Fraud prevention was built around one question: is this really the customer? That is no longer enough. APP scams, synthetic identities, and AI-powered social engineering let fraudsters turn genuine customers and genuine credentials against the bank. At the same time, the PSR and PSD3 are set to move the cost of those losses from customers to payment providers.
In the webinar hosted by The Paypers and Worldline, Fraud in the Digital Identity era: Regulation, Authentication and what comes next, João Rijo Godinho Courinha, Global Product Manager for Fraud Management, and Mathieu Barthelemy, Portfolio Manager for Fraud & Authentication, both at Worldline Financial Services, and Vilém Dědek, Senior Fraud Prevention Strategy and Control Specialist at mBank CZ & SK, joined moderator Dr. Ruth Wandhöfer to discuss what fraud prevention looks like when a customer passes every check.
Here are the key takeaways from the discussion.
A live poll set the scene: half of attendees (50%) identified APP scams and social engineering as their biggest source of losses, well ahead of card-not-present fraud (21%).
When nothing fails, but the customer still loses
João Rijo Godinho Courinha opened the discussion with a case study. Sarah, a low-risk customer in Lyon, gets a call from what her phone shows as her bank. Told that her account is under attack, she opens her banking app, passes biometric SCA, and sends her money to a so-called safe account. The device matches, and she approves the payment herself. As João explained, technically, nothing failed here.
Mathieu Barthelemy described this as the paradox of SCA. While it works well for card payments, credit transfer fraud keeps growing at double digits, even though SCA covers more than 75% of transfers. Vilém Dědek argued that banks must separate authentication from intent: does this payment make sense for this customer, in this context, at this moment? Signals such as a new beneficiary on a recent SIM swap, which telecom initiatives like CAMARA could expose, become meaningful when connected.
The PSR moves the bill to banks
The PSR is expected to shift more of the cost of these scams from customers to payment providers. Citing the EBA’s December 2025 report, João noted that EU credit transfer fraud reached EUR 2.5 billion, up 24% from 2023, with 85% of losses borne by customers and 76% involving manipulation of the payer.
Some countries are already moving in this direction. Courts in France, the Netherlands, Spain, and Norway already protect customers deceived by spoofed bank numbers, and the UK offers a preview of what is to come: since its reimbursement rules took effect in October 2024, 88% of APP claims have been reimbursed, almost GBP 180 million in 11 months. Ruth noted that smaller PSPs struggled to absorb those costs.
For Vilém, liability only helps if it drives prevention. The sending bank, the receiving bank, and the telco each see part of a scam. Fraud doesn’t respect sector boundaries, and our prevention efforts shouldn’t either, he said.
When identity itself becomes the fraud
Mathieu described the case of a student who shared an ID card to book a flat advertised online; the fraudster used it, along with social media photos, to open bank accounts in the student’s name. Synthetic identity fraud rose by more than 160% in Europe last year, he said, as generative AI makes phishing cheap and deepfakes beat liveness checks. eIDAS 2.0 and the European Digital Identity Wallet aim to rebuild trust in how identity data is shared.
Authenticating agents, not just people
Phishing remains the entry door, and passkeys based on FIDO standards close it, with success rates above 90%. They could also play a role in securing agentic commerce.
Mathieu identified three priorities: authenticating the agent, knowing your agent (KYA), and protecting the intent behind it, while also knowing the merchant on the other side of the transaction.
For Vilém, the key is the authority delegated to the agent: what it may do, within which limits, and for how long. Larger amounts or new merchants should bring the customer back in.
What comes next?
Generative AI is not inventing new fraud, Vilém said, but running existing scams at a completely different scale. In the closing poll, votes were spread across payment rails, from instant transfers to the digital euro, which he sees as a chance to build fraud prevention in by design. João read the spread as a warning against silos: criminals follow speed and liquidity, whatever the rail. The PSR’s inter-PSP data sharing will help, he added, but it is no silver bullet.
If one idea ran through the whole discussion, it was a reversal of the past decade’s thinking. After years of working to remove friction from payments, banks and PSPs now have to learn when to add it back, at exactly the moment a customer is about to be deceived.
This webinar recap only highlights the key points of the discussion. For the full conversation, including the Q&A session at the end, watch the webinar recording here.
About Paula Albu
Paula Albu has experience in content writing and editing, as well as being a creative storyteller. As a Junior Editor at The Paypers, she investigates Web3 technologies along with the latest trends and regulations in banking and fintech. Paula is committed to turning complex industry topics into engaging, accessible content that resonates with readers and creates a meaningful connection. She is available via LinkedIn or at paula@thepaypers.com.
About Worldline
Worldline [Euronext: WLN] is Europe's leading operator of critical infrastructure and payment services. With a presence across the entire value chain, the Group offers its customers unique expertise in processing and securing their payments, thereby promoting their growth. Worldline is leveraging its 2030 strategic plan and its technological innovation capabilities to build the European reference payment partner for merchants and financial institutions. With over 1.2 million customers, Worldline achieved EUR 4 billion in revenue in 2025. worldline.com
