Joint EBA-ECB report highlights effectiveness of strong authentication but notes rising fraud

The European Banking Authority (EBA) and the European Central Bank (ECB) published the 2025 edition of their joint report on payment fraud. The report covers data from 2022 to 2024 and confirms that the legal requirement for strong customer authentication (SCA) introduced in 2020 has helped reduce fraud levels.

In 2024, the payment fraud rate remained stable at around 0.002% of total transaction value in the European Economic Area (EEA). The total value of fraud increased to €4.2 billion in 2024 from €3.5 billion in 2023. Fraud reported in 2022 was €3.4 billion, €3.5 billion in 2023, and €4.2 billion in 2024.

Transactions verified with SCA were generally less susceptible to fraud, especially for card payments. Fraud involving card payments was 17 times higher when the recipient was outside the EEA, where SCA is not legally required or often not used.

The report confirms the positive impact of SCA requirements under the revised EU Payment Services Directive (PSD2) and the technical standards issued by the EBA and ECB. However, new fraud types are emerging, particularly manipulation of payers and fraud targeting transactions with SCA exemptions or through user manipulation.

In 2024, fraud losses for credit transfers amounted to €2.200 billion, a 16% increase from the previous year, and €1.329 billion for card payments issued in the EU/EEA, a 29% increase. Payment service users bore approximately 85% of total fraud losses, mainly due to scams tricking users into initiating fraudulent transactions.

The report emphasizes the need for continued vigilance and adaptation of security measures to address emerging fraud threats. Data reporting is governed by PSD2 and ECB regulations, with ongoing monitoring by the EBA and ECB to inform policy and supervisory actions.