The European Banking Authority (EBA) set guidelines for minimum security requirements that payment services providers across the EU's 28 member states must meet by August.
Losses from fraud on card Internet payments alone was 794 million euros ($975 million) in 2012, up 21 percent from the previous year.
The EBA guidelines include requiring payment service providers to carry out strong customer authentication before proceeding with an online payment.
The EU is revising its Payment Services Directive to create more secure, competitive and consumer friendly rules for payments across the region. That could include more stringent rules, but is not expected to be come into force until 2017/18.