European e-commerce fraud is shifting to real-time payment abuse

At a glance

What this is: Sift’s analysis says European e-commerce fraud is moving toward real-time payment abuse, while early-stage screening remains too limited to stop synthetic identities and fake accounts from progressing.

Why it matters: IAM, fraud, and trust teams need to push identity and behavioural controls earlier in the journey because payment-time review is now too late for several of the dominant abuse patterns.

By the numbers:

• 2.8% of revenue is lost to fraud across Europe.
• Fraud accounts for 3% of all orders across Europe.
• Only 16% of EU merchants currently screen users during the browsing or account-creation stages.
• European merchants achieving a 15.1% win rate in chargeback disputes are doing so with stronger evidence-gathering and fraud tooling.

Context

European e-commerce fraud is increasingly a journey problem rather than a checkout problem. The article argues that faster payments, seamless onboarding, and automated attack methods are widening the gap between where trust is granted and where abuse is detected.

That matters to identity practitioners because account creation, device reputation, behavioural signals, and step-up checks are now part of fraud governance, not just UX design. The pattern is typical of modern commerce platforms: the earlier the trust decision, the less room there is for recovery later.

Key questions

Q: What should merchants do first when fraud is hiding in early customer journeys?

A: Start by moving fraud scoring into browsing and account-creation stages, not just checkout. That means combining device intelligence, behavioural tracking, and consortium signals before trust is granted. If suspicious users are only reviewed after payment, the organisation is reacting too late to stop synthetic identities and fake accounts from progressing into irreversible abuse.

Q: Why is real-time payment fraud harder to stop than card fraud?

A: Real-time payment fraud is harder to stop because settlement is immediate and usually irreversible. That removes the recovery window that many card workflows still have. Defenders have to make a risk decision before funds leave the account, using recipient verification, behaviour, and velocity rather than relying on later disputes or manual review.

Q: What breaks when merchants screen users only at checkout?

A: Checkout-only screening misses the point where trust was first established. Synthetic identities, fake accounts, and credential abuse can all mature before a transaction is even attempted. Once the session reaches payment, the organisation is already dealing with a hardened fraud path instead of an early warning signal.

Q: How should finance and identity teams share accountability for payment fraud?

A: Finance teams should own payment rules, approval logic, and exception handling, while identity and access teams help ensure those rules are tied to verified people, vendors, and roles. The key is a shared operating model where vendor changes, approver access, and transaction monitoring are correlated. Without that split ownership, fraud gaps fall between teams.

Technical breakdown

Why early-stage screening is the new fraud control plane

Fraud controls traditionally concentrate on payment authorisation or post-transaction review, but that leaves a large gap when the attacker’s objective is to establish a believable account first. Screening at browsing or account-creation time allows teams to detect synthetic identity patterns, reused devices, and abnormal velocity before a payment event exists. In commerce environments, the point of trust establishment is often more important than the point of payment. This shifts fraud governance closer to identity verification, device intelligence, and behavioural analytics rather than relying only on transaction-time controls.

Practical implication: Move identity and device checks into the earliest customer journey stages, before trust is granted.

Real-time payment fraud depends on short decision windows

Real-time payment fraud is effective because instant settlement removes the recovery window that card rails sometimes provide. Once a transfer is authorised, the funds can move into mule accounts before manual review or downstream dispute handling can intervene. The practical challenge is not only accuracy but latency: the decision has to be made inside a very short operational window, using enough context to detect recipient risk, behavioural anomalies, and transaction velocity. That makes payee verification, device signals, and risk scoring part of the same control chain.

Practical implication: Design payout controls for pre-authorisation detection, not post-transaction investigation.

Behavioural signals are becoming part of identity assurance

Behavioural biometrics and device fingerprinting matter here because the article’s abuse patterns are not just about stolen credentials or payment data. Fraudsters increasingly rely on fake accounts, credential harvesting, and manipulation of user journeys, which means static identity checks are insufficient on their own. A stronger model blends who the user claims to be, how the device behaves, and whether the session matches known risk patterns. That creates a more resilient trust decision across both human identity and account lifecycle stages.

Practical implication: Treat behavioural telemetry as a core trust signal alongside authentication and payment rules.

NHI Mgmt Group analysis

Journey-stage trust is now the decisive fraud governance problem: European merchants are not dealing with a single checkout failure, but with a sequence of weak trust decisions that fraudsters can exploit upstream. When onboarding, browsing, and payout controls are separated, attackers only need one thin point of validation to move from identity fabrication to financial abuse. Practitioners should treat the full customer journey as the control surface, not just payment confirmation.

Real-time payment fraud exposes a governance gap, not just a payment risk: Instant settlement compresses the time available for human judgment, which means legacy review models cannot carry the full burden. The article shows that decisions must be made in the moment using identity, device, and behavioural context. Practitioners should reframe RTP defence as a latency-sensitive trust problem.

Early identity signals now carry fraud value even when the use case is commerce: Although this is not an IAM programme in the strict enterprise sense, the same governance logic applies. Account reputation, device continuity, and step-up authentication are identity controls with direct fraud outcomes. Practitioners should align fraud operations and identity teams around shared signals and shared escalation thresholds.

Customer friction and fraud loss are no longer opposing goals: The better model is selective friction based on risk, not blanket friction applied too late. Merchants that rely on late-stage manual review absorb both losses and customer dissatisfaction. Practitioners should prioritise controls that reduce exposure before the transaction becomes irreversible.

Real-time commerce creates a short-lived trust window: This article reinforces a named concept that matters for the wider market. The trust window is shrinking from account creation to payment confirmation, and governance must move with it. Practitioners should measure how much risk is being accepted before the first irreversible action occurs.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

European commerce fraud is becoming an identity-governance problem as much as a payment problem: merchants now need to treat account creation, session continuity, and payout verification as one control chain. If those stages are governed separately, attackers will keep finding the seam between them.

Trust windows are shrinking faster than manual operations can adapt: instant payments, device switching, and synthetic accounts compress the time available for intervention. Practitioners should expect more value from pre-transaction signals than from post-transaction remediation.

Behavioural and device telemetry should be elevated from supporting data to primary decision inputs: that is the only practical way to catch abuse before a payment becomes irreversible. The organisations that align fraud operations with identity controls will have the clearest path to lower loss and less customer friction.

For practitioners

• Expand screening to pre-checkout journeys Add device fingerprinting, behavioural tracking, and consortium signals during browsing and account creation so suspicious users are scored before checkout or payout.
• Harden real-time payout decisions Use payee verification, recipient matching, and anomaly scoring inside the short decision window for instant payments and withdrawals.
• Rely on step-up authentication for high-risk logins Reserve additional authentication for risky sessions, account changes, and payout events where identity confidence is low or velocity is abnormal.
• Instrument evidence capture for disputes Store IP address, device ID, account activity, and delivery logs so chargeback and refund disputes can be supported with defensible evidence.
• Separate manual review from routine decisions Automate low- and medium-risk decisions and keep human review for edge cases, complex disputes, and exception handling that genuinely needs analyst judgment.

Key takeaways

• European e-commerce fraud is shifting earlier in the customer journey, which makes checkout-only controls too late for several of the most common abuse patterns.
• The article’s evidence points to material loss at scale, including 2.8% of revenue and 3% of orders across Europe, with only 16% of merchants screening users during browsing or account creation.
• The practical response is to combine identity, device, and behavioural signals before trust is granted, especially where instant payments remove the recovery window.

Key terms

• Real-Time Payment Fraud: Real-time payment fraud is abuse of instant payment rails where funds settle too quickly for traditional post-transaction controls to help. The attacker relies on short decision windows, mule accounts, and weak recipient verification to move money before detection or reversal.
• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• Behavioral Biometrics: Behavioral biometrics uses patterns such as typing rhythm, swipe style, device handling, and session timing to infer whether the same user is still present. In practice, it supports continuous verification, but it also demands careful tuning because legitimate behavior can change with context.
• Chargeback Evidence Package: A chargeback evidence package is the set of records a merchant submits to defend a disputed transaction. It usually includes timestamps, delivery confirmation, communications, product details, customer policy acknowledgements, and technical logs. Strong evidence shows that the transaction was authorized, fulfilled, and communicated clearly.

Deepen your knowledge

NHI Mgmt Group’s NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps practitioners connect trust decisions to the broader identity controls that shape risk across modern programmes.