Corporate card security: mastering fraud in 2026

Public figures from France's Payment Security Observatory (Banque de France) tell a two-sided story. In the first half of 2025, card fraud fell to €211 million, approximately €48 frauded per €100,000 paid, its lowest level ever recorded^[3]. At the same time, social engineering fraud (phishing, fake supplier scams, CEO fraud) rose 37%, reaching €245 million^[1]. Translated for a finance team: the card itself holds up well — it is the people around it who are being targeted.

A corporate card compounds this risk for two reasons. First, it carries spending limits far higher than a personal card, a fraudulent debit of €5,000 goes unnoticed where it would immediately alert a consumer. Second, traceability is diluted: the same card number may be used by multiple employees, shared for a recurring purchase, or stored with five different SaaS vendors. Card configuration is therefore not a compliance detail — it is the first line of defence.

The majority of incidents are preventable with five controls configurable from any decent back-office. None require custom development, and all can be applied in minutes per card or per spending profile.

The principle is the same throughout: deny by default, allow by exception. The merchant category code (MCC) is the core building block. It is the four-digit code that classifies every merchant and determines authorisation. Expense management platforms use it to block or permit categories per cardholder^[4]. A travelling sales rep has no business in a casino; a procurement officer has no need to pay an online gambling service. The MCC knows this, the setting enforces it, and the cardholder receives an immediate decline.

A poorly calibrated limit either lets fraud through or leaves employees stranded at a restaurant. The right approach is to break limits down into three dimensions, per transaction, per period (daily, weekly, monthly) and per MCC category, rather than setting a single global amount. A manager authorised to spend €2,000 on client entertainment does not need a single-transaction ceiling of €2,000. For a full methodology, our guide on spending limits and expense policy walks through the complete approach.

"Card not present" transactions, online payments where the card number is entered without the physical card, account for most of the residual risk. Two mechanisms contain it.

Strong customer authentication (SCA) via 3-D Secure 2. Stemming from the European PSD2 directive, it mandates two-factor authentication on most online payments, with defined exemptions (trusted beneficiaries, transaction risk analysis)^[5]. On a corporate programme, 3DS can be enforced on high-risk e-commerce merchants and relaxed for trusted recurring suppliers, so legitimate purchasing is not penalised.

Single-use virtual cards. Rather than storing a permanent card number with every supplier, a dedicated number is generated, with its own limit, its own expiry date and sometimes its own authorised MCC, for a specific payment or project. If the number leaks, it is already expired. This is the most effective defence against fraudulent reuse, and the subject of our in-depth page on virtual cards for business.

Perfect configuration is not enough; you also need visibility over what is happening. Real-time alerts, push notifications or emails on every transaction, or only on out-of-policy transactions, turn the back-office into a monitoring station. Approaching a spending limit, a payment in an unusual country, repeated declines at the same merchant, two simultaneous payments 2,000 km apart: these are signals an automated system detects in a few hundred milliseconds that a human controller would take days to spot in a monthly statement.

The right alert threshold is not "notify everything" — that is a recipe for alert fatigue. Notifications should be reserved for transactions that breach a programme rule: a threshold exceeded, a sensitive MCC, a geography outside scope. Everything else can be reviewed after the fact, within the accounting workflow.

Card networks promote anti-fraud guarantees (Zero Liability), and many issuers add their own "Zero Fraud" promises. Reading the brochure, one might assume full coverage in every scenario. The reality is more nuanced — and the gap is widest on commercial cards.

Visa's Zero Liability Policy, for example, explicitly excludes certain transactions on commercial cards and anonymous prepaid cards^[2]. Mastercard's protection covers unauthorised fraudulent transactions, but only on condition of prompt reporting^[6]. In short: the guarantee is neither universal nor automatic on a B2B programme, and depends largely on what your issuer has negotiated and contracted.

The practical implication: ask your issuer for the exact wording of the guarantee, the reporting deadlines (often very short), the exclusion clauses and the reimbursement process. And never confuse Zero Liability with the absence of risk: the guarantee kicks in after a loss — configuration prevents it from happening in the first place. The two are complementary, not interchangeable.

Once controls are in place, security depends on routine. A few habits distinguish a robust programme from a porous one:

One cardholder, one use. Avoid cards shared between employees: they make traceability impossible and render per-profile limit assignment meaningless. Prefer one card per employee, or one virtual card per project.

Short, regular awareness training. Social engineering fraud is up 37% in a single half-year^[1]. No configuration can withstand it if an employee clicks a malicious link. A ten-minute quarterly reminder on phishing and fake supplier scams is more effective than a lengthy annual training session that gets forgotten.

Audit the controls, not just the spend. Expense reports are reviewed regularly; what is reviewed less often is whether blocked MCCs are still blocked, whether limits raised as a temporary workaround were ever brought back down, and whether authorised countries still match the actual business scope. A quarterly audit of the configuration itself is what keeps defences current.

Suspend quickly, reactivate slowly. At the slightest suspicion about a card number, freeze the card from the back-office with a single click and issue a replacement virtual card to avoid disrupting legitimate activity. The cost of an over-cautious block is always negligible compared to the cost of uninterrupted fraud.

The Greenway corporate card includes these controls as standard: per-transaction and per-period spending limits, MCC blocking, geo-restrictions, real-time alerts and on-the-fly virtual card issuance. The goal is not to stack up security features for show, but to make fraud structurally difficult, so the card serves its purpose of enabling payments, rather than keeping the finance team up at night.