Guideline 1: Payment transactions and fraudulent payment transactions

1.1. For the purposes of reporting statistical data on fraud to the EBA and the ECB in accordance with these Guidelines and with Article 96(6) PSD2, the competent authority should report for each reporting period:

• a. unauthorised payment transactions made, including as a result of the loss, theft or misappropriation of sensitive payment data or a payment instrument, whether detectable or not to the payer prior to a payment and whether or not caused by gross negligence of the payer or executed in the absence of consent by the payer (‘unauthorised payment transaction’); and
• b. payment transactions made as a result of the payer being manipulated by the fraudster to issue a payment order, or to give the instruction to do so to the payment service provider, in good-faith, to a payment account it believes belongs to a legitimate payee (‘manipulation of the payer’).

1.2. For the purposes of Guideline 1.1, the competent authority should report only payment transactions that have been initiated and executed (including acquired where applicable) by payment service providers (including card based payment instrument issuers where applicable). The competent authority should not report data on payment transactions that, however linked to any of the circumstances referred to in Guideline 1.1, have not been executed and have not resulted in a transfer of funds in accordance with PSD2 provisions.

1.3. The competent authority should report all payment transactions and fraudulent payment transactions in accordance with the following:

• a. For non-card based payment transactions and remote card based payment transactions, ‘domestic payment transactions’ refer to payment transactions initiated by a payer, or by or through a payee, where the payer’s payment service provider and the payee’s payment service provider are located in the same Member State,
• b. For EEA branches, domestic payment transactions refer to the payment transactions where both the payer’s and the payee’s payment service providers are in the host Member State where the branch is established.

• c. For non-card based payment transactions and remote card based payment transactions, ‘cross-border payment transactions within the EEA’ refer to payment transactions initiated by a payer, or by or through a payee, where the payer’s payment service provider and the payee’s payment service provider are located in different Member States.
• d. For non-remote card-based payment transactions, ‘domestic payment transactions’ refer to payment transactions where the payer’s payment service provider (issuer), the payee’s payment service provider (acquirer) and the POS or ATM used are located in the same Member State. If the payer’s payment service provider and the payee’s payment service provider are in different Member States or the payer’s payment service provider (issuer) is located in a Member State different from that of the POS or ATM, the transaction is a ‘cross-border payment transaction within the EEA’.
• e. ‘Cross-border payment transactions outside the EEA’ refer to payment transactions initiated by a payer, or by or through a payee, where either the payer’s or the payee’s payment service provider is located outside the EEA while the other is located within the EEA.
• f. ‘Total fraudulent payment transactions’ refer to all the transactions mentioned in Guideline 1.1, regardless of whether the amount of the fraudulent payment transaction has been recovered.
• g. ‘Modification of a payment order by the fraudster’ is a type of unauthorised transaction as defined in Guideline 1.1(a) and refers to a situation where the fraudster intercepts and modifies a legitimate payment order at some point during the electronic communication between the payer’s device and the payment service provider (for instance through malware or man-in-the middle attacks) or modifies the payment instruction in the payment service provider’s system before the payment order is cleared and settled.
• h. ‘Issuance of a payment order by the fraudster’ is a type of unauthorised transaction as defined in Guideline 1.1(a) and refers to a situation where a fake payment order is issued by the fraudster after having obtained the payer’s/payee's sensitive payment data through fraudulent means.

1.4. Competent authorities should report data from payment service providers offering payment initiation services in accordance with the following:

• a. ‘Domestic payment transactions’ refer to payment transactions, where the payment initiation service provider and the account servicing payment service provider are located in the same Member State.
• b. ‘Cross-border payment transactions within the EEA’ refer to payment transactions, where the payment initiation service provider and the account servicing payment service provider are located in different Member States.

• c. ‘Cross-border payment transactions outside the EEA’ refer to payment transactions, where the payment initiation service provider is located within the EEA and the account servicing payment service provider is located outside the EEA.

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Normas relacionadas

2. Requisitos identificados

3. Normas relacionadas

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/