Strong Authentication Is Working. The Fraud Is Moving Elsewhere.

The ECB and EBA released a joint assessment of payment fraud drawing on supervisory reporting across the European Economic Area. The findings are notable less for novelty than for confirmation at scale: after several years of mandatory strong customer authentication, the data now supports what practitioners suspected — SCA materially reduces card fraud where it is applied.

The second finding is the operationally significant one. Card-payment fraud was reported as 17 times higher when the payee was outside the EEA. That is not a marginal difference in risk weighting; it is a structural difference in exposure driven by where authentication requirements and liability frameworks stop applying.

The regulators also observed that strong authentication was less conclusive for some non-card instruments, particularly credit transfers — consistent with the pattern that authentication protects against impersonation of the customer, not manipulation of the customer.

Fraud does not respond to a control by disappearing. It responds by relocating. When authentication raises the cost of one attack path, criminal activity migrates toward transactions, channels, geographies and payment instruments where authentication coverage is thinner and liability protection is weaker.

For merchants, this reframes 3DS strategy. The relevant question is not whether authentication is enabled but where the exempted, out-of-scope and cross-border portions of the portfolio sit — because that is where the residual risk concentrates. An enterprise with 92 percent SCA coverage may hold the overwhelming majority of its fraud exposure inside the remaining 8 percent.

For issuers and acquirers, the cross-border figure has direct portfolio-management implications. It also carries an important caveat: a merchant or portfolio with heavy non-EEA acquiring will show a higher fraud rate for reasons of mix, not necessarily of control quality. Comparing fraud rates across portfolios without normalizing for geography, channel and merchant category produces conclusions that are confidently wrong.

The most common strategic error following data like this is to treat the cross-border figure as a targeting instruction. It is not. Declining non-EEA transactions as a class would suppress fraud and revenue in roughly equal measure, and would do so in the segments many businesses are actively trying to grow.

The productive response is segmentation. Fraud rate by corridor, by merchant category, by channel, by authentication status and by exemption type — measured together — reveals whether elevated cross-border fraud reflects genuine control weakness or simply portfolio composition. Most organizations cannot currently produce that view without a manual exercise, which is itself the finding.

Exemption strategy deserves specific scrutiny. Transaction-risk-analysis and low-value exemptions are commercially valuable and operationally sensible, but they create a measurable, deliberate gap in authentication coverage. That gap should be monitored as a named risk with its own fraud rate, not absorbed into a portfolio average where it is invisible.

There is also an authorization-performance dimension that fraud teams frequently miss. Authentication data improves issuer confidence and can lift approval rates on legitimate cross-border traffic. Treating SCA purely as a fraud control undervalues it; treating it as a data-quality investment in the authorization message frames it correctly.

Finally, the credit-transfer finding is the quiet warning. Where authentication is less conclusive, the attack is usually not credential theft — it is the customer being persuaded. Card-centric fraud strategies do not transfer cleanly to those rails.