2022 Payment Threats and Fraud Trends Report (European Payments Council)

Summary

• The report covers threats and fraud enablers including social engineering and phishing, malware, Advanced Persistent Threats, (D)DoS, botnets and monetisation channels.p.5
• The number of (D)DoS attacks has increased and they still frequently target the financial sector, with ransom DDoS a new threat.p.6
• Advanced Persistent Threat is seen as one of the most sophisticated and lucrative types of payment fraud.p.6
• For SEPA Credit Transfer and Direct Debit, an increase in APP fraud was noted during the past year.p.7
• SCT Inst features that can be exploited include immediate execution and continuous processing on a 24/7 basis.p.7
• As e-commerce is still on the rise, card-not-present fraud remains a significant factor for fraud losses.p.7

Key insights

1. Some criminals are reverting to old school card fraud such as lost and stolen cards, sometimes combined with social engineering.p.7
2. It is too early to observe real-life fraud cases targeting the supporting SEPA schemes SPL and SRTP.p.7
3. Defence against APTs should start with a defence-in-depth strategy and include advanced security data analytics and early detection.p.6
4. Attacks at the payment execution stage focus on processing systems, most relevantly via DDoS and APTs.p.7
5. Against DDoS attacks, PSPs can filter fraudulent traffic and test their measures with simulated attacks.p.6