Line4

In forcePayments and crypto-assetsLast checked 11 November 2026

Payment fraud statistics (PSD2, PSD_FRP)

A regulatory return listed by the European Banking Authority (EBA), European Union.

Payment service providers report statistics on fraudulent payment transactions (unauthorised transactions and transactions where the payer was tricked into paying a fraudster), broken down by payment type, to their supervisor. Supervisors add the figures up and pass them to the EBA and the European Central Bank. The EBA says the Guidelines aim to help increase the security of retail payments in the EU. Source

Official title: Guidelines on fraud reporting under the Payment Services Directive (PSD2) (EBA/GL/2018/05, as amended by EBA/GL/2020/01)

Check a PSD2 fraud reporting file, freeEvery EBA rule for PSD2 fraud reporting, in plain words

The facts

Who files
Payment service providers as defined in PSD2 (for example banks, payment institutions and e-money institutions), except account information service providers (Guidelines, paragraph 12). Each provider reports to the competent authority of its home Member State, including data from its agents (Guideline 5.1 and 5.2). An EEA branch reports separately to the authority of the host Member State (Guideline 5.3). The competent authorities then aggregate the data for their country and send it to the EBA and the ECB (Guidelines section 3.2; EBA/DC/453 Articles 1 and 2). Each authority sends one file covering all providers in its jurisdiction, and does not send data the ECB has already passed to the EBA (EBA/DC/453 Article 2(2) and (3)). The 4.2 PSD_FRP module is this authority-to-EBA report. Source
How often
Providers report every six months (Guideline 3.1). Providers using the Article 32 PSD2 exemption and e-money institutions using the Article 9 Directive 2009/110/EC exemption report once a year, with the data split into two six-month periods (Guideline 3.2). Authorities report to the EBA 'on a semi-annual basis for the reporting periods ending on 30 June and on 31 December' (EBA/DC/453 as amended, Article 3). Source
Deadline
Providers to authorities: 'within the timelines set by the respective competent authorities' (Guideline 3.3 for providers). Authorities to the ECB and EBA: 'within six months from the day after the end of the reporting period' (Guideline 3.4 for authorities). EBA/DC/453 as amended by EBA/DC/482, Article 3: authorities submit to the EBA 'for the reporting periods ending on 30 June and on 31 December, respectively by 10 February and by 10 August of the subsequent year'. The EBA returns validation results by 25 July and 25 January (Article 4(2)). Source
Format
xBRL-CSV, XBRL-XML. Firms file in the data exchange format their national authority sets, following the EBA data point model and its validation rules. Authorities send the data to the EBA in xBRL-CSV only for reference dates from 31 March 2026; for earlier reference dates the EBA accepted xBRL-XML or xBRL-CSV. Source
How it is filed
Filing routes recorded for the EBA: EUCLID (European Centralised Infrastructure of Data); Pillar 3 data hub (P3DH) submissions. See how firms file with the EBA.
Status
In forceThe 4.2 framework page lists the product with 'Status: In force'. The EBA product page shows the amending Guidelines as 'Applicable' with application date 01/07/2020. Reporting to the EBA follows EBA Decision EBA/DC/453 of 24 June 2022 as amended by EBA/DC/482 of 23 March 2023. Source
Legal basis
Group
Payments and crypto-assets
Check a file before you file it

Line4 Check for EBA reporting runs EBA's own validation rules on a PSD_FRP file in your browser, free. Your file never leaves your computer. What it runs, from its published manifest:

  • EBA release 4.2: all 2,399 of EBA's active checks.

Every EBA rule for PSD2 fraud reporting, in plain words

It is not a substitute for the validation the supervisor runs when you submit.

Templates (14)

The tables and forms inside the return. Plain name first, the EBA's code in brackets.

  • Credit transfers transactions (Y 01.01)
  • Losses due to fraud for credit transfers (Y 01.02)
  • Direct debits transactions (Y 02.01)
  • Losses due to fraud for direct debits (Y 02.02)
  • Card-based payment transactions reported by the issuing payment service provider (Y 03.01)
  • Losses due to fraud for card-based payment reported by the issuing payment service provider (Y 03.02)
  • Card-based payments transactions reported by the acquiring payment service provider (Y 04.01)
  • Losses due to fraud for card-based payments reported by the acquiring payment service provider (Y 04.02)
  • Cash withdrawals using cards transactions reported by the card issuer’s payment service provider (Y 05.01)
  • Losses due to fraud for cash withdrawals using cards reported by the card issuer’s payment service provider (Y 05.02)
  • E-money payment transactions (Y 06.01)
  • Losses due to fraud for e-money payment transactions (Y 06.02)
  • Money remittance payment transactions (Y 07.01)
  • Transactions initiated by payment initiation services providers (Y 08.01)

Templates of module PSD_FRP in EBA release 4.2, read from the module's entry point in the taxonomy package; parts of a template split into sub-tables (a, b, c) are listed once. Source

Validation rules

90 rules, as counted from the EBA's published material. Software can run them exactly as published. Source

How they are written: Excel list with one row per rule and module version: an expression column in the EBA's DPM-XL syntax, severity (error or warning), active status and reference-date range. The same rules ship as XBRL Formula assertions in the taxonomy package..

EBA's list applies the active PSD_FRP_4.2 rules to reference dates from 2026-03-31 with no end date set.

The rules, on eba.europa.eu

How they were counted

Distinct rule codes listed for module PSD_FRP_4.2 in EBA's validation rules list VR_4.4.phase1_.xlsx ((from 4.0) EBA_Validation rules, latest update 12/10/2026) with IsActive = Active: 90 of 90 listed. 1 of the active rules have severity error; the rest are warnings.

Counts are in the EBA's own unit, so they are not comparable with other regulators' counts.

Public data

Published only added up across firms. EBA and ECB report on payment fraud (aggregate): Joint EBA and ECB report on the semi-annual payment fraud data reported under Article 96(6) of PSD2, for the six reference periods H1 2022 to H2 2024, by payment instrument and fraud type.. Source

Where it is published (PDF report)

  • EBA and ECB report on payment fraud

    Added up across firms · PDF report

    Joint EBA and ECB report on the semi-annual payment fraud data reported under Article 96(6) of PSD2, for the six reference periods H1 2022 to H2 2024, by payment instrument and fraud type. Source

Official documents (15)

The EBA's own files, with the size and SHA-256 fingerprint of each as downloaded on 11 November 2026, so anyone can tell whether a copy is the same version.

  • Guidelines amending EBA GL on Fraud reporting under PSD2

    Legal text · PDF · 772.4 KB · 22 January 2020

    Listed as 'Legal Act' for PSD_FRP on the 4.2 page. Date is the date printed on EBA/GL/2020/01.

    SHA-256 bcf7ce48864dshow in fullbcf7ce48864d8006f3a1aa17d2ba3228b617bb7529b89cac82f5b287b237bf55
  • Final Report on EBA Guidelines on fraud reporting – Consolidated version updated on 22 January 2020)

    Reporting standard · PDF · 2.0 MB · 22 January 2020

    Consolidates EBA/GL/2018/05 and EBA/GL/2020/01, including the Annex 2 data breakdowns. The EBA says it is 'meant purely as a documentation tool'.

    SHA-256 a6d5c98045e1show in fulla6d5c98045e1389237256a6f39cc7452e8d2fe73cdecdda1ed35d9adeb5e0c4c
  • Decision on reporting of payment fraud data under the revised Payment Services Directive

    Legal text · PDF · 167.8 KB · 24 June 2022

    Consolidated version of EBA/DC/453 as amended by EBA/DC/482 (23.03.2023). Sets authority-to-EBA remittance dates.

    SHA-256 804414d44fcdshow in full804414d44fcd7425beead17d3c58426fccb2dbdd61d8c87ac065ef36dd52e1dc
  • Compliance table (PSD_FRP)

    Other · PDF · 224.9 KB · 20 December 2024

    Which authorities comply with EBA/GL/2020/01.

    SHA-256 ad584136b1b2show in fullad584136b1b29fb79ad4546f14a3b13c672019cc335ca2984259a1fd3c8e793d
  • Final report on Guidelines on fraud reporting under Article 96(6) PSD2 (EBA-GL-2018-05)

    Other · PDF · 1.1 MB · 9 October 2020

    Original 2018 Guidelines (application date 01/01/2019 per the 2018 version page); superseded by the consolidated version for current use.

    SHA-256 c8d15c95dd48show in fullc8d15c95dd4802f87e50789a87aa281cfa9c544c1f17c66ea1e2e47941f353fc
  • DPM table layout and data point categorization (4.2.1)

    Template · ZIP · 17.5 MB · 27 February 2026

    Annotated Excel layouts of every template in release 4.2 and 4.2.1, with row and column codes.

    SHA-256 e022598f9f98show in fulle022598f9f98408d6920555a90c899bea5a1a2519b696703c232526a45b7cc07
  • Reporting framework 4.2

    List of returns · HTML

    Table 1.A maps every module of release 4.2 to its legal act, templates and instructions.

  • Taxonomy package 4.2

    Taxonomy · ZIP · 62.0 MB · 13 January 2026

    XBRL taxonomy for all 50 modules of release 4.2, including the validation rules as XBRL Formula assertions.

    SHA-256 0bf9e33720deshow in full0bf9e33720de1472e809417999cfd29e4b5eadb31750c7770622e502590bbdd0
  • Sample files 4.2

    Sample · ZIP · 2.9 MB · 13 January 2026

    SHA-256 41fb8435ce33show in full41fb8435ce33c53528bd05f8624e79acdfc7e6d8991a67870292646fb88cc0ef
  • (from 4.0) EBA_Validation rules (latest update 12/10/2026)

    Validation rules · XLSX · 1.1 MB · 12 October 2026

    One row per rule and module version, with the expression, severity, active status and reference-date range.

    SHA-256 38c190fa4c2fshow in full38c190fa4c2ff81f22a5bd2ed94f744fc64e4eb9b722676e07f89669d79b1aea
  • Small validation package 14/09/2026: Micro taxonomy package

    Validation rules · ZIP · 1.5 MB · 14 September 2026

    Severity and deactivation updates for the taxonomy (XBRL set folders).

    SHA-256 ea6184a7e3a6show in fullea6184a7e3a67016346f2154bfb04ca0a489ea829cf344239367fa216d21709f
  • EBA filing rule V5.9

    Filing rules · PDF · 1.2 MB · 26 June 2026

    Technical rules for XBRL-XML and xBRL-CSV files sent to the EBA.

    SHA-256 bbc23b9ecad5show in fullbbc23b9ecad5de0a0821bbe8bce8e4ce617652afce02e81c88d572bac4a4b293
  • DPM Know issues (uploaded on 05/11/2026)

    Known issues · XLSX · 69.9 KB · 5 November 2026

    SHA-256 c6753a428649show in fullc6753a4286496876f2e545b355f1ebaddf0e4383de522b19818c93af141327e0
  • EBA filing rule V5.8

    Filing rules · PDF · 1.1 MB · 25 February 2026

    SHA-256 dea8d520c922show in fulldea8d520c9229c52ae1f44e921a3728d769544e0f0c8937da3958f1c0197d2bf
  • FAQs for Reporting Innovations and Upcoming Releases (Updated on 25/11/2025)

    Guidance · PDF · 196.4 KB · 25 November 2025

    SHA-256 ddcccd9e56f0show in fullddcccd9e56f0c670c5fdeffda7b564dd5a7bf752e990be8e6ed3e2fe7c6fd796

Sources

Every page and document this return's facts were read from.

Knowing exactly what is collected, in what format and under which rules is the first step to real-time supervision. Line4 builds SupTech software for financial regulators that runs checks like these as each return arrives.

Line4's text and records here are free to reuse under CC BY 4.0. Please credit: “Source: Line4 regulatory submissions library (CC BY 4.0), https://www.line4.ai”. The regulators' documents, forms, taxonomies, rules and data belong to them: see EBA's reuse terms. This describes what regulators publish. It is not legal or regulatory advice: always rely on the regulator's own text.

Contains material from the European Banking Authority (EBA), https://www.eba.europa.eu, reproduced with the source acknowledged as the EBA's legal notice requires. Source: European Banking Authority.

Last checked 11 November 2026.