ARTICLE
PSD3 and the PSR: why fraud prevention is becoming a real-time priority
For banks and payment providers, PSD3 and the Payment Services Regulation (PSR) are set to change more than reimbursement rules. They are pushing fraud prevention towards a model where PSPs need to take greater responsibility for stopping scams before money leaves the account.
That matters because the nature of fraud is changing. APP scams, impersonation and AI-enabled social engineering increasingly target the customer rather than the bank’s authentication controls. A customer can be using their own device, pass authentication and still be manipulated into making a fraudulent payment.
As discussed by fraud and payments leaders from Citi, Klarna, NatWest and NICE Actimize in our MoneyLIVE webinar, this means banks need to look beyond the transaction itself and understand what is happening across the customer’s journey.
From reimbursement to prevention
Greater reimbursement liability will put more pressure on PSPs to prevent fraud rather than simply manage losses afterwards.
But, as Jonathan Leslie of NatWest highlighted, reimbursement alone does not solve the underlying problem. The money is still reaching the criminal, while customers can lose trust even when they eventually get their money back.
The focus therefore needs to move further upstream – from recovering fraudulent payments to identifying the signals that suggest a customer is being targeted in the first place.
That starts with the wider customer journey. Onboarding should not be treated as a one-time check. Banks need to understand whether subsequent behaviour is consistent with what they know about the customer, particularly as criminals increasingly use compromised or synthetic identities.
Is the customer being manipulated?
One of the biggest challenges for fraud teams is that many scams now exploit legitimate customer behaviour.
Traditional fraud controls ask whether a payment looks suspicious. Increasingly, banks need to ask a different question: is the customer being coerced or deceived?
Behavioural signals can provide valuable context. A new payee, a recent limit increase, an unfamiliar device or location, unusual navigation or hesitation during a payment may not look particularly significant individually. Together, they can tell a very different story.
The answer is not simply to add more warnings. Generic scam messages can quickly become background noise, particularly when customers are already being pressured by a fraudster.
Interventions need to be timely and specific – explaining what looks unusual and giving the customer a reason to pause and reconsider the payment.
Real-time prevention starts with the right data
As instant payments reduce the time available to detect and stop fraud, banks need to make decisions in milliseconds.
But the challenge is not necessarily finding a better fraud model. It is connecting the right information quickly enough for that model to act.
As Jagdish Udayakumar of Citi explained, banks need to bring together signals such as device and session data, authentication, verification of payee, beneficiary intelligence, onboarding information and customer behaviour.
The important thing is the pattern created by those signals.
A customer adding a new payee, increasing their payment limit and then making a large transfer from an unfamiliar location may look very different from any one of those events in isolation.
That also means looking at both sides of the payment. Receiving institutions have an important role to play in identifying mule accounts and stopping fraudulent funds before they move further through the network.
And as banks increase their use of sophisticated analytics and AI, explainability remains essential. Institutions need to understand which signals triggered an intervention and be able to demonstrate how their controls work.
Intelligence sharing needs to happen in real time
Fraudsters do not operate within the boundaries of individual banks, yet the industry can still be hampered by fragmented information.
The panel highlighted the importance of sharing intelligence between payer and beneficiary institutions, particularly while a payment is still in progress. Sharing information after an incident can improve future detection, but real-time intelligence creates an opportunity to prevent the next victim.
Making this work at scale requires more than regulatory permission. Banks need the governance, security and technical infrastructure to share and consume actionable information, while participants need to see clear value from doing so.
There is also an opportunity to look beyond financial institutions. Telecoms, technology platforms and other parts of the ecosystem can hold information that helps identify fraud networks earlier.
The longer-term goal is to move from reacting to individual fraud events towards disrupting the networks behind them.
Stronger authentication does not have to mean more friction
PSD3 will also bring changes to Strong Customer Authentication (SCA), including a broader range of customer actions.
But more authentication does not necessarily mean better protection. In an authorised scam, the genuine customer can pass the authentication process because they are the person making the payment.
The panel therefore discussed a more risk-based approach: keep straightforward, low-risk journeys simple while applying additional intervention when activity looks genuinely unusual.
Accessibility also needs to remain part of the conversation. Fraud controls cannot assume that every customer has the same device, digital confidence or ability to complete an authentication journey.
Customer-configurable controls, such as payment limits and channel restrictions, can provide another layer of protection while generating useful behavioural signals. But banks also need to recognise that criminals may manipulate customers into changing those settings.
The role of AI
AI has an increasingly important role to play, but the discussion was less about introducing AI for its own sake and more about where it can improve existing fraud processes.
For frontline teams, AI could help bring together large amounts of customer and transaction information, identify potential scam narratives and suggest useful next questions during a customer conversation.
That could help banks intervene more effectively without simply adding more friction to the payment journey.
At the same time, AI is giving criminals new ways to manipulate customers, making the need for stronger behavioural and contextual detection even more pressing.
Preparing for the changes ahead
The key message from the discussion was that PSD3 and the PSR should not be treated simply as a compliance deadline.
Banks need to start thinking about how their fraud teams, data, technology and customer interactions work together – from onboarding through to payment, intervention and investigation.
That means connecting fragmented signals, building real-time decisioning capabilities, strengthening intelligence sharing and giving frontline teams the information they need to act.
Ultimately, the goal is not to introduce more friction. It is to introduce the right intervention at the right moment – before a customer has been manipulated into sending money, while keeping legitimate payments fast, accessible and trusted.
About NICE Actimize
As a global leader in artificial intelligence, platform services and cloud solutions, NICE Actimize excels in preventing fraud, detecting financial crime and supporting regulatory compliance. Over 1,000 organizations across more than 70 countries trust NICE Actimize to protect their institutions and safeguard assets throughout the entire customer lifecycle. With NICE Actimize, customers gain deeper insights and mitigate risks. Learn more at www.niceactimize.com.
Stay in the loop with MoneyLIVE
Subscribe to our newsletter to receive news, insights and special offers.