The poll of 1679 cardholders, conducted by Tickbox.net/Opinion Matters claimed that around 26% fell victim to card fraudsters in 2008, up five per cent on the previous year.
However, Apacs rounded on the firm accusing CPP of using "misleading information and spurious statistics" to support the 12 million figure.
The payments body, which will publish its own fraud statistics for 2008 in March, says its most recent figures indicate that in 2007 there were just over a million reported cases of card fraud, suggesting the CPP numbers are "wildly out of line".
CPP has since moved to clarify its earlier statements, saying that the 12 million card fraud number refers to total lifetime figures, not just last year's data.
The average sum fraudulently transacted is over £650, with one in 20 victims reporting losses of over £2000. Yet 42% of victims did not know about these transactions and only found out they had been defrauded when alerted by their bank.
Online fraud affected 39% of victims, while card cloning from a cash point or chip and pin device accounted for a fifth of cases. Out of all cards that are physically lost and stolen, one in ten are also being used fraudulently.
Separately, a survey from CyberSource has found that one in eight UK businesses in 2008 suffered fraud losses in excess of five per cent of total online revenues.
Of 150 online merchants questioned, 40% say the amount they lost to fraud rose in 2008 with an overall increase 2.6%.
The losses come despite continued investment by retailers in tackling fraud. Around 16% of merchants integrated Verified by Visa and MasterCard SecureCode schemes in 2008, meaning 60% of firms in the UK now employ these services.