The survey, conducted by Austin-based Mindwave Research Inc., found that companies with online revenues of between $5 million and $25 million annually are being hit the hardest. Those companies saw online fraud losses rise from 1.5 percent of their revenue in 2004 to 1.8 percent of their revenue this year.

Online fraud losses suffered by merchants with more than $25 million worth of online sales annually rose only slightly year over year, from 1.1 percent in 2004 to 1.2 percent this year, the survey said. Online fraud losses for smaller merchants, those with online revenues of less than $5 million, were lower than last year -- falling from 2.1 percent of revenues in 2004 to 1.6 percent this year, according to the survey.

Part of the problem is that while merchants are reviewing more orders manually this year to catch fraudulent orders, they're doing so without hiring more employees, according to CyberSource spokesman Bruce Frymire. In fact, midsize merchants said they reviewed one quarter of their orders this year, up from 21 percent of orders in 2004, he said.

Most merchants are so far relying on two basic means of fighting fraud: address verification systems, which compare the address on file at the card issuer to the billing address provided by the card holder, and checks of the card verification number -- the additional digits printed on the credit cards, according to the survey.

Over half the merchants who took part in the survey said that they are currently using or intend to use MasterCard's SecureCode or Visa's Verified by Visa payer authentication systems before the end of 2006, Frymire said.