.svg)
Strong customer authentication (SCA) is combating payment fraud effectively in the European Economic Area (EEA), the European Banking Authority (EBA) and the European Central Bank (ECB) have confirmed in a new report.
The report, analysing payment fraud data from 2022 and the first half of 2023, highlights SCA's critical role in preventing payment fraud.
It reveals that the total value of fraud across major payment instruments, including credit transfers and card payments, reached €4.3bn in 2022 and €2bn in the first half of 2023.
The data shows that transactions authenticated with SCA have significantly lower fraud rates, particularly in card payments.
The report, therefore, finds that mandatory application of SCA under the EU’s revised Payment Services Directive (PSD2) has reduced fraud risk in EEA countries, despite initial concerns from stakeholders about potential negative impacts such as basket abandonment and increased payment friction.
Nevertheless, card fraud remains a significant concern.
For example, the report notes that 0.031 percent of the total value of card transactions were fraudulent in the first half of 2023, with most fraud occurring in remote transactions, indicating the vulnerability of online and mobile payments.
SCA has been a crucial deterrent, however, as fraud rates for card payments are ten times higher in transactions involving non-EEA counterparts, where SCA is not legally required.
The report also highlights a rise in authorised push payment (APP) fraud.
In the first half of 2023, 57 percent of fraudulent credit transfer transactions involved manipulation of the payer, with fraudsters issuing payment orders in nearly 70 percent of cases.
Non-SCA payments
Non-SCA transactions show higher fraud rates than SCA transactions.
The report identifies various exemptions under the Regulatory Technical Standards (RTS) on SCA and Common and Secure Open Standards of Communication (CSC), such as contactless payments, low-value transactions and trusted beneficiaries.
For credit transfers, recurring transactions and secure corporate processes were the most common exemptions; transaction risk analysis (TRA) was the primary exemption for remote card payments.
Fraud rates were also higher for low-value transactions and trusted beneficiaries compared with other exemptions such as secure corporate processes.
Fraudulent payment regulation
The report comes at a pivotal time for payments regulation in the EU, with the Instant Payments Regulation (IPR) set to be implemented next year.
The new rules require instant payment providers to verify that the beneficiary’s IBAN and name match, alerting payers to potential mistakes or fraud.
In addition, the EU’s Payment Services Regulation (PSR) will introduce new rules regarding liability and SCA application.
This regulation imposes liability on technical service providers (TSPs) and payment scheme operators for financial damages caused by failures to provide necessary SCA services.
Payment service providers (PSPs) will be required to establish outsourcing agreements with TSPs, and to ensure that all customers, including those with disabilities or limited digital access, have the means to perform SCA.
PSPs will also be liable for unauthorised transactions and mismatches in payment details and must refund consumers for impersonation fraud unless they can prove the consumer acted fraudulently or with gross negligence.
The regulation, which is awaiting formal agreement by EU political institutions, underscores the ongoing importance of addressing payment fraud within the EU.
