Payments directive ‘has helped lower fraud’
A joint report from the European Banking Authority (EBA) and the European Central Bank (ECB) says that a legal requirement for strong customer authentication (SCA) introduced in 2020 has contributed to reducing fraud levels.
It also finds, however, that new types of fraud are on the rise, particularly the manipulation of payers, which will require “additional and new mitigation approaches”.
The report finds that, in 2024, the payment-fraud rate in the European Economic Area (EEA) was stable at around 0.002% of total value of transactions in a calendar year.
The total value of fraud, however, increased to €4.2 billion from €3.5 billion in 2023.
SCA transactions ‘less susceptible’
The supervisory bodies say that SCA remains effective against the fraud types it was designed to mitigate and that were dominant at the time that the PSD2 Directive that introduced it came into force.
The report says that transactions that were verified with SCA were generally less susceptible to fraud than those without it, especially card payments.
For other payment types, such as credit transfers, this effect was less clear, according to the bodies.
“Notably, card payment fraud was 17 times higher when the payment recipient was outside the EEA, where SCA is not legally required and often not used,” they say.
Manipulation
The report also highlights that new types of fraud are emerging, often targeting transactions for which an SCA exemption is applied or manipulating legitimate users into authenticating fraudulent transactions.
“In most card-payment fraud transactions, fraudsters directly issued the payment order, often using stolen credentials for remote card fraud or lost/stolen physical cards for non-remote card fraud.
“Manipulation of the payer accounted for more than half of the total value of fraudulent credit transfers,” the report states.
The report notes that electronically initiated card payments and e-money transactions were only SCA-authenticated in 40% and 38% of transactions, respectively, last year, mainly due to contactless payments where SCA may not be applied.
A breakdown shows that the value of fraudulent transactions in Ireland last year was €67.4 million for credit transfers, just over €45 million for card payments, and €25.6 million for e-money transactions.