PSD3 and PSR shift fraud governance to real-time payment controls

At a glance

What this is: This analysis argues that PSD3 and the PSR will redraw EU fraud controls around real-time, end-to-end payment monitoring, broader liability, and more adaptive detection models.

Why it matters: It matters to IAM and fraud practitioners because the regulation turns identity, device, behavioral, and transaction signals into governance inputs that must work together across both sending and receiving payment flows.

By the numbers:

• In the first six months of the UK scheme, 87% of eligible losses were reimbursed, returning £66 million to victims.
• In the 15 months since the scheme launched, 89% of eligible APP scam losses were reimbursed, returning £243 million to victims.
• According to the UK Finance Annual Fraud Report 2026, impersonation fraud fell 18% as these vectors became unviable.

Context

PSD3 and the PSR are often discussed as one package, but they split governance from operational fraud obligations. PSD3 sets the authorization and supervision framework for payment service providers, while the PSR defines the fraud controls, liability rules, and monitoring expectations that will shape day-to-day operations.

For banks, payment institutions, and the teams that govern identity and access management, the real issue is not the naming of the regulation but the control design it forces. Outbound-only monitoring, isolated transaction checks, and static rules will not satisfy a regime built around end-to-end payment visibility and evidence of effective fraud control.

Key questions

Q: What fails when fraud monitoring only covers outgoing payments?

A: Outbound-only monitoring leaves the receiving institution blind to mule activity, incoming scam payments, and the evidence needed to prove compliance. Under PSD3 and the PSR, that gap matters because liability can attach on both sides of the transfer. Teams need receiving-side triage, escalation, and documentation, not just sender-side fraud rules.

Q: Why do device and behavioral signals matter in payment fraud controls?

A: They help distinguish a legitimate transfer from a coerced or manipulated one. A payment record alone often misses signs such as a suspicious session, a new beneficiary, or a parallel call pattern. When those signals are fused with transaction data, fraud teams can make stronger risk decisions and reduce overreliance on static rules.

Q: What are the signs that a payment fraud programme is not ready for PSR?

A: Common signs include separate tools for transaction and behavior analysis, no receiving-side case workflow, weak evidence retention, and refund logic that assumes authentication proves legitimacy. Those gaps suggest the institution can detect some fraud but cannot govern it end to end. Readiness depends on operational proof, not just detection coverage.

Q: Should banks treat Verification of Payee as the final fraud control?

A: No. Verification of Payee should be treated as one input to a broader risk decision, not a binary pass or fail control. The article makes clear that a mismatch cannot automatically stop every payment, and a match does not eliminate fraud risk. Effective programmes combine VoP with behavioral, transactional, and operational context.

Technical breakdown

Why inbound payment monitoring changes the control model

Traditional fraud programmes often watch for suspicious outbound payments and treat the receiving side as passive. PSD3 and the PSR change that assumption by requiring real-time monitoring of incoming payments as well, with clear signs of fraud triggering blocking and fund return. That means the receiving institution needs triage logic, case workflows, and evidence handling, not just detection rules. This is not just an extension of existing monitoring. It is a redesign of where risk decisions happen and which team owns them. Practical implication: build receiving-side monitoring and investigation capacity before the obligation lands.

Practical implication: Design receiving-side detection and case handling, not just outbound alerting.

How device and behavioral signals become fraud evidence

The article treats device telemetry, session context, and behavioral patterns as baseline fraud inputs rather than optional enrichment. That matters because a payment alone rarely tells you whether the customer is acting willingly, under coercion, or through a compromised channel. When those signals are fused with transaction data, institutions can spot patterns such as an active call, a new beneficiary, and a payment in rapid sequence. The control problem is not collecting more data, but deciding whether those signals are correlated in one decision layer or stranded across separate tools. Practical implication: unify behavioral and transactional inputs into one decision model.

Practical implication: Fuse behavioral and transaction signals in one decision layer.

Why burden of proof moves beyond authentication

PSD3 and the PSR push liability far beyond customer authentication. The article makes clear that strong customer authentication alone will not prove customer negligence, and that institutions may need to demonstrate effective transaction monitoring and evidence from both sending and receiving sides. This changes fraud governance from a checkpoint model to a proof model. If you cannot show what was monitored, when it was monitored, and how the decision was made, the control may exist operationally but fail legally. Practical implication: align monitoring evidence, refund logic, and audit trails before policy is tested in a dispute. Read the Ultimate Guide to NHIs: Regulatory and Audit Perspectives.

Practical implication: Make monitoring evidence auditable across the full payment journey.

Threat narrative

Attacker objective: The attacker’s objective is to move stolen funds through the payment system before controls, liability checks, or human triage can stop the transfer.

1. Entry begins with socially engineered or manipulated payment flows that reach the receiving institution as apparently legitimate transfers.
2. Credential or behavioural trust is then abused through mule accounts, device context, or customer interaction patterns that mask fraud indicators.
3. Escalation occurs when institutions fail to detect incoming risk fast enough to stop onward movement of funds or establish liability evidence.
4. Impact is reimbursement exposure, operational overload, and weaker fraud containment across both sending and receiving payment rails.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

PSD3 and the PSR turn fraud prevention into shared payment governance, not a back-office detection problem. The article is right to separate authorization rules from fraud obligations, because the regulatory burden now sits across both payment execution and evidence of control effectiveness. That changes how banks should think about operating model design, not just compliance wording. Practitioner conclusion: fraud governance has to be owned across risk, compliance, product, and payments operations.

Verification of Payee is a risk signal, not a verdict. The article’s treatment is important because it shows how a single check cannot carry the full burden of fraud decision-making. Institutions need broader decision logic that incorporates device, behavioural, and transaction context before blocking or releasing a transfer. Practitioner conclusion: design VoP as one input in an end-to-end risk engine, not as a stand-alone rule.

Device and behavioural signals are becoming compliance baseline data. That is a meaningful shift for organisations that still treat these signals as optional intelligence for analysts rather than operational evidence. The governance challenge is not whether the data exists, but whether it is fused into the payment decision at the point of risk. Practitioner conclusion: move these signals out of disconnected tools and into the core monitoring stack.

The PSR is exposing a transaction-monitoring trust gap. Institutions that cannot prove what they monitored, on which side of the transfer, and with what outcome are effectively operating with untested liability assumptions. The article shows why outbound-only models are no longer defensible once the receiving institution also carries responsibility. Practitioner conclusion: align monitoring, case handling, and audit evidence before the regulation tests your process.

What this signals

The new control challenge is evidence, not just detection. PSD3 and the PSR are pushing banks toward a model where they must show how fraud decisions were made across both payment directions. That shifts programme design away from siloed alerting and toward provable monitoring, case handling, and decision auditability.

Fraud operations will need to converge with identity and access governance. Once device context, session behaviour, and payment risk are judged together, the boundary between fraud control and identity assurance gets much thinner. Institutions that already govern privileged access and identity evidence well will have an easier path to unified risk decisions.

Behavioral intelligence is becoming part of the payment trust layer. That means teams should expect more pressure to integrate analysis, case management, and refund governance into one operating model rather than bolt on more point solutions. The programme implication is simple: the control stack has to explain itself under dispute, not just score risk.

For practitioners

• Build inbound payment monitoring workflows Stand up receiving-side triage, alerting, and fund-return processes so suspicious incoming payments are handled with the same urgency as outbound fraud alerts.
• Fuse behavioral and transactional signals Integrate device context, session signals, and behavioral patterns into the same decision engine that scores payment risk, rather than leaving them in separate tools.
• Rework liability evidence procedures Document how transaction monitoring decisions are made, what evidence is retained, and how the sending and receiving sides prove compliance when disputes arise.
• Update claims and refund operating models Prepare for shared liability by defining escalation paths, ownership, and proof standards across risk, compliance, and operations before the regulation is fully applicable.

Key takeaways

• PSD3 and the PSR reframe fraud as an end-to-end payment governance issue, with obligations on both sending and receiving institutions.
• The article highlights UK reimbursement outcomes, including 87% in the first six months and 89% over 15 months, as evidence that the operating model can work when governance is explicit.
• Banks that want to be ready for 2028 need monitoring, evidence, and case handling to operate as one control system rather than three separate functions.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Top 10 NHI Issues · Ultimate Guide to NHIs: Regulatory and Audit Perspectives · IAM and IGA Basics

Key terms

• Verification Of Payee: Verification of payee is a control that checks whether the recipient name and account number supplied in a payment instruction match. It is designed to interrupt authorised fraud by exposing destination mismatches before money leaves the payer’s account, but it still depends on alert quality and user response.
• App Scam Reimbursement: App scam reimbursement is a liability model that compensates customers who are tricked into authorising payments to criminals. It changes the operational burden on institutions by requiring proof, case handling, and shared responsibility across the payment chain.
• Behavioural Signal: A pattern in how a user acts over time that can help distinguish normal activity from abuse. In fraud operations, behavioural signals include timing, repetition, device consistency, channel switching, and claim history. They are most useful when combined with human review and case context.
• Inbound Payment Monitoring: Inbound payment monitoring is the practice of detecting and triaging suspicious incoming funds before they are moved onward. It extends fraud governance to the receiving institution and requires workflow, evidence, and escalation paths, not just detection logic.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader fraud and security programmes their organisations depend on.