This report, prepared by the EBA and the ECB, assesses recent payment data regarding transactions and fraud in the European Economic Area. It analyzes fraud types, the impact of strong customer authentication (SCA), and provides geographical perspectives on fraud. The data covers multiple reference periods and includes card transactions, credit transfers, direct debits, and cash withdrawals.
This joint report by the European Banking Authority (EBA) and the European Central Bank (ECB), published in December 2025, analyses payment fraud in the European Economic Area (EEA) over six semesters from the first half of 2022 to the second half of 2024. It covers the main payment instruments: transfers, direct debits, card payments (from the issuer's perspective), cash withdrawals, and electronic money transactions. The report is based on semi-annual data collected in accordance with Article 96(6) of EU Directive 2015/2366 (PSD2) and ECB Regulation (EU) No 1409/2013 on payment statistics. It excludes certain specific data (Liechtenstein, Netherlands for direct debits, Bulgaria for some semesters). The scope covers all EU/EEA countries that provided a complete data series.
This report assesses the levels and characteristics of payment fraud in the EU/EEA, which amounted to €4.2 billion in 2024, a 17% increase compared to 2023 (p. 10). The largest fraud values concern transfers (€2.5 billion, fraud rate 0.001%) and card payments (€1.3 billion, rate 0.033%) (p. 6-7, 10). By volume, most fraud concerns card payments (17 million fraudulent transactions out of 111 billion) (p. 12). Fraud is mainly linked to remote transactions for transfers, cards, and electronic money, while most card payments are non-remote (p. 17-19). Payer manipulation is the main fraud method for transfers (up to 74% by value in 2024), whereas for cards, data theft or stolen card fraud dominates (p. 19-22). Strong Customer Authentication (SCA) is applied to the majority of electronic payments by value (77% for transfers, 64% for cards, 70% for electronic money in 2024) (p. 23-25). Transactions authenticated by SCA show lower fraud rates, especially for cards, while transactions outside the EEA, where SCA may not apply, have fraud rates up to 17 times higher (p. 26-27). Financial losses due to fraud amount to €3.8 billion in 2024, with 65% borne by users (PSU), particularly for transfers (85% of losses) (p. 34-36). Loss distribution varies greatly by country and instrument (p. 36-40). Fraud is significantly higher for cross-border payments, especially outside the EEA, with fraud rates up to 7 times higher for cards (p. 41-43). The report highlights the positive impact of SCA and EMV standards on fraud reduction, while calling for continued vigilance by sector actors and regulators.
The report was prepared by the EBA and ECB within their respective mandates for regulation and oversight of payment systems in Europe. It relies on reporting obligations of payment service providers (PSP) under the PSD2 Directive and the ECB Regulation on payment statistics. The objective is to provide a factual and detailed analysis of the levels, types, and impacts of payment fraud in the EU/EEA, considering regulatory developments such as the introduction of Strong Customer Authentication (SCA). The report covers semi-annual data from 2022 to 2024, with full country coverage from 2022 onwards. It acknowledges limitations related to data quality and completeness, as well as the need for caution in interpreting short-term trends. The report aims to inform regulators, PSPs, and users about fraud risks and the effectiveness of implemented security measures.
Fraud levels: Payment fraud reached €4.2 billion in 2024, up 17% year-on-year. Transfers and card payments account for the majority of fraudulent amounts. The overall annual fraud rate remains low (~0.002%), but higher for cards (0.033%) and electronic money (0.018%) than for transfers (0.001%) or direct debits (0.0004%) (p. 10-12).
Fraud types: Payer manipulation dominates for transfers (up to 74% by value), often via phishing or identity theft. For cards, most remote fraud stems from card data theft (56% by value), while non-remote fraud mainly relates to lost or stolen cards (42% by value) (p. 19-22).
Remote vs non-remote transactions: Transfers and electronic money are mostly initiated remotely, including fraud. Card payments are mostly non-remote, but fraud is mainly linked to remote transactions, with fraud rates 13 to 22 times higher than for non-remote payments (p. 17-19).
Strong Customer Authentication (SCA): SCA is applied to 77% of transfers by value, but only 64% of card payments and 70% of electronic money transactions, affected by exemptions such as contactless payments. Frauds are significantly less frequent on SCA transactions, especially for cards. Transactions outside the EEA, where SCA is often absent, show fraud rates up to 17 times higher (p. 23-27).
SCA exemptions: Main exemptions include contactless payments, trusted beneficiaries, recurring transactions, and low-risk transactions identified by risk analysis (TRA). Some exemptions, such as trusted beneficiaries, show higher fraud rates, suggesting fraudsters target these cases (p. 28-33).
Financial losses: In 2024, fraud losses amount to €3.8 billion, with 65% borne by users (PSU), notably 85% for transfers. Loss distribution varies greatly by country and instrument, reflecting differences in liability regimes and recourse mechanisms (p. 34-40).
Geographical dimension: Most transactions are domestic, but fraud is significantly higher on cross-border payments, especially outside the EEA. In 2024, fraud on cross-border card payments outside the EEA is 17 times higher than on domestic transactions (p. 41-43).
Established facts:
- Payment fraud in the EU/EEA increased by 17% in value in 2024, reaching €4.2 billion (p. 10).
- Transfers and card payments represent the majority of fraud by value (€2.5 billion and €1.3 billion respectively) (p. 10).
- Most fraud on transfers and electronic money is initiated remotely, while card fraud is mainly linked to remote transactions, although most card payments are non-remote (p. 17-19).
- Strong Customer Authentication (SCA) is widely deployed, with lower fraud rates on SCA transactions, particularly for cards (p. 23-27).
- Financial losses are mainly borne by users, especially for transfers (85%) (p. 34-36).
- Fraud is significantly higher on cross-border payments, especially outside the EEA (up to 17 times higher for cards) (p. 41-43).
Hypotheses and interpretations:
- Higher fraud rates on SCA transactions for transfers reflect fraudsters targeting higher-risk or higher-value transactions (p. 26).
- The large share of payer manipulation in transfer fraud indicates increased use of social engineering techniques (p. 19).
- Significant variation in loss distribution between countries suggests differences in liability regimes, consumer awareness, and reporting practices (p. 36).
Uncertainties:
- Some data are incomplete or subject to revisions, notably for certain countries and instruments (p. 9).
- The future impact of regulation on instant payments and implementation of complementary measures such as beneficiary verification remains to be seen (p. 13-14).
- Categorization of some fraud types, especially in the "other" category, requires further clarification (p. 22).
The report concludes that payment fraud in the EU/EEA remains overall stable in rate despite an increase in absolute value, with concentration on transfers and card payments. Strong Customer Authentication (SCA) proves effective in reducing fraud, especially on electronic transactions, but its application is uneven across instruments and geographic areas, particularly outside the EEA. SCA exemptions, while necessary for payment fluidity, may constitute preferred attack vectors for fraudsters. The distribution of financial losses shows a significant burden on users, especially for transfers, raising questions about consumer protection and recourse mechanisms. Cross-border fraud, especially outside the EEA, remains a major challenge requiring enhanced cooperation among stakeholders. The report recommends continued fraud monitoring, in-depth analysis of SCA exemptions, and improvement of liability and user protection frameworks. The EBA and ECB will continue to collect and publish data to monitor fraud evolution and the effectiveness of countermeasures.
Synthesis note written from the full document by DataSAI Academy. This note comes from the scientific library of the DataSAI Academy, open to all.