PSD2 fraud reporting: EBA guidelines (GL/2018/05)

What PSD2 fraud reporting covers

Payment fraud in the EEA came to €4.2 billion in 2024, against €3.5 billion in 2023 and €3.4 billion in 2022, at a fraud rate of around 0.002% of the value of all payments (EBA and ECB). Card fraud was 17 times higher when the payee was outside the EEA, where strong customer authentication (SCA) is not required. Those numbers are built from this data.

Article 96(6) of PSD2 asks payment service providers to give their authority statistical data on fraud for each means of payment. The EBA guidelines say what to report: every executed payment and every fraudulent one, by number and by value, split into domestic, cross-border within the EEA and cross-border outside it. Two kinds of fraud count: unauthorised payments, and payments the payer made after being manipulated by a fraudster. Blocked attempts do not count (Guidelines 1.1 and 2.4).

01Y 01.01 and Y 01.02: credit transfersAll credit transfers and the fraudulent ones, by channel, by whether SCA was used, by the exemption used when it was not, and by fraud type. Y 01.02 has the losses, by who bore them.

02Y 02.01 and Y 02.02: direct debitsReported by the payee’s provider, with the way consent was given and the fraud type, and the losses.

03Y 03.01 to Y 05.02: cards and cashCard payments from the issuer’s side and from the acquirer’s side, and cash withdrawals with cards, each with its losses.

04Y 06.01 to Y 08.01: e-money, remittances and payment initiationE-money payments, money remittances, and payments initiated through a payment initiation service provider.

€4.2bnof payment fraud reported across the EEA in 2024, up from €3.5bn in 2023EBA and ECB, 2025 report on payment fraud →

10 Feb, 10 Augwhen each authority’s file is due at the EBA, for the half-years to 30 June and to 31 DecemberEBA Decision EBA/DC/453, Article 3 →

2,399checks in EBA’s 4.2 fraud reporting rules (87 rules); only one rule can block a filingLine4 count of the EBA 4.2 package →

Who files, and when

Banks, payment institutions and e-money institutions report to the authority of their home Member State every six months (Guideline 3.1). Small providers exempt under Article 32 of PSD2 or Article 9 of the E-Money Directive report once a year, with figures for each half (Guideline 3.2). Each authority sets its own deadline and format for providers (Guideline 3.3).

The authority then adds up its providers’ figures, breakdown by breakdown, and sends one file for its Member State. Under EBA Decision EBA/DC/453, as amended in 2023, the file follows the EBA data point model and reaches the EBA through EUCLID, its data platform, or via the ECB. The half-year to 30 June is due by 10 February of the next year, the half-year to 31 December by 10 August. The file can be xBRL-CSV, made with the EBA’s Excel tool, or XBRL-XML. In the EBA’s 4.2 taxonomy it is the PSD2 fraud reporting module.

01Payment service providersEvery six months, to their home authority, in the format it sets.

02Small exempt providersOnce a year, with figures for each half-year.

03National authoritiesOne aggregated file per Member State, for the EBA and the ECB.

04The EBARuns its validation rules and sends authorities the results by 25 January and 25 July (EBA/DC/453, Article 4).

What goes wrong in validation

EBA’s 4.2 package has 87 fraud reporting rules, written out into 2,399 checks across the templates, the three geographies and both number and value. By Line4’s count only one rule can block a filing: v09247_s, which says no credit transfer total in Y 01.01 can be negative. The rest are warnings. When an authority submits, it warrants that the data has been through EBA’s validation rules and its own quality checks, or tells the EBA where it has not (EBA/DC/453, Article 4).

01Breakdowns that do not add upMost rules are sums. Remote payments must split into those with SCA and those without (rules such as v09196_h), and payments without SCA must split by the exemption used (v09129_m). Each transaction goes in only one sub-category of each breakdown (Guideline 2.8): counted twice, or not at all, it breaks the sum.

02Card payments outside SCAMerchant-initiated card payments, and one-leg payments where the issuer or the acquirer is outside the EU, have their own categories, “Merchant initiated transactions” and “Other” (Q&A 2019_4866). Left out, they leave the card exemption breakdown short of its total.

03What counts as fraudOnly unauthorised payments and manipulation of the payer. Fraud by the payee, such as a merchant that never delivers, is out of scope unless the payment process itself was manipulated (Q&A 2019_5039).

04Zero or not applicableA provider reports 0 when nothing happened and NA when a breakdown does not apply to it (Guideline 2.10). Mixing the two up makes a provider with no fraud look like one that did not report, and the error flows into the national total.

Every payment without strong authentication needs a reason. A machine can check that for a whole country in seconds.

An example: every payment without SCA needs a reason

Rule v09129_m in EBA’s 4.2 package checks credit transfers in Y 01.01. Here it is with simple numbers.

Domestic credit transfers without SCA, by value, Y 01.01

Low value (row 0170): 120
Payment to self (row 0180): 340
Trusted beneficiary (row 0190): 410
Recurring transaction (row 0200): 260
Secure corporate payment processes (row 0210): 90
Transaction risk analysis (row 0220): 380
Authenticated without SCA, as reported (row 0110): 1,700

How the rulebook writes it

{Y_01.01,r0170,c0010,s0010} + {Y_01.01,r0180,c0010,s0010} + {Y_01.01,r0190,c0010,s0010} + {Y_01.01,r0200,c0010,s0010} + {Y_01.01,r0210,c0010,s0010} + {Y_01.01,r0220,c0010,s0010} = {Y_01.01,r0110,c0010,s0010}

The same check, in plain words

Every credit transfer made without strong customer authentication must sit under one of the six exemptions. The six add up to 1,600, but the file reports 1,700 without SCA, so 100 have no reason. The check fails.

Rule v09129_m is a warning in EBA’s 4.2 package. In an authority’s file each figure is the sum of all its providers’ reports, so the gap can come from a single provider. The numbers are illustrative (€ million).

Check PSD2 fraud data before you send it

Line4 Check runs all 2,399 of EBA's active fraud reporting checks in your browser, on an xBRL-CSV package or an XBRL-XML instance: an authority’s file for the EBA, or a provider’s figures where the authority collects them in the EBA templates. Try it on EBA’s own sample, or drop in your own file. Your file never leaves your computer. It is a free check to catch problems early, not a substitute for the EBA’s own validation.

Free tool · Line4 CheckCheck PSD2 fraud data against EBA's rules, in your browser

Line4 Check runs all 2,399 of EBA's active checks, on an xBRL-CSV package or an XBRL-XML instance. Your file never leaves your computer. It is a free check, not a substitute for your authority's own validation.

Payment fraud PSD2 fraud reporting2,399 of 2,399 checks · 100%

Try EBA's PSD2 fraud reporting sample Check your own file

Why checking at submission matters

Fraud data makes two trips: from each provider to its authority, then from the authority to the EBA. The EBA sends authorities the results of its rules by 25 January and 25 July, months after the period closed. Run when each provider submits, and again when the authority builds its file, the same rules catch a broken total while it can still be fixed at source.

That is the first step to real-time supervision: validated data, sent straight from the providers’ systems, seen as it changes. On top of it, AI can read the movements that matter, such as a jump in fraud on payments that used an SCA exemption, and draft the question for a supervisor, citing the cells behind it. Rules decide whether the data is right. Supervisors decide what it means.

Put it to workBefore you send PSD2 fraud data

1Report executed payments only: blocked attempts are not fraud data (Guideline 2.4).
2Put each transaction in one sub-category of each breakdown, and give every payment without SCA its exemption.
3Report merchant-initiated and one-leg card payments in their own categories (Q&A 2019_4866).
4Leave payee fraud out unless the payment process itself was manipulated (Q&A 2019_5039).
5As an authority, run EBA’s 4.2 rules on the aggregated file well before 10 February and 10 August.

From Insights

Straight-through reporting: what it means for supervisors

Where Line4 fits

Line4 is SupTech software for financial regulators. It collects returns in XBRL, Excel and CSV by portal, API or MCP, validates them against your taxonomies and rules at the point of submission, and puts AI to work reading them, with supervisors making every decision. If you work with a standard we have not yet run in production, we will say so plainly and show you how we would approach it.

You can try validation at the gate now on an EBA filing: our free EBA validator checks filings for 41 EBA modules, in xBRL-CSV or XBRL-XML, against EBA's own rules, in your browser, without uploading anything. Guides to the returns it checks: IRRBB reporting, NSFR reporting, Resolution and MREL reporting, ALMM reporting, Asset encumbrance reporting, Funding plans reporting and Supervisory benchmarking.

Questions

What is PSD2 fraud reporting?

The statistical data on payment fraud that payment service providers give their national authority under Article 96(6) of the revised Payment Services Directive (PSD2), following the EBA Guidelines on fraud reporting (EBA/GL/2018/05, amended by EBA/GL/2020/01). Authorities add up the data and send it to the EBA and the ECB.

Who has to report fraud data under PSD2?

Every payment service provider: banks, payment institutions and e-money institutions, to the authority of their home Member State, with branches reporting to the host authority. Each national authority then sends one aggregated file for its Member State to the EBA and the ECB (EBA Decision EBA/DC/453).

How often is PSD2 fraud data reported?

Providers report every six months, or once a year with figures for each half if they are exempt under Article 32 of PSD2 or Article 9 of the E-Money Directive. Authorities send the half-year to 30 June to the EBA by 10 February of the next year, and the half-year to 31 December by 10 August.

What counts as a fraudulent payment transaction?

Unauthorised payment transactions, including those made with lost, stolen or misappropriated payment data or instruments, and payments the payer made after being manipulated by a fraudster. Only executed transactions count, whether or not the money was recovered; blocked attempts do not (EBA/GL/2018/05, Guidelines 1.1, 1.6 and 2.4).

Which templates are used for PSD2 fraud reporting?

In EBA reporting framework 4.2, templates Y 01.01 to Y 08.01: credit transfers, direct debits, card payments from the issuer’s and the acquirer’s side, cash withdrawals with cards, e-money, money remittances and payment initiation services, with separate templates for losses due to fraud.

Can I check PSD2 fraud data for free?

Yes. Line4 Check runs all 2,399 of EBA's active fraud reporting checks in your browser, on xBRL-CSV or XBRL-XML, without uploading the file. It is not a substitute for the EBA’s own validation.

Sources

Share this guideShare on LinkedIn

Was this useful?

What is XBRL? →What is SupTech? →All data standards →

PSD2 fraud reporting: EBA guidelines, templates and validation rules