Payment fraud across the European Economic Area reached EUR 4.2 billion in 2024, and the drive to make bank transfers instant is changing who carries that loss. New EU rules, due to apply over the next two years, will move a larger part of the cost of scams from customers onto banks.
The figures come from a joint report by the European Banking Authority and the European Central Bank, published in December 2025. Fraud rose from EUR 3.4 billion in 2022 and EUR 3.5 billion in 2023. Credit transfers accounted for EUR 2.2 billion of the 2024 total, a 16 percent increase on the year before.
Customers absorbed about 85 percent of those credit transfer losses, the report found, largely because they had been talked into sending the money themselves. The regulators singled out that kind of manipulation as the fastest-growing type of fraud.
Two-factor authentication, which banks adopted under the last payments directive, still works against the attacks it was built for, according to the report. It offers little protection once the customer is the one approving the payment.
Ten seconds, no recall
Since October 2025, every bank in the euro area has been required to let customers send euro transfers that arrive within 10 seconds, at any hour, at no more than the price of a standard transfer. For consumers it is a convenience. For fraudsters it removes the delay that used to give banks a chance to stop a suspicious payment before the money moved on.
The same regulation introduced a safeguard. Before every euro transfer, banks now check whether the name entered by the payer matches the name on the receiving account. By April 2026, 2,768 payment providers had joined the European Payments Council's scheme for these checks, 25 of them outside the euro area, according to the Council's update to the ECB.
The check is aimed at invoice fraud, which the Council's latest fraud trends report describes as one of the biggest drivers of scam payments in Europe. Criminals alter the account details on a genuine invoice, a QR code or a payment request, and the money goes to them instead of the supplier. A mismatch between the supplier's name and the new account exposes the swap.
It does not catch the more common scam, in which the victim is persuaded to pay an account that matches perfectly because the fraudster, or someone recruited to lend their name, opened it. The check confirms the money is going where the customer intended. It cannot tell that the customer was lied to. Banks are responding by moving fraud prevention earlier in the chain, to the point where accounts are opened.
Non-euro countries next
The rules now reach EU members outside the eurozone, including Poland, Hungary, the Czech Republic and Romania. Their banks must be able to receive instant euro payments, at prices in line with regular transfers, by 9 January 2027. By 9 July 2027 they must also be able to send them, and every payment provider in those countries must offer the name check.
Banks there are likely to see the same pattern the euro area has seen since 2025, with faster and cheaper cross-border transfers making it easier to move stolen money between countries in seconds.
Banks to carry more of the cost
The bigger change is legal. EU negotiators reached a political agreement in November 2025 on a new Payment Services Regulation, which is expected to be formally adopted in the second half of 2026 and to apply around 2028.
Under the agreed text, as summarised by industry analysts, a customer tricked by someone posing as their own bank is entitled to a refund if they report it quickly and file a police report. The bank then has 15 business days to repay in full or refuse in writing. It may refuse only if it has objective grounds to suspect fraud or gross negligence by the customer, and the burden of proof is on the bank. A correctly entered authentication code does not, on its own, count as evidence that the customer was careless.
The protection has limits. It does not cover scammers posing as police or tax officials, investment scams or romance scams. Banks will, however, be able to pursue large online platforms and telecom operators that fail to remove fraudulent adverts or block spoofed calls, spreading the cost to the companies whose services carry the scams.
The result is that a loss which customers used to bear privately becomes a cost on bank balance sheets.
Mule accounts in focus
Every scam payment needs somewhere to land, which is drawing attention to the receiving account rather than the sending one.
Mule accounts are often opened online using stolen or invented identities, or by real people paid to lend their names. Catching them depends on identity checks at sign-up that can separate genuine applicants from fabricated ones, including biometric checks able to spot deepfakes and doctored video. The technology behind modern identity verification has moved quickly in response.
Banks are also watching money coming in. An account that receives a string of instant payments from unrelated senders and empties within minutes looks nothing like an ordinary customer, and real-time transaction monitoring on inbound payments can freeze it before the funds disappear.
With non-euro countries joining in January and liability rules following in 2028, the banks under most pressure will be those that still check payments only as money leaves.
