Guideline 1: Payment transactions and fraudulent payment transactions

1.1. For the purposes of reporting statistical data on fraud in accordance with these Guidelines, the payment service provider should report for each reporting period:

• a. unauthorised payment transactions made, including as a result of the loss, theft or misappropriation of sensitive payment data or a payment instrument, whether detectable or not to the payer prior to a payment and whether or not caused by gross negligence of the payer or executed in the absence of consent by the payer (‘unauthorised payment transactions’); and
• b. payment transactions made as a result of the payer being manipulated by the fraudster to issue a payment order, or to give the instruction to do so to the payment service provider, in good-faith, to a payment account it believes belongs to a legitimate payee (‘manipulation of the payer’).

1.2. For the purposes of Guideline 1.1, the payment service provider (including the payment instrument issuer where applicable) should report only payment transactions that have been initiated and executed (including acquired where applicable). The payment service provider should not report data on payment transactions that, however linked to any of the circumstances referred to in Guideline 1.1, have not been executed and have not resulted in a transfer of funds in accordance with PSD2 provisions.

1.3. In the case of money remittance services where funds were transferred from a payer’s payment service provider to a payer’s money remitter payment service provider (as part of a money remittance payment transaction), it is the payer’s payment service provider, rather than the money remitter payment service provider, who should report the payment transactions from the payer’s payment service provider to the money remitter. Such transactions should not be reported by the payment service provider of the beneficiary of the money remittance payment transaction.

1.4. Transactions and fraudulent transactions where funds have been transferred by a money remitter payment service provider from its accounts to a beneficiary account, including through arrangements offsetting the value of multiple transactions (netting arrangements), should be reported by the money remitter payment service provider in accordance with Data Breakdown G in Annex 2.

16 1.5. Transactions and fraudulent transactions where e-money has been transferred by an e-money provider to a beneficiary account, including where the payer's payment service provider is identical to the payee's payment service provider, should be reported by the e-money provider in accordance with Data Breakdown F in Annex 2. Where the payment service providers are different, payment is only reported by the payer’s payment service provider to avoid double counting.

1.6. Payment service providers should report all payment transactions and fraudulent payment transactions in accordance with the following:

• a. ‘Total fraudulent payment transactions’ refer to all transactions mentioned in Guideline 1.1, regardless of whether the amount of the fraudulent payment transaction has been recovered.
• b. ‘Losses due to fraud per liability bearer‘ refers to the losses by the reporting payment service provider, its payment service user or others, reflecting the actual impact of fraud on a cash flow basis. Since the registering of financial losses borne may be disassociated time-wise from the actual fraudulent transactions and in order to avoid revisions of reported data purely due to this immanent time lag, the final fraud losses should be reported in the period when they are recorded in the payment service provider’s books. The final fraud loss figures should not take into account refunds by insurance agencies because they are not related to fraud prevention for the purposes of PSD2.
• c. ‘Modification of a payment order by the fraudster’ is a type of unauthorised transaction as defined in Guideline 1.1(a) and refers to a situation where the fraudster intercepts and modifies a legitimate payment order at some point during the electronic communication between the payer’s device and the payment service provider (for instance through malware or attacks allowing attackers to eavesdrop on the communication between two legitimately communicating hosts (man-in-the middle attacks)) or modifies the payment instruction in the payment service provider’s system before the payment order is cleared and settled.
• d. ‘Issuance of a payment order by the fraudster’ is a type of unauthorised transaction as defined in Guideline 1.1(a) and refers to a situation where a fake payment order is issued by the fraudster after having obtained the payer/payee's sensitive payment data through fraudulent means.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Standards relatati

2. Rekwiżiti identifikati

3. Standards relatati

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/