A legitimate payment under suspicion
A customer makes an unusual transfer. The bank pauses it, asks for confirmation and perhaps requires a call. The interruption may prevent a scam. It may also delay a genuine property payment, supplier invoice or family transfer. Security teams need to understand both outcomes to judge whether the control is working.
The joint EBA and ECB report on payment fraud finds that strong customer authentication has helped reduce certain fraud while criminals have adapted. The evidence comes from a defined European reporting period. It does not suggest that extra checks on every transaction are the most effective answer.
Friction can be measured. The share of legitimate transactions challenged, time to resolution, customer abandonment, repeated contacts and accessibility failures all belong alongside fraud losses and confirmed attempts.
Fraud moves around the strongest gate
A technical authentication step establishes that a credential or device was used. It does not prove that the customer understood the beneficiary or was free from manipulation. The EBA consumer trends assessment highlights scams in which payers are persuaded to authorise payments themselves.
A bank that improves account login security may still see losses through social engineering, compromised business processes or account changes. More authentication at login does not necessarily address a scam that happens after the customer has signed in. Controls should reflect where the loss actually arises.
This requires careful messages. A generic warning shown on every payment becomes easy to ignore. A timely explanation that names a particular risk, without revealing sensitive detection rules, may better support an informed decision. Its effectiveness should be tested against customer outcomes.
The cost of false positives
A false positive occurs when a legitimate payment is flagged as suspicious. It can impose a direct cost on the customer, particularly if a time-sensitive obligation is missed. The bank also incurs contact-centre work, complaints and potentially lost trust. These costs are harder to tally than fraud losses but no less real.
Metrics should distinguish a brief extra step from a payment blocked for several days. They should also show which groups experience the greatest burden. Customers who lack a smartphone or need accessible support may face a very different journey from the average user.
The EBA risk assessment identifies stolen credentials and social engineering among important fraud drivers. A risk-based response should therefore combine authentication with monitoring, beneficiary checks where appropriate and effective case handling rather than treating every customer as equally risky.
When fewer challenges are appropriate
Exemptions and differentiated checks can reduce needless friction for some low-risk activity, subject to applicable rules and the provider’s risk controls. The EBA report on account access authentication exemptions illustrates that European technical standards have been adjusted in this area. Its precise provisions apply within their legal scope and should not be generalised globally.
A bank can use transaction context, account history and the consequence of a mistake to decide whether to intervene. The customer should still be able to recover from a failed challenge or a lost device. An exemption is not an absence of security; it shifts reliance to other controls.
Risk models need monitoring for drift. A pattern that was normal last year may become attractive to fraudsters. At the same time, too many interventions can train customers to approve prompts automatically. Banks need a feedback loop that assesses both forms of failure.
A better review of outcomes
A useful dashboard groups payments by type and risk, then compares confirmed fraud, legitimate declines, manual reviews, average delay and complaints. It follows a flagged case through to resolution. A low fraud rate achieved by stopping a large number of legitimate transactions may be a poor outcome.
The UK Payment Systems Regulator’s APP scam reimbursement dashboard illustrates the value of publishing customer outcomes, although reimbursement data measure a different stage from a bank’s real-time challenge decision. Banks should avoid treating one metric as a complete measure of protection.
An independent sample review can identify whether warnings were comprehensible, whether staff had enough information and whether customers were given a fair route to correct an error. Numbers locate a problem; case records explain it.
Protect the relationship as well as the transaction
Fraud controls are successful when they stop losses while allowing legitimate customers to transact with confidence. Some delay is justified for a high-risk transfer, and speed alone is not the aim. The bank should be able to explain why its interventions are proportionate and how quickly it resolves mistakes.
The strongest design connects detection, customer communication and support. When a customer reports a suspected scam, a clear path to urgent help matters. When a legitimate payment is blocked, a prompt and accessible correction path matters just as much.
The decision cannot be reduced to a single fraud rate or conversion measure. Banks need to see the full cost of a control, then adjust it as customer behaviour and criminal tactics change.
Different delays have different consequences
A five-second biometric prompt and a two-day account freeze both count as interventions, but their customer effects differ greatly. Banks should segment the duration and consequence of each challenge. The impact of delaying a routine subscription payment is not the same as holding a payroll run or a property completion.
The customer may also abandon the transaction without formally complaining. That outcome should be visible in data, subject to privacy safeguards. A bank that measures only complaints may underestimate friction because many customers simply choose another route.
The review should include the accessibility of the challenge. A process that assumes every customer can receive a mobile notification may disadvantage people with limited connectivity, older devices or particular disabilities. An alternative path should preserve security and avoid excessive waits.
A scam can pass authentication
In an authorised push payment scam, a customer may complete every required authentication step while acting on a false story supplied by a criminal. A control focused only on proving possession of a device cannot establish that the beneficiary is genuine or that the purpose of the transfer is understood.
A timely challenge can ask the customer to pause and verify independently, but warning fatigue is a real limitation. Banks can test whether a targeted intervention changes the decision for higher-risk payments without imposing repeated warnings on low-risk activity.
Staff escalation matters when the signals remain ambiguous. The bank needs a consistent way to document concerns and release a legitimate payment. Unclear handoffs can leave customers caught between the fraud and service teams.
Model governance is part of customer protection
Fraud detection models are trained on observed cases and can become less effective as criminal tactics change. They can also flag unusual but legitimate behaviour, such as a first international transfer or a large payment after a house sale. A review should test both missed fraud and unequal rates of false alarms across customer groups.
An intervention threshold can be adjusted, but the result should be evaluated over a suitable period. If a lower threshold catches more suspicious payments but sharply raises legitimate holds, the bank needs evidence that the additional burden is proportionate.
The model should not be the final explanation to the customer. Staff need enough information to assess an appeal, protect sensitive detection methods and correct an erroneous decision. Governance is operational when it gives someone responsibility for those cases.
Recovery matters after the decision
A bank may prevent a scam and still leave a customer feeling uncertain if it offers no clear explanation or next step. A concise message can say what action is required and how to contact the bank safely. It should avoid directing customers to unverified telephone numbers or links.
If money is lost, rapid reporting, payment tracing and an understandable claims process become central to the customer outcome. Different legal reimbursement rules apply in different markets, so banks should describe the process accurately for the relevant jurisdiction.
The best control review follows the entire journey: detection, challenge, resolution and any subsequent complaint or claim. That shows whether fraud reduction came with a sustainable customer experience.
References
joint EBA and ECB report on payment fraud
EBA consumer trends assessment
EBA report on account access authentication exemptions
UK Payment Systems Regulator’s APP scam reimbursement dashboard