OSCAMPS Fraude — the French payment fraud census
Two rules decide most of what goes into the French fraud census, and both cut against how fraud teams normally count. Only proven fraud is declared — attempts are out. And the amount declared is the nominal amount of the payment, not the loss the institution ended up bearing after chargebacks, recoveries and litigation. A fraud function that reports net losses to its own management and reads those figures across into the Recensement de la fraude will understate the return systematically. This piece sets out who is caught, what the return rests on, how the OSCAMPS channel handles it, and the boundary with the separate PSD2 notifications a French PSP also owes.
1. Who is caught
The Banque de France applies the same reporting population to the fraud census as to the payment-means mapping. In scope are credit institutions, payment institutions, electronic money institutions and account information service providers that are either governed by French or Monegasque law and authorised in France or Monaco, or governed by foreign law, entitled to operate in France and established there as a branch. The institutions named in Article L. 518-1 of the Code monétaire et financier are also in scope.
As with the mapping collection, the trigger for a passporting firm is establishment. Serving French customers under freedom of services does not bring an institution into this population; opening a French branch does. A group that runs fraud operations centrally, with no French-specific fraud reporting, acquires a French-perimeter data requirement on the day the branch opens.
2. What the return rests on
Since 1 January 2022, the Recensement de la fraude collection incorporates the requirements of the ECB payment statistics framework as amended by Regulation (EU) 2020/2011 (ECB/2020/59), which amended Regulation (EU) No 1409/2013. That amendment is what pulled the French fraud census into line with the European payment-statistics data model, and it is why the instrument, channel and authentication breakdowns look the way they do rather than following a French-only taxonomy.
From 1 January 2023 the fraud declaration is half-yearly, matching the mapping collection. The Banque de France publishes versioned documentation per data period — a guide de remplissage and a contrat d’interface remettant — with separate sets for data from 2023 and 2024 and for data from 1 January 2025 onward. Documentation for periods up to and including 2022 is no longer published and must be requested from the collection mailbox.
A derogation regime runs alongside, on the same activity-threshold basis as the mapping collection: where the Banque de France grants it, fraud data is collected at lower granularity and once a year rather than half-yearly, against a separate lightened guide and interface contract. Requests are made by email.
3. The two counting rules that matter most
The Banque de France’s published guidance settles two questions that would otherwise be answered differently by every institution.
Each half of that rule breaks a common internal habit.
Attempts are out. Fraud-prevention teams live on attempt data: blocked transactions, declined authorisations, rules that fired. Those are the numbers that justify the control environment internally, and they are exactly what this return does not want. A pipeline built off the fraud-detection system’s event log rather than off confirmed-fraud case outcomes will inflate the return, sometimes by an order of magnitude.
Gross, not net. Management reporting almost universally shows net loss — after recoveries, after chargeback outcomes, after insurance. The census wants the nominal amount of the fraudulent payment. Two institutions with identical fraud experience and different recovery rates should report the same figures here, which is the whole point of a statistical census. Reporting net makes an institution look better than its peers for a reason that has nothing to do with fraud.
For cheques, the guidance adds a distinction worth carrying: stolen blank cheque forms subsequently reused by a fraudster must be separated from forms in the chequebook that were used by the account holder before the theft and might have been declared stolen in error — the latter being identifiable through a subsequent regularisation in the national irregular-cheque file.
4. Filing it: the OSCAMPS channel
The fraud census is filed through ONEGATE–OSCAMPS. Enrolment follows the OSCAMPS pattern rather than the general ONEGATE one:
| Field | What OSCAMPS expects |
|---|---|
| Identifier | A nominative, professional email address — a personal address is explicitly not accepted |
| Accreditation code | None for OSCAMPS collections |
| Collection | “OSCAMPS France” |
| Declarant type / code | LEI, and the 20-character LEI itself |
| Certificate | Not required for the OSCAMPS collection portal |
| Domain code | OFR (enquête Fraude2), or OFD for the derogated lightened version |
An existing ONEGATE account does not carry rights to OSCAMPS automatically; adding them follows the Bank’s published “extension of rights on the OSCAMPS collection” procedure. The portal is open for data entry from 04:00 to midnight every day except Sunday, with technical support Monday to Friday, 08:00 to 19:00.
Where an institution offers only a narrow band of services, the Bank publishes XML files pre-initialised to zero inside each interface contract, so that mandatory questions can be pre-populated. The behaviour to design around is that importing an XML file cancels entries previously made for the corresponding surveys — import is replacement, not merge. Import the zeroed file first, then key the real figures over it.
5. What this return is not
A French PSP owes several fraud-adjacent obligations that are easy to conflate, and they run on different channels, cadences and legal bases.
| Obligation | Basis | Channel and cadence |
|---|---|---|
| Fraud census (Recensement de la fraude) | ECB payment statistics as amended by Regulation (EU) 2020/2011 | ONEGATE–OSCAMPS, domain OFR — half-yearly |
| Refusal of immediate refund of an unauthorised transaction, where the PSP suspects user fraud | Article L. 133-18 CMF | ONEGATE–OSCAMPS — monthly since 1 January 2020; Excel submissions no longer accepted |
| Blocking a third-party provider’s access to an online payment account for unauthorised or fraudulent access | Article L. 133-17-1 CMF | By email, by the PSP that generated the event — not through the portal |
| Payment-security observatory collection | National oversight of cashless payment means | ONEGATE–OSCAMPS, domain OBO |
The monthly L. 133-18 notification is the one most often missed by newly established firms, because it is not thought of as “reporting” at all — it is a consequence of a dispute-handling decision. Every time the firm declines to refund an unauthorised transaction immediately on the ground that it suspects the user, that decision becomes a monthly declarable event through the same portal.
6. Three scenarios
Scenario 1 — the return built on the rules engine. A firm extracts its fraud figures from the transaction-monitoring platform, using the “fraud” disposition flag. Facts to rule: only proven fraud is declared; attempted fraud is excluded. What the analyst does: source the return from confirmed-fraud case outcomes — cases closed as fraud after investigation — not from rule hits or blocked authorisations, and reconcile the two populations once so the difference is understood rather than discovered. Outcome: a return that matches the definition. The failure mode is a fraud rate several times the market’s, generated entirely by counting blocks.
Scenario 2 — the netted amount. A card issuer reports fraud at the value it ultimately bore after chargeback recovery, because that is the figure in its own loss reporting. Facts to rule: the amount to declare is the nominal amount of the payment, not the loss remaining after the dispute is resolved. What the team does: carry both figures in the case record — nominal transaction amount for the census, net loss for management — and label the census field explicitly so the two never get crossed. Outcome: comparable statistics. The failure mode is an institution whose declared fraud falls every time its recovery process improves.
Scenario 3 — the refusal that nobody reported. A firm declines to refund a disputed card transaction immediately, on the ground that it suspects the customer of fraud. The dispute team documents the decision and moves on. Facts to rule: since 1 January 2020, refusals under Article L. 133-18 are declarable monthly through ONEGATE–OSCAMPS. What the operations lead does: make the notification a step in the dispute workflow rather than a monthly reporting task, so the population is complete by construction, and confirm the OSCAMPS rights cover the relevant domain. Outcome: the monthly file matches the case system. The failure mode is a monthly return that reports zero while the dispute log shows refusals.
7. Running the campaign
The fraud and mapping campaigns are launched together, and communicated the same way. The main banking groups are told the dates at an interbank meeting; roughly ten days before a campaign opens, a letter goes to the responsible director of each declaring institution at the contact details declared to the ACPR, the Banque de France’s reference being the ACPR’s REGAFI file as at 31 December of the previous year. Operational staff who registered in ONEGATE–OSCAMPS in the previous year also receive an email with the dates.
At the opening of a declaration, the operational staff in charge should record their own contact details in each questionnaire — a maximum of two per questionnaire. That is the mechanism by which the Bank reaches the people who actually build the return rather than only the responsible director, and it has to be redone as staff change.
Do we declare attempted fraud?
No. The Banque de France’s guidance is explicit that in all cases the fraud to be declared is proven fraud, not attempted fraud. Attempt volumes belong in internal control reporting, not in this census.
Should the amount be net of recoveries?
No. The amount to declare equals the nominal amount of the payment and is not reduced to the loss suffered after the dispute has been worked through. Carry the nominal amount separately in the case record so the census and management reporting do not share a field.
How often is the fraud return due?
Half-yearly for data from 1 January 2023. Institutions granted a derogation on activity-threshold grounds report annually, at lower granularity, against separate documentation.
Is the L. 133-18 monthly notification part of this return?
No. It is a separate obligation with its own cadence — monthly since 1 January 2020, through the same ONEGATE–OSCAMPS portal, with Excel submissions no longer accepted. The related L. 133-17-1 notification about blocking a third-party provider’s access goes by email instead.
Do we need a certificate to file the fraud census?
No. The OSCAMPS collection portal is accessed without an authentication certificate, and the reporter account is created and accredited online. The declarant type is LEI, so a current LEI is a prerequisite.
8. What to do, today
- Source the census from confirmed-fraud case outcomes, not from the detection platform’s event log — attempts are out of scope.
- Store the nominal payment amount as a distinct field in every fraud case, separate from net loss.
- Check whether the firm is inside the population on the establishment test: a French branch brings the obligation, freedom of services does not.
- Confirm the reporting entity’s LEI before requesting OSCAMPS rights — it is the declarant code.
- Wire the Article L. 133-18 monthly notification into the dispute workflow, so the population is complete by construction.
- Write the import-then-key order into the procedure — an XML import erases prior entries for that survey.
- Ask about the derogation if activity is low: annual and coarser instead of half-yearly and granular, on request.
Related: OSCAMPS Cartographie des moyens de paiement · ONEGATE — the Banque de France reporting channel · OSMP — French payment fraud statistics · PSD2 fraud reporting under the EBA guidelines
