PSD3 shifts fraud exposure toward providers when controls fail

At a glance

What this is: SEON says the EU’s PSR and PSD3 agreement is moving authorised payment fraud exposure toward providers when prevention controls and evidence are inadequate.

Why it matters: That matters to IAM and security practitioners because payment fraud now depends on control design, decision logs and real-time risk signals, not authentication alone.

By the numbers:

• In 2024, payment service users absorbed approximately 85% of credit-transfer fraud losses in the European Economic Area.
• The EBA and ECB recorded €4.2 billion in payment fraud across the EEA in 2024.
• Credit-transfer fraud accounted for €2.2 billion of the EEA’s 2024 payment fraud total.
• Card fraud accounted for €1.3 billion of the EEA’s 2024 payment fraud total.

Context

Payment fraud is no longer just a customer-loss problem. The combination of authorised-payment scams, instant settlement and uneven prevention controls means liability is increasingly being shaped by what a provider can detect, document and justify at decision time.

The article’s core governance point is that fraud controls must be judged by their ability to interrupt suspicious activity in context, not merely by whether the transaction was authenticated. That shifts attention from authentication to decisioning, evidence and operational accountability.

Key questions

Q: What breaks when payment fraud controls rely only on the transaction itself?

A: Controls fail when they treat the payment as isolated from the actor behind it. Fraudsters can reuse stolen, synthetic, or hijacked identities, making a transaction look normal while the surrounding identity context remains adversarial. Strong programmes connect device, behaviour, and account history so approval decisions reflect continuity, not just a momentary score.

Q: When should organisations prioritise real-time fraud monitoring over batch reviews?

A: Organisations should prioritise real-time fraud monitoring whenever compromise can quickly become monetary loss, such as account takeover, instant payments, or onboarding abuse. Batch review is too slow when attackers can extract value within minutes, so control decisions must happen in the same flow as the transaction.

Q: What are the signs that payment fraud decisioning is failing?

A: Common signs include a high share of disputes after settlement, repeated losses from the same scam typology, weak or missing decision logs, and inconsistent responses to similar risk scores. If the organisation cannot explain why a payment was allowed, delayed or frozen, the control is not operationally mature enough.

Q: Who is accountable when APP fraud occurs under reimbursement rules?

A: Accountability is shared across fraud operations, payment governance, and compliance because the event spans customer protection, transaction monitoring, and AML obligations. Reimbursement may transfer the cost, but it does not remove the need to prove how the institution detected, triaged, and reported the scam.

Technical breakdown

Why strong customer authentication does not stop coached payments

Strong customer authentication confirms that the payer authenticated, but it does not determine whether the payer was deceived into authorising the transfer. In authorised push payment and other coached-payment scams, the fraudster manipulates the victim rather than stealing the credential outright, so the authentication event can be technically valid while the decision is still fraudulent. That is why authentication alone is an incomplete control. The operating model has to inspect contextual signals around the payment, not just the sign-in or approval step. Practical implication: treat authentication as a gate, not a fraud verdict, and build additional decisioning around transaction context. See the MFA Guide.

Practical implication: Separate authentication from fraud decisioning and add contextual controls before payment execution.

How payee verification and real-time holds change the fraud path

Verification of Payee reduces misdirection by checking whether the recipient name matches the account details supplied, but it does not solve every impersonation or mule-driven scam. Real-time delay, freeze and review capabilities matter because instant payments compress the time available to interrupt the transfer. Once funds settle, recovery becomes much harder and reimbursement exposure rises. For receiving institutions, the control burden also extends to suspicious inbound activity, not only outbound payer behaviour. Practical implication: design controls that can intervene before settlement, especially where recipient risk signals or mule indicators are present. See the Authorised Push Payment (APP) Fraud Guide.

Practical implication: Implement pre-settlement intervention for higher-risk transfers and suspicious receiving accounts.

Why fraud governance now depends on decision evidence

The regulatory shift makes contemporaneous evidence part of the control itself. Firms will need to show what signals were available, which control path was chosen and why that choice was reasonable in context. That is a governance problem as much as a fraud problem, because retroactive reconstruction is weaker than records created at the time of the decision. In practice, the decision layer becomes auditable security infrastructure. Practical implication: capture the rationale for allow, warn, delay or freeze decisions inside the payment workflow, not after a complaint arrives.

Practical implication: Log decision rationale inside the payment flow so reimbursement reviews can rely on contemporaneous evidence.

NHI Mgmt Group analysis

Fraud control is becoming a governance and evidence problem, not just a detection problem. The article shows a market in which reimbursement exposure depends on what a provider can prove about prevention, not only what it can detect after the fact. That means fraud teams, IAM teams and payment operations can no longer treat their control evidence as an afterthought. The winning control posture is one that makes every suspicious-payment decision reconstructable.

Authentication is losing its status as the decisive trust event. A valid customer authentication can still sit inside a coerced or impersonated transfer, which means the security model has to move upstream into context, behaviour and payment intent. That is a useful reminder for workforce identity security teams as well: identity proof alone does not settle trust when the user is being manipulated. Practitioners should design for decision confidence, not just login confidence.

Payment providers need a fraud operating model that can absorb regulatory liability, not just a prevention stack. The article’s direction of travel is toward board-level exposure management, scenario analysis and accountable decisioning. That is the same governance pattern seen whenever a control failure becomes financially attributable. The practical conclusion is that fraud prevention must be managed as part of enterprise risk, with named ownership and measurable control effectiveness.

Real-time payment governance now defines the control boundary. Instant settlement compresses the available response window so tightly that batch review cannot be the primary safeguard. The new control question is whether a firm can see, hold and justify a transfer before money is gone. Practitioners should treat latency as a fraud-control variable, not just a systems metric.

From our research library:

• Authorised push payment (APP) fraud is projected to cause global losses of US$331 billion by 2027.

What this signals

Payment fraud is moving into the same governance class as other material financial risks. As liability shifts toward providers, control effectiveness, loss reporting and evidentiary quality will matter more than checkbox compliance. Boards will need to ask not only whether the organisation complies, but whether it can demonstrate that its controls changed the outcome of a suspicious payment.

Instant settlement creates a fraud-control latency problem. The shorter the time to finality, the less useful post-event review becomes. That pushes practitioners toward pre-execution context, pre-settlement interruption and stronger recipient-risk telemetry, because the usable control window is shrinking faster than the fraud typologies are stabilising.

For practitioners

• Define fraud as a balance-sheet risk Set explicit risk appetite, loss thresholds and executive ownership for authorised-payment fraud, then report them alongside other material financial risks. See the Financial Services Identity Security Guide.
• Add real-time context to payment decisioning Use device, recipient, behaviour and journey signals to classify transfers before execution, especially where a first-time payee or unusual path appears.
• Instrument every allow, warn, delay and freeze decision Store the signals used, the action chosen and the rationale inside the payment flow so complaints and reimbursement reviews have contemporaneous evidence.
• Review receiving-side mule detection Treat suspicious inbound transfers and mule account indicators as shared responsibility, not as another institution’s problem. See the Authorised Push Payment (APP) Fraud Guide.
• Run reimbursement scenario analyses Model historical scams against the new liability rules to estimate refund exposure, operational cost and the controls most likely to change outcomes.

Key takeaways

• The article’s central risk is a shift in fraud liability from the customer toward the provider when prevention controls are absent or ineffective.
• The evidence points to rising exposure, including €4.2 billion in EEA payment fraud in 2024 and a large share of credit-transfer losses still borne by users.
• The practical answer is real-time, context-aware decisioning with contemporaneous evidence, not authentication alone.

Related NHI Mgmt Group resources: Payment Fraud Guide · Authorised Push Payment (APP) Fraud Guide · Workforce Identity Security Guide · Financial Services Identity Security Guide

Key terms

• Authorised Push Payment Fraud: A payment scam in which the victim is persuaded to authorise the transfer themselves. The transfer is technically authorised, but the decision is corrupted by deception, which makes liability, evidence, and prevention harder to separate from standard transaction controls.
• Verification Of Payee: Verification of payee is a control that checks whether the recipient name and account number supplied in a payment instruction match. It is designed to interrupt authorised fraud by exposing destination mismatches before money leaves the payer’s account, but it still depends on alert quality and user response.
• Real-Time Payment Decisioning: The process of evaluating a transaction before it settles using contextual and behavioural signals. In fraud programmes, it turns risk scoring into an operational action such as warn, delay, freeze or allow, with the goal of interrupting suspicious activity before funds are lost.
• Contemporaneous Evidence: Records created at or near the time a control operated, rather than assembled later for an audit. This matters because delayed documentation can describe intent, but contemporaneous evidence shows that a safeguard was live when it mattered and can withstand external scrutiny.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. Explore the course if your role depends on stronger identity governance across access, credentials and delegated control.