European payment fraud.
A 61-year-old pensioner in Vilnius gets a phone call from someone who says they work for her bank's fraud department. The caller already knows her balance, her last three transactions, and her mother's maiden name. Twenty minutes later she has moved her savings, in three separate transfers, into an account she was told belonged to a "safe holding facility." Her bank's fraud system never gets the chance to flag anything, because from its point of view she authorised every payment herself.
That scene repeats itself thousands of times a week across the EU and UK, and it's why the numbers keep climbing. The European Banking Authority and the European Central Bank published a joint report on payment fraud in December 2025 covering 2024 data, and the total came to 4.2 billion euros in reported losses, up from 3.5 billion euros the year before. Credit transfer fraud, the category that covers most of these authorised push payment scams, made up 2.2 billion euros of that figure, a 16% jump. Card fraud rose even faster: up 29% to 1.3 billion euros.
None of this is happening because banks got careless. Strong customer authentication, required under PSD2 since 2020, has measurably cut fraud on the transactions where it applies. The trouble is that criminals stopped attacking the login step and started attacking the person behind it. You can't block someone from entering their own PIN and confirming their own transfer when they genuinely believe they're paying their landlord, their tax office, or their bank's own security team.
This piece walks through where the losses are concentrated, what regulators across Europe are actually doing about it, and what's changing for the compliance and fraud teams who have to make it work in production.
Ask any fraud analyst at a European bank what keeps them up at night and the answer isn't card skimming anymore. It's a customer on the phone, calm and cooperative, walking through a payment they've been coached to make by someone pretending to be a police officer, a courier, or their own relationship manager.
The EBA/ECB report put a hard number on who eats the cost: consumers absorbed roughly 85% of credit transfer fraud losses in 2024, mostly through scams that manipulate people into authorising the transfer themselves rather than through account takeover. That split matters, because it tells you the fix isn't purely technical. A perfectly secure login does nothing if the account holder is the one typing in the transfer details.
A few patterns show up again and again in casework across the bloc:
Real-time payment rails make all of this worse in one specific way: the money moves in seconds, not days. Under the old batch-processing model, a bank had a window overnight to catch something that looked off. SEPA Instant Credit Transfer closes that window. By the time a fraud team's rules engine flags an unusual pattern, the funds have often already cleared into a mule account and been split across a dozen more.
Card fraud losses climbed 29% year on year, and the EBA/ECB data points to a specific and fairly blunt explanation: fraud rates were about 17 times higher on transactions where the payment recipient sat outside the European Economic Area, where SCA isn't a legal requirement.
That gap is the whole story. A criminal holding stolen card details doesn't need to beat European authentication rules if they can simply route the transaction through an acquirer in a jurisdiction that never asks for a second factor. Card-not-present fraud on cross-border e-commerce checkouts remains the easiest way to monetise a stolen card number, and merchants processing through non-EEA gateways are, whether they realise it or not, sitting in the part of the system with the thinnest controls.
Card testing bots add another layer to this. Fraud rings run scripts that fire small, low-value authorisation requests, often under a euro, against a list of stolen numbers just to see which ones are still live before attempting a bigger purchase. Issuers that don't have velocity checks tuned for this kind of probing traffic end up handing attackers a validated card list for free.
Picture a merchant acquirer in a non-EEA jurisdiction processing a batch of a thousand tiny authorisation attempts from the same IP range within an hour, spread across a hundred different card numbers, none of them individually large enough to trip a fraud alert. That's not a hundred separate incidents. It's one attack, and the only way to catch it is by looking at the pattern across transactions rather than scoring each one alone, which is exactly the kind of cross-border visibility a purely domestic fraud engine tends to miss.
For years, a European bank transfer only checked one thing before moving money: does this IBAN exist. It never checked whether the name typed in matched the name on the account. That gap is exactly what impersonation and invoice scams exploit, since the victim types in a name they trust while the money actually lands in a mule account with a completely different owner.
The EU's Instant Payments Regulation closes that gap through Verification of Payee, or VoP. Payment service providers in the euro area had to have it live by October 9, 2025, with non-euro EU member states given until July 2027. VoP checks the IBAN against the account holder's name before the transfer goes through and returns one of four results: a match, a close or partial match, no match, or an unavailable status if the receiving bank can't respond in time.
A close match, in practice, is where most of the value sits. It's the warning that stops someone from sending money to "J Smith" when the account is actually held by "J Smyth Holdings Ltd," a name similarity mule networks rely on because most people don't read the fine print on a payment confirmation screen. PSD3 and the accompanying Payment Services Regulation, still working through the EU legislative process, are expected to extend fraud liability rules further, shifting more responsibility onto banks that fail to run these checks properly or ignore a clear mismatch warning.
A synthetic identity doesn't belong to any real person. It's built from a real, valid national insurance or tax ID number, usually stolen or bought on a forum, stitched together with a fabricated name, date of birth, and address. Because the core identifier is genuine, it passes basic database checks that only confirm a number exists. The fraudster then nurtures the identity for months, opening a small account, using it normally, building a credit history, before cashing out on a much larger scale.
Generative AI has made this dramatically cheaper and faster to pull off. Identity verification vendor Shufti projected in its 2026 Identity Fraud Index that deepfake identity fraud would rise nearly 495% over 2025 levels across live video deepfakes, face swaps, and document forgeries, with document deepfakes alone expected to jump close to 40-fold. A fraudster no longer needs a graphic designer to fake a passport photo page. A generative model can now produce a document image, and a real-time face swap can pass a liveness check that was designed years before this kind of tooling existed.
This is why onboarding checks built around a single static ID scan are aging out fast. Anyone tracking financial fraud trends across the sector will notice the same shift showing up in banking, crypto exchanges, gig-economy platforms, and online lenders at once: the fraud isn't concentrated in one channel, it's spreading wherever onboarding still leans on a document photo and a selfie without deeper signal. Layered verification, active liveness challenges, device and behavioural signals, and cross-referencing against known fraud patterns rather than a single document check, is becoming the baseline rather than a premium feature.
The EU's new Anti-Money Laundering Authority began operations on July 1, 2025, headquartered in Frankfurt after member states competed for the seat. Consilium's own announcement of the decision called AMLA "the centrepiece of the reform of the EU's anti-money laundering framework," and it isn't an exaggeration. AMLA gets direct and indirect supervisory powers over obliged entities, plus the authority to impose sanctions, backed by a staff of more than 400 once fully operational.
What changes in practice is accountability. Rather than 27 national regulators each interpreting AML obligations slightly differently, a subset of the highest-risk cross-border financial institutions will answer directly to a single EU-level supervisor. For a compliance officer at a bank operating across several member states, that means one consistent rulebook instead of reconciling a patchwork of national guidance, and it means an enforcement body with teeth rather than a coordination function with a mailing list.
Smaller firms shouldn't read this as something that happens to other people. AMLA's technical standards and guidance will filter down through national regulators regardless of whether a given firm sits under direct supervision, and the direction of travel is unmistakably toward harmonised, stricter enforcement across the bloc. A regional payment institution that's never dealt with a supranational regulator before will still feel the effects the first time its national authority updates a reporting template to match AMLA's format.
The Digital Operational Resilience Act took effect across the EU financial sector on January 17, 2025, and it reframes something that used to sit purely in the IT department's lap: operational resilience is now a fraud and compliance issue, not just an uptime metric.
DORA requires financial entities to maintain a register of every ICT third-party provider they rely on, test their systems against realistic cyberattack scenarios, and report major incidents within tight timeframes. That matters for fraud prevention for a plain reason: a ransomware attack or a cloud outage at a core banking provider doesn't just knock out online banking, it also creates a window where fraud monitoring systems go dark or degrade, exactly the moment fraud rings are quick to exploit. A payment processor whose fraud-scoring engine fails over to a backup with looser rules for two hours has effectively handed criminals a two-hour amnesty.
Firms that treated cybersecurity and fraud prevention as separate budget lines are having to merge those functions, or at least get them talking to each other properly, because DORA's incident reporting obligations and a bank's fraud loss reporting increasingly cover the same underlying event.
None of the scam patterns above work without somewhere for the money to land first. That's what a money mule account is: a bank account, often opened by a real person for a real (if naive) reason, used to receive stolen funds and move them onward before anyone can claw them back.
Europol's 2025 Internet Organised Crime Threat Assessment describes a thriving underground market where stolen personal data gets bought, sold, and repackaged to open these accounts at scale, sometimes using real identities recruited through fake job ads promising easy money for "processing payments," sometimes using synthetic identities built for exactly this purpose. Students and people in financial difficulty are common recruitment targets, often through social media ads that never mention the word "mule."
For a bank, catching a mule account matters more than catching any single fraudulent transaction, because one mule account can be the exit point for dozens of unrelated scams running in parallel. This is where network analysis earns its keep: an account that receives transfers from ten different, unconnected customers in different cities within a week is a far stronger signal than any single transaction looked at in isolation. The instant payment rails that make life easier for legitimate customers are the same rails that let a mule account cash out and close before a bank's investigation team even opens the file.
A lot of these accounts get opened through onboarding flows that never should have approved them in the first place: a stolen identity document, a rushed video selfie check, a name that doesn't quite match the address on file. Tightening onboarding controls at account opening does more to choke off the mule supply than any amount of after-the-fact transaction monitoring, because it stops the account from existing rather than trying to catch what flows through it later.
Given all of that, what does a workable defence actually look like on the ground, rather than in a regulatory press release?
None of this is theoretical for the people running fraud operations inside actual banks and fintechs, and it's worth hearing it from them directly rather than from a summary. The WTF podcast spends entire episodes with fraud leads and investigators walking through cases like these, the near misses as much as the failures, which tends to be more useful than another whitepaper full of averages.
The pattern across every section here is the same one: fraud prevention in Europe has stopped being a problem any single institution solves alone. A bank's fraud controls are only as good as the payee-verification checks its counterparties run, the mule accounts its peers have already flagged, and the identity signals shared across a market rather than hoarded inside one company's database. Regulation is pushing hard in that direction. The institutions getting ahead of it aren't the ones with the biggest compliance budget, they're the ones treating fraud data as something to pool rather than protect.
Disclaimer: The information provided on the Website does not constitute investment advice, financial advice, trading advice, or any other form of advice, and you should not interpret any of the financial content as such. Please conduct your own due diligence and consult with a financial advisor before making any investment decisions. Midday does not endorse or promote any such activities, and you access them at your own risk, fully understanding the monetary and legal consequences involved. Midday shall not be held responsible for any losses you may incur as a result of using any such apps or websites.
