PSD3 shifts payments identity and fraud controls from guidance to law

At a glance

What this is: The EU is replacing PSD2 with PSR and PSD3, tightening payment authentication, payee verification and fraud prevention obligations across member states.

Why it matters: This matters because payments teams must now align identity controls, fraud monitoring and liability handling to a more uniform regulatory baseline across onboarding, login and transaction flows.

Context

PSD2 created a common payments baseline, but national transposition left firms with uneven interpretations of Strong Customer Authentication, fragmented consumer protection and inconsistent enforcement. That made compliance a jurisdiction-by-jurisdiction exercise instead of a single operating model, which is exactly the kind of regulatory drift that creates control gaps in payments and identity governance.

PSD3 and the Payment Services Regulation change that model by separating operational rules from institutional supervision. For financial services firms, the identity question is no longer only how customers authenticate, but how authentication, fraud detection and reimbursement responsibilities are governed across the full payment journey.

Key questions

Q: How should payment providers adapt Strong Customer Authentication for biometric-only checks?

A: Providers should treat biometric-only SCA as a governance change, not a cosmetic rule update. The key is to validate liveness, binding, fallback and recovery so the biometric factor actually delivers independent assurance. Teams should also test how biometric authentication behaves across devices, jurisdictions and customer support flows before relying on it in production.

Q: Why does impersonation fraud create a stronger identity governance problem for PSPs?

A: Because the attack exploits trust in the provider’s identity, not just the payment flow. When fraudsters use spoofed numbers, domains or sender IDs, the control boundary extends into communications governance and brand protection. PSPs therefore need to manage channel identity, not only user identity, if they want to reduce fraud and refund exposure.

Q: What breaks when verification of payee is not in place for credit transfers?

A: Without verification of payee, the payer’s PSP has no structured control to compare the stated beneficiary name with the IBAN before execution. That leaves social engineering fraud much easier to complete because the warning happens too late or not at all. In regulated payment flows, the control gap becomes both a fraud exposure and a liability issue for the provider.

Q: Which controls should financial firms prioritise to prepare for PSD3 and PSR?

A: Prioritise the controls that affect authentication, payee verification, fraud monitoring and evidence handling first. Those are the areas where PSR turns soft guidance into enforceable obligation. Firms should also align legal, fraud, operations and security teams so liability, reporting and customer remediation are governed as one process.

Technical breakdown

How PSR changes Strong Customer Authentication for biometrics

Strong Customer Authentication has always required two elements from different categories: knowledge, possession and inherence. PSR keeps that structure but introduces a specific exception that allows two inherence factors, which means biometrics-only authentication becomes legally acceptable in some flows. That matters because biometrics are not interchangeable with passwords or devices. Their assurance depends on capture quality, liveness, template protection and how independence between factors is interpreted by regulators. In payment environments, the governance question becomes whether the biometric stack can stand alone without weakening assurance or widening account takeover risk. See the MFA Guide.

Practical implication: Treat biometric-only authentication as a governed assurance change, not a UX update.

Why Verification of Payee becomes a broader fraud control

Verification of Payee extends beyond instant euro transfers and becomes a universal check for credit transfers under PSR. The mechanism is simple but operationally demanding: before executing payment, the sending provider must compare the payee name with the destination account name and interrupt the transaction when they do not match. That shifts VoP from a niche anti-APP fraud control into a baseline payment integrity control. It also increases the importance of alias handling, customer messaging, latency management and exception governance, because false mismatches can damage trust while false passes create loss exposure. See the Authorised Push Payment (APP) Fraud Guide.

Practical implication: Design VoP as a transaction control with clear exception handling, not as a back-office screening task.

How impersonation fraud liability changes the identity boundary

Impersonation fraud under PSR is not just a payment problem. It is an identity-trust problem in which fraudsters exploit channels that appear to belong to the payment service provider, such as spoofed phone numbers, email domains or SMS sender IDs. The new rules move the burden of proof toward the PSP and require robust technical safeguards to stop channel replication in the first place. That makes communications governance, domain protection, brand impersonation monitoring and customer-facing trust signals part of the fraud control stack. The attack succeeds when the consumer cannot distinguish legitimate PSP identity from a spoofed one. Read Fraud Prevention Guide for Digital Businesses.

Practical implication: Bring branded communication channels into the fraud and identity control model.

Threat narrative

Attacker objective: The attacker’s objective is to persuade the victim to authorise a fraudulent payment while preserving the appearance of legitimate PSP communication.

1. Entry occurs when a fraudster impersonates the payment service provider through spoofed phone numbers, email domains or SMS sender IDs.
2. Credential harvesting is replaced by trust harvesting, because the attacker exploits the consumer’s confidence in the apparent PSP identity rather than stealing a login secret.
3. Escalation happens when the manipulated consumer authorises the payment and the transaction moves through channels that appear legitimate.
4. Impact is the transfer of funds, followed by refund disputes and liability for the provider when impersonation fraud is proven.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
• Entra ID actor token flaw (CVE-2025-55241): Hidden Actor tokens plus an Azure AD Graph validation flaw could have let attackers become Global Admin in any Entra ID tenant (CVE-2025-55241).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

PSD3 turns payment identity governance into a liability discipline. The most important shift is not the split between a regulation and a directive, but the fact that authentication, payee verification and fraud monitoring now carry explicit operational consequences. That means payments teams can no longer treat identity controls as a narrow access-management issue; they are now part of regulated transaction integrity. The practical conclusion is that governance must follow the payment flow, not stop at login.

Biometric-only authentication creates an assurance question, not just a policy exception. Allowing two inherence factors sounds simple, but it pushes firms to prove that biometric capture, matching and fallback paths are reliable enough for regulated payments. Where biometrics become the main control, weak liveness checks or poor device binding can undermine the whole assurance model. Payments organisations should treat biometric assurance as a control design problem, not a feature rollout.

Impersonation trust gap: the fraud model now includes the provider’s own branded communication surface. This is the governance gap the new rules are trying to close. If a consumer cannot reliably distinguish genuine PSP communication from a spoofed channel, the payment system has already lost the trust boundary before the transaction is approved. The practitioner conclusion is to govern domain, SMS and telephony identity as part of fraud prevention, not as separate marketing or comms controls.

Verification of Payee is becoming a control for payment integrity, not only fraud reduction. Once it applies to all credit transfers, VoP becomes a core check on whether the payer is sending value to the intended recipient. That raises the stakes for exception management, customer messaging and operational tuning. The practical conclusion is that PSPs should measure VoP quality as a transaction control outcome, not only as a compliance obligation.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.
• Read next: Fraud Prevention Guide for Digital Businesses

What this signals

PSD3 makes payment identity a regulated control surface. The practical effect for programmes is that authentication, fraud monitoring and transaction verification can no longer be owned as separate silos. Teams that still treat login assurance as distinct from payment integrity will struggle to evidence consistent governance across the end-to-end flow.

Impersonation fraud now sits at the intersection of identity and communications governance. That means payment teams need visibility into spoofable channels, refund evidence and customer trust signals, not just authentication logs. The operational boundary has moved outward, and programmes that fail to follow it will find their fraud controls too narrow for the liability model now taking shape.

Biometric-only SCA will force better assurance decisions, not just broader adoption. The issue is not whether biometrics are permitted, but whether they are independently reliable enough for a regulated payment journey. Security leaders should expect more scrutiny on liveness, fallback design and proof of factor independence as implementation begins.

For practitioners

• Build PSR readiness into your authentication roadmap Map current login and transaction flows against the new two-category SCA rules, then isolate where biometric-only options could be introduced without weakening assurance or recovery paths.
• Extend payee verification across all transfer types Review payment rails, exception logic and customer notices so Verification of Payee can operate consistently across euro, non-euro and non-SEPA credit transfers.
• Treat spoofed PSP channels as fraud infrastructure Add monitoring for lookalike domains, spoofed numbers and sender IDs to the fraud stack, and make ownership of those channels explicit across security, comms and operations.
• Prepare refund and evidence workflows for impersonation claims Define how the organisation will prove fraud or gross negligence, preserve channel evidence and handle the 15 business day refund obligation when impersonation is reported.

Key takeaways

• PSD3 and PSR move payment authentication, payee verification and fraud prevention from fragmented guidance into a more uniform legal control set.
• The article’s central governance concern is liability, because payment providers will carry more responsibility when authentication or fraud checks fail.
• Financial services teams should prepare now for biometric assurance, Verification of Payee expansion and impersonation fraud evidence handling.

Related NHI Mgmt Group resources: Authorised Push Payment (APP) Fraud Guide · Fraud Prevention Guide for Digital Businesses · MFA Guide · Workforce Identity Security Guide

Key terms

• Strong Customer Authentication: A regulated authentication requirement that demands more than a single password or code. Under PSD2, it requires at least two factor types and must support the payment context, so the approval is tied to the specific transaction rather than a reusable login event.
• Verification Of Payee: Verification of payee is a control that checks whether the recipient name and account number supplied in a payment instruction match. It is designed to interrupt authorised fraud by exposing destination mismatches before money leaves the payer’s account, but it still depends on alert quality and user response.
• Impersonation Fraud: Impersonation fraud is deception in which an attacker poses as a trusted person, organisation, or authority to trick a victim into sending money, credentials, or data. Defenders should verify identity through separate channels, train staff to challenge urgency, and monitor changes to payment instructions, contact details, and account recovery requests.
• Payment Service Provider: A payment service provider is a platform that helps merchants accept and process electronic payments. In chargeback operations, PSPs often hold transaction records, authorization data, and dispute inputs. When merchants use multiple providers, the resulting data fragmentation makes evidence collection and reporting more difficult.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management for practitioners building regulated identity controls. It helps security and identity teams translate assurance requirements into operational governance.