Real-time monitoring: staying ahead of modern payment fraud

Industrialised fraud and instant payments have outpaced single-institution defences. Real-time, network-level monitoring (backed by the PSR and tools like FPAD) is the fix, if PSPs adopt it widely and consistently.

Fraud levels in European payments are rising sharply, driven by well-resourced criminal groups using increasingly advanced technology. Today’s fraud is no longer the work of isolated individuals, but an industrialised threat. Highly coordinated networks operate on a corporate scale and are estimated to command a global workforce of close to 1.5 million people. These criminal operations run “fraud factories”, invest billions in scam advertising each day and deploy cutting-edge tools such as generative AI and deepfakes.

In tandem, the 24/7 immediacy of instant payments, where funds are cleared irrevocably within seconds, leaves a vanishingly small window in which to detect and stop illicit flows. Money-mule networks, comprising both knowing and unwitting accomplices, can rapidly disperse stolen funds across multiple accounts and borders. This is reflected in fraud recalls for instant payments occurring at a rate ten times higher than that for standard credit transfers.

Against this backdrop, the forthcoming Payment Services Regulation (PSR) places fraud prevention at the centre of Europe’s payments agenda, recognising that effective defences must operate in real time and across institutions if they are to keep pace with increasingly fast, coordinated, and technology-enabled threats.

How VOP provides the foundations

In October 2025, as part of the wider Instant Payments Regulation (IPR), PSPs were mandated to perform checks before a payment is authorised to validate whether the recipient’s name and International Bank Account Number (IBAN) match. By providing greater certainty to the payer, the Verification of Payee (VOP) scheme targets misdirected payments and authorised push-payment (APP) fraud.

While highly effective at preventing genuine mistakes, VOP’s effectiveness against sophisticated fraud is more limited – as many scams involve accounts where the name superficially matches or where fraudsters co-opt legitimate accounts (‘mule accounts’) that pass the name check.

Through its mandatory rollout, VOP has also served as an important technological stepping stone by driving the widespread adoption of application programming interfaces (APIs) and real-time connectivity across the payments ecosystem. This has established much of the infrastructure needed to support the more advanced real-time transaction monitoring requirements set out in the forthcoming PSR.

Looking ahead to the PSR

The PSR will require PSPs to perform real-time transaction monitoring on all incoming and outgoing payments. Monitoring must draw on historical transaction data and information-sharing arrangements, recognising that effective fraud detection depends on a broader view than any single institution possesses.

Moreover, the new regulation will oblige PSPs to participate in information-sharing arrangements and to exchange pseudonymised data with other PSPs for fraud prevention and detection purposes. The latter must be done in case of known or suspected fraudulent behaviour by a payment service user.

In combination with the IPR, the forthcoming PSR requirements are set to pave the way for PSPs to take the fight against payment fraud to the next level.

A network-level approach

A major obstacle to more effective fraud fighting is that no single PSP has sufficient visibility to identify many modern fraud patterns. Criminal networks deliberately distribute activity across institutions, accounts and jurisdictions, meaning suspicious behaviour often becomes evident only when transactions are viewed collectively.

Transaction monitoring is therefore most effective at the network level, where a much broader data view can be taken into account than each individual PSP has at its disposal. The indicators and signals generated from this network-wide view can enrich PSPs’ own anti-fraud engines with additional intelligence. Because the analysis takes place in real time, it also avoids the delays associated with end-to-end information-sharing models, which typically require suspicious accounts to be identified and validated before information can be exchanged and action taken.

One example of a fraud-fighting tool that leverages a network-wide perspective is EBA CLEARING’s Fraud Pattern and Anomaly Detection (FPAD) functionality. FPAD draws on insights from across its SEPA payment systems to enable real-time transaction monitoring at a pan-European scale. In practice, FPAD provides participating PSPs with many of the data points and network-wide indicators required to meet the PSR obligations. Early adopters report that FPAD enabled them to reduce fraud losses by 30% or more within the first six months. In addition, FPAD can support information sharing across the ecosystem by combining and analysing passive and active data feeds from participating PSPs.

The real-time monitoring imperative

As the payments ecosystem continues to evolve, a fundamental reality remains: the defence of the network is only as strong as its weakest link. The effectiveness of real-time transaction monitoring will depend on broad and consistent adoption. Where PSPs do not consume network-level signals and act on the resulting insights, gaps may emerge that criminals can exploit.

In order to reduce systemic vulnerabilities, more collective action is needed. Together with a pan-European group of fraud experts, for example, EBA CLEARING constantly improves FPAD models to capture new or evolving fraud scenarios, such as the exploitation of direct debits by criminals. By continually adapting these capabilities as a community, the industry can stay ahead of changing threats and strengthen the resilience of the entire payments ecosystem.

About Erwin Kulk

Erwin Kulk is Head of Service Development and Management at EBA CLEARING. In this position, he manages EBA CLEARING’s payment services EURO1, STEP2 as well as RT1 and leads the development of new services. Erwin has been working in the domain of interbank payment processing since 1998 and joined EBA CLEARING in 2012.

 

About EBA CLEARING

EBA CLEARING is a European-owned, European-governed and European-regulated provider of payment infrastructure solutions processing over 23 billion payments a year. Founded in 1998, the company is owned by 48 of the major banks operating in Europe and is based on a country-neutral governance model. The payment systems of EBA CLEARING are pan-European by design and desire: they are developed in close co-operation with the Company’s multinational user community and best-of-breed technology partners. EBA CLEARING manages and operates the payment services EURO1, STEP1, STEP2 and RT1. Both EURO1 and STEP2 have been classified as systemically important payment systems (SIPS) by the European Central Bank. RT1, the first pan-European real-time payment system, has been processing euro instant payments complying with the European Payments Council (EPC)’s SEPA Instant Credit Transfer Scheme since 2017.  For more information on EBA CLEARING, please visit www.ebaclearing.eu or follow us on LinkedIn.