The EBA has identified new types of payment fraud and proposes measures to mitigate underlying risks and protect consumers from resultant losses 

The European Banking Authority (EBA) published today an Opinion, in which it assesses payment fraud data that has recently become available to the EBA, identifies new types and patterns of payment fraud, and develops proposals to mitigate them. This Opinion aims at further strengthening the forthcoming legislative framework under the Third Payment Services Directive (PSD3) and Payment Services Regulation (PSR), as it will enshrine anti-fraud requirements for several years to come and needs to be as future-proof as possible.

In the Opinion, the EBA confirms that regulatory measures such as the Strong Customer Authentication (SCA) that the revised Payment Service Directive (PSD2) and the EBA’s Technical Standards have imposed on the payments industry have been successful in achieving the aim of significantly reducing fraud that involves the stealing of customers’ credentials. However, fraudsters have adapted their techniques and are using more complex types of fraud, such as those based on what is commonly referred to as ‘social engineering’.

To mitigate these dynamic new fraud types, the Opinion is proposing that new security measures are prescribed that are in addition to those articulated in the EU Commission’s welcome proposals for the PSD3 and a PSR as well as the provisions that recently entered into force through the Instant Payments Regulation (IPR). 

Legal basis

The competence of the EBA to deliver this opinion is based on Articles 1(5), 8(2)(g), 9(4) and 16a(1) of Regulation (EU) No 1093/2010, which mandate the EBA to ‘achiev[e] a coordinated approach to the regulatory and supervisory treatment of new or innovative financial activities’ and ‘upon a request from the European Parliament, from the Council or from the Commission, or on its own initiative, provide opinions to the European Parliament, to the Council and to the Commission on all issues related to its area of competence’.