Topic starter
27/10/2026 7:04 pm
TL;DR: Feedzai says PSD3 and the PSR will force EU banks to treat fraud as a payments-wide governance problem, with inbound monitoring, device and behavioral signals, Verification of Payee, and broader liability all becoming central before 2028. Static rules and outbound-only controls will not be enough once the burden of proof shifts to institutions.
Editorial analysis by NHI Mgmt Group, based on content published by Feedzai: “PSD3 and the PSR: What Financial Institutions Need to Know”.
By the numbers:
- In the first six months of the UK scheme, 87% of eligible losses were reimbursed, returning £66 million to victims.
- In the 15 months since the scheme launched, 89% of eligible APP scam losses were reimbursed, returning £243 million to victims.
- According to the UK Finance Annual Fraud Report 2026, impersonation fraud fell 18% as these vectors became unviable.
Key questions
Q: What fails when fraud monitoring only covers outgoing payments?
A: Outbound-only monitoring leaves the receiving institution blind to mule activity, incoming scam payments, and the evidence needed to prove compliance.
Q: Why do device and behavioral signals matter in payment fraud controls?
A: They help distinguish a legitimate transfer from a coerced or manipulated one.
Q: What are the signs that a payment fraud programme is not ready for PSR?
A: Common signs include separate tools for transaction and behavior analysis, no receiving-side case workflow, weak evidence retention, and refund logic that assumes authentication proves legitimacy.
Practitioner guidance
- Build inbound payment monitoring workflows Stand up receiving-side triage, alerting, and fund-return processes so suspicious incoming payments are handled with the same urgency as outbound fraud alerts.
- Fuse behavioral and transactional signals Integrate device context, session signals, and behavioral patterns into the same decision engine that scores payment risk, rather than leaving them in separate tools.
- Rework liability evidence procedures Document how transaction monitoring decisions are made, what evidence is retained, and how the sending and receiving sides prove compliance when disputes arise.
Bottom line: PSD3 and the PSR reframe fraud as an end-to-end payment governance issue, with obligations on both sending and receiving institutions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/10/2026 9:29 pm
PSD3 and the PSR turn fraud prevention into shared payment governance, not a back-office detection problem. The article is right to separate authorization rules from fraud obligations, because the regulatory burden now sits across both payment execution and evidence of control effectiveness. That changes how banks should think about operating model design, not just compliance wording. Practitioner conclusion: fraud governance has to be owned across risk, compliance, product, and payments operations.
A question worth separating out:
Q: Should banks treat Verification of Payee as the final fraud control?
A: No. Verification of Payee should be treated as one input to a broader risk decision, not a binary pass or fail control. The article makes clear that a mismatch cannot automatically stop every payment, and a match does not eliminate fraud risk. Effective programmes combine VoP with behavioral, transactional, and operational context.
👉 Read our full editorial: PSD3 and PSR shift fraud governance to real-time payment controls