Fraud losses — who bore them, and when they count
Fraud transactions and fraud losses are two different numbers, reported on two different bases, and they are not supposed to reconcile. The EBA Guidelines on fraud reporting under Article 96(6) of PSD2 define losses due to fraud per liability bearer as the losses borne by the reporting payment service provider, its payment service user, or others — reflecting the actual impact of fraud on a cash flow basis. Three drafting choices inside that definition catch most firms out.
1. Three liability bearers, not one
| Bearer | Typical case |
|---|---|
| The reporting payment service provider | Refund to the customer where the provider carries the loss |
| The payment service user | Loss left with the customer — including where an excess, a threshold or a conduct finding applies |
| Others | Loss falling elsewhere in the chain — another provider, a merchant, or a party under scheme allocation rules |
Splitting the loss across the three is not an accounting nicety. It is the only place in the framework where the outcome for the customer is visible — and it is what makes a provider’s refund posture comparable across a market.
2. The timing rule that stops endless restatement
Losses are frequently recorded long after the fraudulent transaction, once disputes, recoveries and liability allocation have run their course. If losses had to be reported in the period of the transaction, every reporting period would be permanently open to revision.
The consequence is direct and often unwelcome to a finance team: the loss figure in a period does not correspond to the fraud transactions in that period. Any internal control that reconciles the two will fail by design. What should be reconciled instead is the loss figure to the general ledger, and the transaction figure to the fraud case records.
3. Insurance refunds are excluded
The definition states that final fraud loss figures should not take into account refunds by insurance agencies, on the basis that these are not related to fraud prevention for PSD2 purposes.
This is a genuine reporting trap for firms carrying fraud insurance. The economically correct number for management purposes is net of insurance recovery; the number the guidelines ask for is not. A single “fraud loss” figure serving both purposes will be wrong for one of them, so the two need to be maintained separately and labelled clearly.
4. How losses relate to the transaction counts
The transaction side is deliberately gross. Total fraudulent payment transactions refers to all fraudulent transactions regardless of whether the amount has been recovered — so recovery never reduces the count. Recovery shows up only in the loss figures, and only when it is recorded in the books.
Put together, the framework produces three distinct measures, and a mature fraud MI pack keeps all three visible:
- Fraud transaction volume and value — gross, in the period of the transaction, initiated and executed only.
- Fraud losses by liability bearer — on a cash-flow basis, in the period the loss is recorded, excluding insurance refunds.
- Prevented and blocked attempts — not reported at all under the guidelines, and therefore something the firm must measure for itself if it wants any view of control effectiveness.
That third gap is the one worth acting on. Because the framework counts only executed transactions, an improving prevention rate makes reported fraud fall for reasons the report itself cannot evidence — and a supervisor asking “why did your fraud drop?” is asking for exactly the data the framework does not collect.
FAQ
Should fraud losses match fraud transactions for the period?
No. Losses are reported in the period they are recorded in the provider’s books, precisely to avoid restating earlier periods as disputes and recoveries settle.
Do we deduct insurance recoveries?
Not for this report. Final fraud loss figures should not take insurance-agency refunds into account. Keep the net-of-insurance figure separately for management reporting.
Why report losses by liability bearer?
Because it is the only measure in the framework that shows where the loss actually landed — with the provider, the customer, or elsewhere in the chain.
Related: PSD2 fraud reporting · The supervisory fraud taxonomy · Manipulation of the payer
