The Payments Defense Grid: The Control Worked. The Money Still Left.

Your authentication worked. The biometric matched, the device was trusted, and the customer approved the payment themselves. The money is gone, irreversibly, in under a second. Nothing failed — and that is the problem.

On an irreversible rail, a control that passes is not the same thing as a bank that is protected, and most banks have built only the half of their defence that can see an impostor.

Why this matters now

Instant payment rails changed one thing that matters more than speed. They removed the pause.

On an older rail, a transfer sat somewhere for a few hours. That gap was never a design feature, but every fraud control a bank built quietly depended on it. Somebody could look, ask, hold the payment, or reverse it while an answer came back. Instant settlement is final: once value lands in the receiving account, it is not coming back by request.

Banks responded reasonably. They moved controls earlier and made them faster — stronger authentication at the edge, better scoring inside the payment path, more monitoring in less time. The engineering behind that shift is genuinely impressive and it was not wasted.

The losses kept climbing anyway. Across the European Economic Area in 2024, total payment fraud reached four point two billion euro, and credit-transfer fraud alone reached two point two billion, up sixteen percent on the prior year (EBA–ECB joint payment fraud report, December 2025). That gap between effort and outcome is not a failure of execution. It is a failure of diagnosis.

What a fraud control is actually built to notice

Consider what a modern fraud control watches for. A stranger. Someone using credentials that are not theirs. A device it has never seen. A session that behaves wrong — typing rhythm off, location impossible, a remote-access tool running quietly underneath. Every one of those signals asks a single question: is this person who they claim to be?

That is a good question. It is also, increasingly, the wrong one.

Picture the payment that actually drains a retail portfolio. A customer receives a call. Over an hour, sometimes over several weeks, they are persuaded that moving their money is the safe and urgent thing to do. Then they open their own banking application, on their own phone, in their usual place, at an ordinary hour. They pass the biometric check. They read the confirmation screen. They approve the transfer themselves.

Nothing about that payment is anomalous, because nothing about it is false. The device is genuine. The credentials are genuine. The intent, in the only sense a system can measure, is genuine. The customer is not being impersonated — they are being directed. No rule is broken inside the payment, so no rule watching the payment has anything to catch.

Here is the measurement that should reframe the budget conversation. On credit transfers across the EEA in 2024, payment service users themselves bore approximately eighty-five percent of the total fraud loss, mainly as a result of scams that tricked users into initiating fraudulent transactions. Read that precisely: it is a statement about who absorbed the loss, not a claim that eighty-five percent of fraud is any single type.

The supervisors' own reading is more carefully worded than the summary this argument would prefer, so here it is in their terms. Strong customer authentication "remains effective against the fraud types it was designed to mitigate and that were dominant at the time PSD2 came into force, especially for card payments"; for other payment types, such as credit transfers, "this effect was less clear". They also record new fraud types "manipulating legitimate users into authenticating fraudulent transactions". That is weaker than saying SCA is bypassed on transfers — it says the measured benefit is less clear there — and the weaker version is the one that survives checking.

The authentication did not fail in those cases. It passed, confirming accurately that the right person was instructing the bank — which then executed a valid instruction, promptly and correctly, into an account controlled by a criminal.

The two failures that share no signal

So the useful reframe is this: a payment control is worth what it can see, not how fast it fires.

Money leaves an account wrongly in only two ways. In the first, an impostor acts without the owner's consent — stolen credentials, a hijacked device, a swapped mobile number. The deception targets the bank's systems, so the bank's systems can find it. There is a lie inside the transaction.

In the second, the owner acts, deceived. The deception targets the customer, not the bank. By the time the payment reaches any control, the lie has already succeeded somewhere the bank cannot observe — in a phone call, a message, a relationship. The transaction itself is clean.

These are not degrees of one problem. They are two problems, with different signals, different owners and different economics. And here is the consequence most banks have not priced: no amount of investment in impostor controls produces any coverage of the second kind at all. You can double the budget and buy nothing.

The Payments Defense Grid — two axes, six cells

That gives the framework. Two axes, six cells.

Down one side, what a control can see: an impostor, or a deceived owner. Across the other, what it can still do by the moment it fires: prevent before value moves, interrupt at the moment of intent, absorb after finality. Every payment control a bank operates sits in exactly one cell.

The cell references are labels, not a ranking — they are numbered so a control can be named in a committee paper without a paragraph of description, and they match the downloadable playbook cell for cell.

Two disciplines make the grid useful rather than decorative. First, it is not a maturity ladder. Nobody progresses from D1 to D6; the columns are different problems, not stages, and reading them as a sequence rebuilds the very error the grid corrects. Second, owning a product is not operating a cell. Mark only the cells where something fires and somebody is accountable for the outcome — most control inventories shrink considerably under that test.

The impostor column: the half you already have

D1, prevent, is payer and device trust: biometrics, presentation-attack detection, device binding, malware and remote-access detection. It is the regulatory floor, and in Vietnam parts of it are now explicit. Thông tư 77/2025/TT-NHNN, issued 31 December 2025 and published in Công báo No. 25 of 20 January 2026, amends Circular 50/2024 and requires both presentation-attack detection and automated device-security checks — and it is worth reading which article carries which duty, because the commencement is staged and the staging does not fall where a skim would put it.

The substantive security duties take effect on the general date, 1 March 2026. Article 7 of the amending circular rewrites Article 11 of Circular 50/2024 to require a presentation-attack detection solution — PAD is named in the text in English — certified by a biometric laboratory accredited by the FIDO Alliance or by a licensed certification body, to ISO 30107 Level 2 or equivalent. Article 5 rewrites Article 8 to require the Mobile Banking application to exit or halt automatically, and tell the customer why, on detecting a debugger, an emulator or virtual device, Android Debug Bridge, runtime hooking or repacking, or a rooted, jailbroken or bootloader-unlocked device.

What is deferred is narrower. Article 12 defers only Articles 3 and 10 of the amending circular itself — the confirmation methods required when customer identity information changes, and the revised Appendix — to 1 July 2026 for providers serving both individual and organisational customers, and to 1 October 2026 for providers serving organisational customers only. So a universal bank has a July clock on identity-change confirmation and the Appendix, and a March clock on PAD and the device checks. Reading the staged date as cover for the biometric work would defer the wrong programme by four months. Confirm against the gazette text before committing any date.

D3, interrupt, is the in-flight decision: scoring the transaction inside the authorisation path, within the scheme's latency budget, with a defined behaviour when the model is unavailable. D5, absorb, is post-finality recovery — cancellation requests, account freezing, funds tracing. Be honest about that last one: on an instant rail it is largely a formality, because funds cascade onward within minutes and the receiving account is usually empty by the time a recall message arrives.

Most banks deploy this entire column to a high standard and then count it as coverage. It is capped by what it can see. D1's residual risk against authorised fraud is close to total, because a scammer does not defeat presentation-attack detection — they ask the customer to pass it.

The deceived-owner column: the half that is mostly unbuilt

D2, prevent, is payee intelligence: not who is sending, but where the money is going. Verifying the payee name against the account record. Scoring the destination — how old is that account, how does it behave, has this customer ever paid it before. It is the highest-leverage cell in the grid, and no single bank can build it properly, because it needs infrastructure at scheme or national level.

D4, interrupt, is customer-in-the-loop friction: controls aimed at the payer rather than the payment. Specific warnings rather than generic ones. Questions that interrupt a rehearsed story. Holds and cooling-off periods on newly added payees and new device bindings. This is the only cell in the grid that can reach a person while they are being manipulated — and the only cell with a direct revenue cost, which is exactly why it stays unbuilt unless somebody senior owns the decision.

D6, absorb, is network signal and shared liability: cross-institution intelligence on mule accounts, and an allocation of loss that gives a receiving bank an actual reason to act. This is the cell that changes the economics of the other five.

What happened when one regulator changed who pays

The obvious objection is that the second column is soft — that friction and payee checks are what you recommend when you have run out of engineering. So look at what happened when a regulator stopped treating this as a detection question.

In the United Kingdom, mandatory reimbursement for authorised push payment fraud took effect on 7 October 2024, with the cost split fifty-fifty between the sending and the receiving firm (Payment Systems Regulator).

Watch what moved. For APP scams before 7 October 2024, in cases closed during 2024, the fourteen largest banking groups reimbursed sixty percent of the money lost by value, and seventy-three percent of reported cases were fully or partially reimbursed. The regulator records a sixty-one percentage point gap between the highest and lowest firms — your protection depended largely on where you happened to bank (PSR APP scam performance data, February 2026). Eighteen months in, the regulator's own dashboard has eighty-eight percent of money lost to in-scope APP scams returned to victims, equalling three hundred and sixteen million pounds between 7 October 2024 and 31 March 2026, with eighty-two percent of claims closed within five business days and ninety-eight percent within thirty-five; consumers reported around four hundred and thirty-eight thousand claims, of which three hundred and one thousand five hundred were in scope (PSR APP scams reimbursement dashboard for Q1 2026, updated 30 July 2026).

Now the caution, and this piece is about measurement discipline so it has to be stated against its own headline rather than in a footnote. Sixty and eighty-eight are not a clean like-for-like pair. Three things differ. The sixty percent is every APP scam loss at the fourteen largest groups; the eighty-eight percent is losses in scope of the reimbursement requirement, and "in scope" is a category the mandate itself created, so no pre-mandate figure can be an in-scope rate. The seventy-three percent counts cases fully or partially reimbursed, which a single percentage flattens. And the periods do not overlap at all: the eighty-eight percent is cumulative across the requirement's own lifetime — three hundred and sixteen million pounds over the first eighteen months, against one hundred and seventy-three million at the twelve-month mark, the same eighty-eight percent at both — while the sixty and seventy-three percent stop on 7 October 2024, the day the requirement began. The PSR states plainly that its pre-mandate report "reflects performance before the reimbursement requirement" and that firm performance has since shifted, and it declines the same comparison this section is making: setting the eighty-eight percent beside an earlier reimbursement rate, the regulator notes that it "can't make direct comparisons, due to difference in scope".

So the honest reading is narrower than the arresting one: reimbursement rose substantially on a perimeter the mandate redefined, and a true like-for-like would need the regulator's own reconciliation of the two populations. Eighty-two percent is a claims-handling speed and pairs with nothing here. What is not in doubt is the direction, or the mechanism: nothing about the underlying models changed in that window. The detection technology was the same technology. What changed was who carried the cost — and behaviour followed the liability, quickly.

Why the receiving side holds the leverage — and whether that travels

The same regulator's data carries a structural lesson, and this is the finding most likely to redirect a roadmap.

The institutions receiving scam payments are not spread evenly across the market. Non-directed payment service providers — the firms outside the fourteen largest banking groups — received thirty-four percent of total fraud value while handling only nineteen percent of consumer Faster Payments by value, in the period before mandatory reimbursement. By volume the gap is starker: forty-eight percent of fraudulent transactions on ten percent of consumer Faster Payments. And the regulator separately reports their fraud rate by value as forty-one times higher than the largest fourteen banking groups.

Take that third figure as the regulator's own reported rate, not as an inference from the first two. Divide the two shares above and you get a ratio nearer twofold, so a reader doing the arithmetic will not arrive at forty-one — the multiple is computed on a different basis, and the three numbers are three separate published measures of the same asymmetry rather than one derivable from another. That distinction is precisely the discipline this article demands of its own PDF, so it applies here too.

Criminals were not defeating the biggest banks' models. They were shopping for the weakest place to land the money.

The scam mix compounds it. Purchase scams are seventy-three percent of UK cases but only twenty-seven percent of value, while investment scams are four percent of cases and twenty-five percent of value, in the period before mandatory reimbursement. A control estate tuned on alert volume optimises for the cheap scams and misses the expensive ones — which is a genuine trap for any bank measuring fraud performance by case count.

One honest caution, because the difference matters for anyone reading this in Asia. That concentration comes from a market with a long tail of smaller payment firms and e-money institutions. A rail dominated by licensed commercial banks under a common identity mandate may not distribute mule accounts the same way; the problem may concentrate inside institutions rather than between them. That would change the control — from shared intelligence to internal account-cluster monitoring — without changing the conclusion that the leverage sits at the destination. It is a genuinely open question, and it is worth answering with your own data rather than borrowing another market's structure.

The coverage audit: a page you can fill in this week

When the payer is genuine, leaders should stop buying detection and start buying interruption. The first three steps below establish the comparison; all five close it.

1. Split the loss. Separate authorised from unauthorised loss on your instant rail. Refuse any blended number — a blended figure hides the entire problem and flatters the control estate.
2. Mark the cells you actually operate. Not the cells you have bought a product for: the cells where a control fires and someone owns the outcome.
3. Compare the two. If the loss is concentrated in the deceived-owner column and your operated cells sit in the impostor column, the investment case writes itself — and it is not a model.
4. Fund the mandate and the loss as separate decisions. The mandated cell and the expensive cell are not the same cell. Both need funding, for different reasons.
5. Instrument the inbound ledger now. Under a fifty-fifty split, hosting mule accounts becomes a direct cost centre. The bank that measured inbound velocity early does not pay to learn that.

Risks and caveats

Two honest limits. The evidence that friction works is largely mandate-based rather than outcome-measured: no source reviewed here measured abandonment or conversion cost against loss prevented, so a finance director can fairly argue that D4 is an unpriced control. Raising that to high confidence needs an independent measurement of both sides of the trade.

And a control that blocks a customer's payment can itself bring the decision within scope of Vietnam's AI Law 134/2025 and the personal-data regime — an exposure the fraud literature routinely treats as costless. Stated conditionally on purpose: whether it does depends on whether the control is an AI system in scope and at what tier, and on whether the block is automated decision-making with significant effect on the customer. A deterministic rules-based block may fall outside the AI instrument altogether, and a data-protection regime more typically attaches duties — notice, objection, human review — than making the act regulated in itself. The point is that the cost is not zero, not that a specific control is caught.

Every figure above is quoted with the market, period and definition it was measured on, in the text or in the table below, which states each one explicitly; each describes the market measured and is not a rate for any individual bank.

Key takeaways

• A control that passes is not the same thing as a bank that is protected. On EEA credit transfers in 2024, users bore approximately eighty-five percent of the fraud loss on payments they had authenticated.
• A payment control is worth what it can see, not how fast it fires. Impostor controls buy no coverage of deceived-owner fraud at any budget.
• Six cells, two axes. Most banks operate the impostor column and almost none of the deceived-owner column.
• Liability moves behaviour faster than capability. UK reimbursement by value rose from sixty to eighty-eight percent with unchanged detection technology — on a perimeter the mandate itself redefined, so read it as direction rather than as a like-for-like delta.
• The leverage is at the destination, not the sending side — though whether the UK's concentration pattern travels to a bank-dominated rail is still open.

Figures in this article, and where each one comes from

Each row below names the primary source and the framing that must travel with the figure. Every number here was read from the issuing body's own report or statutory text, verified 2026-09-21, with the UK reimbursement figures re-read from the regulator's own dashboard on 2026-09-26; nothing in this piece rests on a vendor statistic or on a secondary retelling.

One figure was corrected, one was wrongly retracted, and two were dropped. The research behind this piece originally carried a credit-transfer total of €2.5bn and 24% growth, a reimbursed value of £316m, a sub-hundred-millisecond latency benchmark, and a Singapore scam-loss total. Going to the primary sources showed the first was simply wrong: the EBA–ECB report gives €2.200bn and +16%. That one is corrected and kept, because the underlying quantity is real, published and load-bearing here — and stating otherwise would be the more comfortable claim rather than the accurate one. The £316m was not wrong. It is the PSR's cumulative reimbursed value over the requirement's first eighteen months, 7 October 2024 to 31 March 2026, against £173m at the twelve-month mark — both of them eighty-eight percent of in-scope losses. An earlier version of this article called it an error and put the twelve-month figure in its place, which was the less current of two correct numbers; the eighteen-month figure is restored above. The other two are dropped entirely: the latency benchmark rested on a preprint rather than a bank disclosure, and the Singapore total was attributed to a police brief but actually sourced to a vendor index, so in both cases there was no primary figure to correct to. And now the uncomfortable part, because this paragraph has been wrong three times about its own sources and every time in the same direction. An earlier draft said all four figures had been excluded rather than corrected-and-kept. A later revision retracted the £316m as an error when it was a published regulator figure. And elsewhere on this page that same revision asserted three times that the PSR does not describe the eighty-eight percent as covering "the first twelve months" — it does, in the first line of the February 2026 report's introduction, which is where a reader would look first. Each of those withdrew accurate material and claimed credit for the rigour of withdrawing it. In the one paragraph that asks you to trust this piece because it corrects itself, the corrections have been the least reliable thing on the page, and that is recorded here rather than quietly rewritten.

Sources & note. Primary sources only, each read from the issuing body's own text and verified 2026-09-21, with the UK reimbursement figures re-read from the regulator's own dashboard on 2026-09-26; every figure is quoted with the market, period and definition it was measured on, in the text or in the table above, and each describes the market measured rather than any individual institution.

EEA fraud totals and the loss-bearing share: the joint EBA–ECB report on payment fraud, published 15 December 2025, covering semi-annual data for 2022 to 2024. Total EEA payment fraud was €3.4bn in 2022, €3.5bn in 2023 and €4.2bn in 2024; 2024 credit-transfer losses were €2.200bn, a year-on-year increase of 16%. The approximately eighty-five percent figure is the share of credit-transfer fraud loss borne by payment service users in 2024, "mainly as a result of scams that tricked users into initiating fraudulent transactions" — the causal clause is the report's own, not an addition here, and the figure is a statement about who absorbed the loss rather than a fraud-type share or a rate any single bank should expect. On authentication the report's wording is preserved above rather than sharpened: SCA "remains effective against the fraud types it was designed to mitigate and that were dominant at the time PSD2 came into force, especially for card payments", while "for other payment types, such as credit transfers, this effect was less clear". An earlier version of this article rendered that as SCA being "largely bypassed by social engineering on transfers", which is stronger than the source supports and has been withdrawn.

UK mandatory reimbursement: the Payment Systems Regulator's APP scams work its APP scam performance data of February 2026 and its APP scams reimbursement dashboard for Q1 2026, updated 30 July 2026. Read the perimeters carefully, because they differ: the sixty percent by value and seventy-three percent by volume describe reimbursement by the fourteen largest banking groups for scams occurring before 7 October 2024 in cases closed during 2024, with the volume measure counting cases fully or partially reimbursed, and come from the February 2026 report; the eighty-eight percent, £316m and the claim counts come from the dashboard and are cumulative over the requirement's first eighteen months, 7 October 2024 to 31 March 2026, for losses in scope of the reimbursement requirement — a category the mandate created. The rate was also eighty-eight percent at the twelve-month mark, on £173m, which the February 2026 report carries in its introduction; the eighteen-month figure is the current one and the twelve-month figure is kept above only as the earlier comparison point. The pre- and post-mandate measures are therefore not a like-for-like pair, on the perimeter and on the period alike; the February report states that its data "reflects performance before the reimbursement requirement", and the dashboard declines the equivalent comparison in its own words — it "can't make direct comparisons, due to difference in scope" — when setting the eighty-eight percent against an earlier reimbursement rate. The eighty-two percent is a claims-handling speed on its own denominator, with ninety-eight percent of claims closed within thirty-five business days. The 34%/19% and 48%/10% pairs describe non-directed PSPs on consumer Faster Payments in the pre-mandate period; the forty-one-times rate is the regulator's separately reported figure for those firms against the largest fourteen groups and is not the ratio implied by those shares, which is nearer twofold.

Vietnam: Thông tư 77/2025/TT-NHNN, issued 31 December 2025, signed by Deputy Governor Phạm Tiến Dũng and published in Công báo No. 25 of 20 January 2026, amending Circular 50/2024/TT-NHNN. Article 12 was read directly: general commencement 1 March 2026, except that Articles 3 and 10 of the amending circular apply from 1 July 2026 for providers serving both individual and organisational customers, and from 1 October 2026 for providers serving organisational customers only. The presentation-attack detection requirement is Article 7 (amending Article 11 of Circular 50/2024, requiring FIDO Alliance-accredited or certification-body attestation to ISO 30107 Level 2 or equivalent) and the device-integrity checks are Article 5 (amending Article 8), so both fall under the 1 March 2026 general date and not the deferral. An earlier version of this article placed the staged date beside the biometric requirement, which would have deferred the wrong programme by four months. Circular 50/2024 itself is the consolidating instrument and should be read alongside the amendment. Law 134/2025 on Artificial Intelligence and Vietnam's personal-data regime are cited for the exposure a payment-blocking decision may create, stated conditionally rather than as a ruling that any specific control is in scope; no enforcement precedent on payment interdiction exists under either, and no specific personal-data instrument number is asserted here.

No customer, employee or institution-level data of any kind appears in this article, the worked payment walkthrough is illustrative — no bank, no figure, no loss — and the framework is the author's proposed decomposition rather than a ratified standard. This is independent thought leadership, not affiliated with any current or past employer, and not a substitute for your own legal, compliance, fraud-risk and data-protection review.