Abstract: The rapid transition to card payments has sparked a search for effective countermeasures to those who exploit card payment security vulnerabilities to commit payment fraud. A review of these vulnerabilities finds that they are tied together by an information-intensive payment approval system. Especially damaging are large data breaches, which are often the result of criminals gathering information useful to committing payment fraud. Criminals particularly target nonbank payment processors,retailers, and government entities. Although traditional forms of payment fraud remain important, a complex and developing chain from data breach to payment fraud is developing. Preliminary estimates of card payment fraud losses in the United States show that the fraud loss rate for the U.S. appears to be higher than that of Australia, France, Spain and the UK. Several industry initiatives may help to protect payment card information, but because lack of good data on the extent and characteristics of payments fraud makes it difficult to develop effective industry strategies and policy responses. Policymakers should monitor the card payment industry to see if it better coordinates security efforts, and if not, consider actions to help the industry overcome barriers to effective development of security.