What fraud looks like in your transaction list

What does fraud look like in a transaction list?

Fraud takes a handful of recognisable shapes. A test charge of a few kroner just before a large one. A subscription you never started. The same purchase again a day later. A foreign-currency charge from a shop you did visit. Or a merchant name that belongs to a payment processor rather than to the shop itself.

They are worth knowing, because individually they are easy to miss. None of them looks dramatic. That is exactly the point.

• The test charge. A few kroner from a name you do not recognise, then a much larger amount from the same name shortly after. The small one is somebody checking that the card works before using it properly.
• The subscription you never started. A fixed monthly amount that is suddenly there, often small enough to be mistaken for something you forgot you had.
• The purchase that arrives twice. A real purchase you made, and then the same amount again a day or two later.
• The foreign-currency charge from a shop you were in. The card details were copied where you actually shopped, and are now being used somewhere else.
• The name that is not the shop's. Be careful with this one: a great many perfectly real purchases show up under a payment processor's name. It only means you cannot recognise the purchase by its name, and have to go by amount and date instead.

Card fraud is worth the attention right now because it is growing. Nordic banks report that as they got better at stopping fraud through account transfers, fraud using payment cards rose instead.^[4] The methods themselves are familiar enough: stolen cards, misused card details, and relay fraud, where the NFC signal from your card is picked up and forwarded to someone completing a purchase elsewhere.

Why is categorizing what reveals the fraud?

Because categorizing is the only routine that forces you to read every line. An unknown charge of 149 kroner looks like everything else in a list you are skimming. When each transaction has to go into a category, you have to recognise it, and the one you cannot recognise stays behind.

That is why an uncategorized backlog is worse than it looks. When you do three weeks in one sitting you go faster, you recognise patterns rather than individual purchases, and a line for a few kroner from a name you have never seen is exactly the kind of thing that vanishes in that sort of pass. Ten minutes a week finds what a quarter of an hour a month does not.

It also helps that you know your own spending. You know you did not buy anything that Tuesday. Your bank does not. Their monitoring catches the large, fast and unusual, and it has become good at it. But a small subscription of 149 kroner a month does not look unusual to anyone except you.

What do you do when you find a transaction you do not recognise?

First check that it is not your own purchase under an unfamiliar name. If it is not, block the card in your bank app straight away, tell the bank you dispute the transaction, and file a police report. The order matters: blocking is what stops the charges that would otherwise keep coming.

1. Check the amount and date against your own calendar first. Most unfamiliar names are payment processors for purchases you really made, and an unnecessary block costs you a card you need.
2. Block the card in your bank app. It takes seconds, and it is the only part that is urgent.
3. Tell the bank you dispute the transaction. Do it in writing in the app or online bank if you can, so you have a timestamp to point at.
4. File a police report. All three countries take these online, and banks routinely ask for the reference number.
5. Read the rest of the list. If the card has been misused once, the last three months deserve a proper look.

What are you entitled to?

For a payment you did not authorise, the starting point in all three countries is that the bank carries the loss and refunds you by the end of the next business day. Your own share is capped: up to 450 kr in Norway, at most 400 kr in Sweden, and up to 375 kr in Denmark, with higher tiers if you were grossly negligent.

The rules rhyme because they come from the same EU directive, but the numbers and the conditions do not match. The table is the short version.

The figures come from the Financial Contracts Act in Norway^[1], the Payment Services Act in Sweden^[2] and the Payments Act in Denmark^[3]. Two details are worth pulling out. In Sweden the 400 kr is not an automatic excess: it applies where the fraud was possible because you did not protect your security credential, so if you were not at fault you carry nothing. In Denmark the 375 kr tier is the baseline once the security feature was used, and the bank has to prove more before it can move you up to 8,000 kr.

Some rules cancel your liability entirely in all three countries: anything charged after you reported the card for blocking, and cases where the bank did not require strong customer authentication. Everywhere the outer deadline to complain is 13 months from the debit, coupled with a duty to report as soon as you become aware. Miss the second one and you can end up carrying the whole amount even inside the 13 months.

What if you moved the money yourself?

That is the hard case, and it is treated differently everywhere. All of the protection above applies to payments you did not authorise. If you approved the transfer yourself, even after being manipulated into it, it counts as authorised, those rules do not apply, and the caps are not there to fall back on.

This is worth stating plainly, because it is the fastest-growing kind. Norwegian banks name manipulation fraud as their single biggest challenge for 2026: fraud where the victim is tricked into carrying out the transaction themselves. The classic case is the safe-account call, where someone claiming to be from your bank or the police tells you that you are being defrauded and talks you into moving your money to an account that is anything but safe. Often the money goes first to a new account in your own name, precisely so the bank's monitoring does not react.^[4]

The complaints bodies have been direct about it. Sweden's ARN has held that the rules on unauthorised transactions do not apply where the account holder approved the payment with their own mobile BankID, and that this holds even where they were defrauded and tricked into approving it.^[5] Denmark's financial complaints board reached the same result under its own act, in a case where it was accepted that the customer had been deceived and pressured during a fraudulent phone call.^[6]

There is one distinction that pays to understand: who started the payment. If a fraudster initiated it and you merely approved it in your authentication app, it is still someone else's use of your payment service, and the capped liability rules apply. If you initiated the transfer yourself, they do not. That is a technical difference with a very large effect on what you get back.

It does not mean you have nothing. These cases turn on their own facts, including whether the bank should have stopped the payment, and the complaints bodies hear them regularly. But it is a complaint with an uncertain outcome rather than a refund by the next business day, and that is the honest expectation to walk in with.

The practical takeaway is simple enough: no real bank and no real police force will ever ask you to move money to another account to protect it. Hang up, and call the bank back on the number in their own app.

The routine that catches it early

All of the above comes down to one habit. Go through the new transactions about once a week, categorize them while you are there, and let the one you cannot place stay unresolved until you know what it is. It takes a few minutes, it is the same pass that gives you a view of your spending, and it finds the fraud while it is still small.