How Much Fraud Does Europe Actually See?
What Europe’s payment statistics reveal about fraud, and what they leave out.
Imagine a customer taking a call from someone claiming to work for her bank. The caller tells her that her savings are at risk and urges her to move them to a secure account. She opens the genuine banking app, enters the details and confirms the transfer herself. The bank can verify that she used the app to approve the payment. The caller’s instructions are invisible to it.
Payment service providers in the European Economic Area reported €4.2 billion in fraudulent transactions in 2024, up from €3.5 billion in 2023. Fraud represented about 0.002% of the total value of payments covered by the report. For credit transfers, the distribution of losses tells a different story. Payment service users bore about 85% of the reported fraud losses, according to the joint EBA–ECB report on payment fraud.
A small share of the payment system can represent a large share of someone’s savings. To understand where protection works, we need to follow a case from the initial deception to the receiving account and the eventual loss.
🟥 What does the €4.2 billion measure?
The report measures the value of fraudulent payments identified and reported by payment service providers. Credit transfers accounted for €2.5 billion and card payments for €1.3 billion in 2024. Direct debits, cash withdrawals and electronic money transactions made up the remainder of the reported transaction value.
A fake investment scheme may appear in this dataset through a transfer a bank identifies as fraudulent. The same payment can form part of a police investigation, while the scheme itself may appear in a financial regulator’s records. Adding those figures risks counting the same money more than once. The opposite problem arises when a payment goes unrecognised. If the customer has yet to discover the deception and the provider has no reason to flag it, the transfer can remain indistinguishable from ordinary activity.
🟥 What changes when the customer makes the payment?
In an account takeover, a criminal gains access and initiates a payment. In a scam involving manipulation of the payer, the customer initiates it after being deceived. In 2024, manipulation accounted for 74% of the value of reported fraudulent credit transfers, up from 65% in 2023. Strong customer authentication remains particularly effective against card fraud. It offers less protection when the criminal persuades the customer to complete the security checks herself, as the EBA and ECB’s analysis of fraud types shows.
Verification of payee addresses a separate risk. It checks whether the name entered by the payer matches the account identifier. The EU’s Instant Payments Regulation provides for this check on both standard and instant euro credit transfers. A mismatch can prompt the customer to pause. A match can coexist with fraud when the criminal supplies the correct name for an account used to receive the proceeds.
🟥 Can the data tell us which scams are growing?
A call from a fake bank employee, a false invoice and a fabricated romance can all lead to the same kind of transfer. Each leaves a payment record with an amount, a time and a destination. The story behind it may emerge only when the customer reports what happened.
Fraud labels also describe different parts of the deception. Phishing can be the first contact. Bank impersonation gives the message apparent authority. A fake investment platform can sustain the relationship and prompt further payments. One scam can use several methods, and one victim can make several transfers.
The European figures reveal a shift towards manipulation of the payer. To see which tactics are driving that shift, institutions would need to record consistently how the contact began, what persuaded the customer and how the case was identified.
🟥 What can the receiving bank see?
The sending bank may see an unusual transfer to a new recipient. The receiving bank may see several unrelated customers paying into the same account, followed by rapid transfers out. That second pattern can help identify a mule account, an account used to receive and move criminal proceeds. When payments settle within seconds, the time it takes for a warning to reach the receiving institution can determine whether funds are still there.
An investment scam illustrates the timing problem. A platform lets a customer make a small withdrawal, building enough confidence for a larger deposit. Months later, it refuses a second withdrawal. By the time the customer calls her bank, the proceeds may have passed through several accounts. Police can use the messages and platform records to investigate the deception. Financial intelligence can help connect transactions across institutions, as FIU-Nederland explains.
🟥 5. Who ultimately carries the loss?
Payment providers reported €2.2 billion in fraud losses on credit transfers in 2024, compared with €2.5 billion in fraudulent credit transfers. The difference cannot be used to calculate how much money was recovered. Providers report losses in the period when they book them, which may differ from the period when the fraudulent payment took place. The two totals can therefore cover different sets of transactions, as the report’s loss methodology explains.
Recovering funds takes money back from the recipient or from an account further along the chain. Reimbursing a customer determines who bears the financial loss. A provider can reimburse the customer even if the criminal keeps the proceeds.
The EU’s revision of its payments framework, known as PSR and PSD3, addresses part of that allocation. In its first-reading position adopted on 29 October 2026, the Council’s proposed Payment Services Regulation would require providers to refund consumers in qualifying cases of bank impersonation. The text sets conditions for notifying the provider and reporting the fraud to police, and allows refusal on specified grounds, including objectively justified suspicion of gross negligence. The scope of that protection matters for customers who approve a payment while being deceived.
🟥 What should Europe measure next?
Europe needs to be able to follow a fraud case across institutions. That means recording how the payment was initiated, when each provider became aware of the fraud, whether the receiving institution could intervene, and how much was eventually recovered or reimbursed. The record should also show how long the customer waited for an outcome.
That sequence would make different safeguards easier to assess. A name check may prevent a payment from being sent. A prompt alert may help the receiving provider preserve funds. A refund rule can protect the customer after the proceeds have gone. Each measure has an outcome that can be tracked.
Signal
Europe can measure the value of the fraudulent payments it identifies. The next step is to show where the money could be stopped, how much came back and who was left to bear the loss.
This is the first article in AMLA and Europe’s Fraud Defences, a five-part series from Altair Media Europe on how Europe tracks criminal money and protects bank customers.
Credit
AI-generated illustration by Altair Media / OpenAI.
Caption
A customer is about to confirm a bank transfer. A red trail through the financial district traces the route her money could take beyond the banking app.
