Strong customer authentication has reduced payment fraud — but are security frameworks keeping pace with the tactics fraudsters are now using?
The European Banking Authority (EBA) and the European Central Bank (ECB) have published their 2025 joint report on payment fraud in the European Economic Area (EEA). While the overall fraud rate remained stable at around 0.002% of total transaction value in 2024, the total value of fraud rose to €4.2 billion — up from €3.5 billion in 2023 and €3.4 billion in 2022.
The report confirms that the strong customer authentication (SCA) requirements introduced under PSD2 in 2020 have contributed to reducing fraud, particularly for card payments. Transactions verified with SCA were significantly less susceptible to fraud: card payment fraud was 17 times higher when the recipient was outside the EEA, where SCA is not legally required. However, the report also signals a clear shift in fraud patterns. New types of fraud are on the rise — particularly the manipulation of legitimate users into authenticating fraudulent transactions (so-called “authorised push payment” scams) and exploitation of SCA exemptions. Credit transfer fraud totalled €2.2 billion in 2024 (up 16% year-on-year) and card payment fraud €1.3 billion (up 29%), with payment service users bearing approximately 85% of credit transfer fraud losses.
For banking supervisors, the report underscores the need to monitor not only fraud rates but also the distribution of fraud losses between institutions and end users, and to adapt supervisory expectations as fraud methodologies evolve beyond the typologies SCA was originally designed to address.
