer awareness. Originality: The first comprehensive Turkish-language card payment fraud taxonomy integrating ATM hardware attacks, digital skimming, and merchant-side schemes within a unified domestic regulatory framework. Policy Recommendations: Mandate real-time transaction monitoring, require anti-skimming kits on all ATMs, and establish a national fraud intelligence-sharing platform.

Anahtar Kelimeler

• Card Payment Systems
• Banking Fraud
• Skimming.

KARTLI ÖDEME SİSTEMLERİNDE DOLANDIRICILIK: TÜRLER, TEHDİT ANALİZİ VE ÖNLEME STRATEJİLERİ

Öz

Özet Amaç: Bu çalışma, bankacılık sektöründe kartlı ödeme sistemlerinde karşılaşılan dolandırıcılık türlerini sistematik biçimde sınıflandırmayı, tehdit düzeylerini analiz etmeyi ve çok katmanlı bir önleme çerçevesi geliştirmeyi amaçlamaktadır. Veri ve Yöntem: Nitel betimleyici araştırma tasarımı benimsenmiştir. Birincil veri olarak TBB (2015) raporu kullanılmış; hakemli makaleler, EBA ve BIS raporları ile PCI-DSS/EMV standartları ile desteklenmiştir. Bulgular: Dört ana dolandırıcılık kategorisi belirlenmiştir: ATM, kart, üye işyeri ve tali dolandırıcılıklar. Skimming ve zararlı yazılım tabanlı ATM saldırıları en yüksek tehdit olarak öne çıkmaktadır. EMV geçişi sahte kart olaylarını azaltmakla birlikte CNP kanallarında artışa neden olmaktadır. Sonuç: Tek katmanlı savunma yetersizdir. Etkin önleme stratejisi; teknoloji, yasal uyum, personel eğitimi ve müşteri farkındalık yatırımlarının koordinasyonunu gerektirmektedir. Literatüre Katkı: ATM donanım saldırıları, dijital kopyalama ve işyeri kaynaklı planları bütünleştiren, Türkiye düzenleyici gereklilikleriyle uyumlu ilk kapsamlı Türkçe kartlı ödeme dolandırıcılığı taksonomisidir. Politika Önerileri: Gerçek zamanlı işlem izleme zorunlu kılınmalı, tüm ATM'lere anti-kopyalama kiti kurulumu şart koşulmalı ve ulusal dolandırıcılık istihbarat paylaşım platformu kurulmalıdır.

Anahtar Kelimeler

• Kartlı Ödeme Sistemleri
• Bankacılık Dolandırıcılığı
• Skimming.

Kaynakça

1. Ali, A., Abd Razak, S., Othman, S. H., Eisa, T. A. E., Al-Dhaqm, A., Nasser, M., Elhassan, T., Elshafie, H., & Saif, A. (2022). Financial fraud detection based on machine learning: A systematic literature review. Applied Sciences, 12(19), 9637. https://doi.org/10.3390/app12199637
2. Anderson, R., Barton, C., Böhme, R., Clayton, R., Gañán, C., Grasso, T., Levi, M., Moore, T., & Vasek, M. (2019). Measuring the changing cost of cybercrime. Paper presented at The 18th Annual Workshop on the Economics of Information Security (WEIS 2019), Boston, United States, June 3–4, 2019. https://weis2019.econinfosec.org
3. Bank for International Settlements [BIS]. (2023). CPMI annual statistics [İstatistik veri tabanı]. https://www.bis.org/cpmi/index.htm
4. Bankalararası Kart Merkezi [BKM]. (2024). İstatistiki raporlar [İstatistik veri tabanı]. https://bkm.com.tr/raporlar/
5. Bhattacharyya, S., Jha, S., Tharakunnel, K., & Westland, J. C. (2011). Data mining for credit card fraud: A comparative study. Decision Support Systems, 50(3), 602–613. https://doi.org/10.1016/j.dss.2010.08.008
6. Cherif, A., Badhib, A., Ammar, H., Alshehri, S., Kalkatawi, M., & Imine, A. (2023). Credit card fraud detection in the era of disruptive technologies: A systematic review. Journal of King Saud University – Computer and Information Sciences, 35(1), 145–174. https://doi.org/10.1016/j.jksuci.2022.11.008
7. Dal Pozzolo, A., Caelen, O., Johnson, R. A., & Bontempi, G. (2015). Calibrating probability with undersampling for unbalanced classification. Proceedings of the 2015 IEEE Symposium Series on Computational Intelligence (SSCI), 159–166. https://doi.org/10.1109/SSCI.2015.33
8. European Banking Authority [EBA]. (2022). EBA report on payment fraud under PSD2 [Kurum raporu]. https://www.eba.europa.eu/eba-report-payment-fraud-2022

9. European Central Bank & European Banking Authority [ECB & EBA]. (2025). 2025 report on payment fraud [Kurum raporu].https://www.ecb.europa.eu/press/pr/date/2025/html/ecb.pr251215~e133d9d683.en.htm l European Payments Council [EPC]. (2024). 2024 payment threats and fraud trends report (EPC162-24) [Kurum raporu]. https://www.europeanpaymentscouncil.eu/
10. Fiore, U., De Santis, A., Perla, F., Zanetti, P., & Palmieri, F. (2019). Using generative adversarial networks for improving classification effectiveness in credit card fraud detection. Information Sciences, 479, 448–455. https://doi.org/10.1016/j.ins.2017.12.030
11. Jurgovsky, J., Granitzer, M., Ziegler, K., Calabretto, S., Frédérick, P.-E., He-Guelton, L., & Caelen, O. (2018). Sequence classification for credit-card fraud detection. Expert Systems with Applications, 100, 234–245. https://doi.org/10.1016/j.eswa.2018.01.037
12. Marazqah Btoush, E. A. L., Zhou, X., Gururajan, R., Chan, K. C., Genrich, R., & Sankaran, P. (2023). A systematic review of literature on credit card cyber fraud detection using machine and deep learning. PeerJ Computer Science, 9, e1278. https://doi.org/10.7717/peerj-cs.1278
13. Moscato, V., Picariello, A., & Sperli, G. (2021). A benchmark of machine learning approaches for credit card fraud detection. Future Generation Computer Systems, 165, 791–809. https://doi.org/10.1016/j.future.2020.09.029
14. PCI Security Standards Council. (2022). Payment Card Industry Data Security Standard (PCI DSS) version 4.0 [Teknik standart]. https://www.pcisecuritystandards.org/document_library/
15. Pourhabibi, T., Ong, K. L., Kam, B. H., & Boo, Y. L. (2020). Fraud detection: A systematic literature review of graph-based anomaly detection approaches. Decision Support Systems, 133, 113303. https://doi.org/10.1016/j.dss.2020.113303
16. Sinap, V. (2024). Comparative analysis of machine learning techniques for credit card fraud detection: Dealing with imbalanced datasets. Turkish Journal of Engineering, 8(2), 196– 208. https://doi.org/10.31127/tuje.1386127
17. Sullivan, R. J. (2014). Controlling security risk and fraud in payment systems. Federal Reserve Bank of Kansas City Economic Review, 99(3), 47–78.
18. Şahin, Y., & Duman, E. (2011). Detecting credit card fraud by ANN and logistic regression. In 2011 International Symposium on Innovations in Intelligent Systems and Applications (INISTA) (pp. 315–319). IEEE.
19. Türkiye Bankalar Birliği [TBB]. (2015). Bankacılıkta dolandırıcılık eylemleri tespit ve önleme yöntemleri [Sektörel rapor]. https://www1.tbb.org.tr/gec/KTPV14.pdf
20. Türkiye Bankalar Birliği [TBB]. (2022). Dolandırıcılık eylemleri ve korunma yöntemleri [e- Kitap]. https://www.tbb.org.tr/bankacilik/arastirma-ve-yayinlar/kitaplar/pdf/887
21. Vlasov, A. V. (2017). The changing nature of cyber risks in the financial sector. Journal of Financial Crime, 24(1), 2–18.
22. Xuan, S., Liu, G., Li, Z., Zheng, L., Wang, S., & Jiang, C. (2018). Random forest for credit card fraud detection. Proceedings of the 2018 IEEE 15th International Conference on Networking, Sensing and Control (ICNSC), Zhuhai, China (pp. 1–6). IEEE. https://doi.org/10.1109/ICNSC.2018.8361343
23. Yıldırım, A., & Şimşek, H. (2021). Sosyal bilimlerde nitel araştırma yöntemleri (12. bs.). Seçkin Yayıncılık.