2025 Payment Threats and Fraud Trends Report (European Payments Council)

Summary

• Social engineering and phishing attempts are still increasing, with a shift in targets toward company executives, employees, payment service providers and payment infrastructures.p.6
• AI tools make it easier for fraudsters to generate realistic phishing emails and deepfakes, removing the language barrier.p.6
• Botnets continue to act as a force multiplier for malicious activity, including DDoS attacks.p.7
• Third-party vendor risks are increasingly critical for PSPs, including a high concentration of services in a few cloud service providers.p.7
• ATM man-in-the-middle relay attacks scaled up, with a sharp increase observed in various European countries in 2024.p.20
• The upcoming Payment Services Regulation proposal is expected to grant customers refund rights in specific situations.p.9

Key insights

1. Social engineering increasingly leads to authorised push payment (APP) fraud as attackers target users rather than technology.p.6
2. Awareness campaigns remain a very important countermeasure against social engineering.p.6
3. Card fraud criminals are reverting to old-school fraud such as lost and stolen cards, sometimes combined with social engineering.p.8
4. CNP fraud remains a significant factor for fraud losses as e-commerce is still on the rise.p.8
5. For SEPA credit transfers and direct debits, impersonation and deception scams are the primary factors behind fraud losses.p.8
6. Malware attacks on mobile devices leverage accessibility features, malicious updates of legitimate apps and bogus apps.p.17
7. There is an observable tendency to increase PSP and telecom provider liability for failing to detect fraud arising from social engineering.p.9
8. DMARC take-up by organisations has proven successful in stopping phishing emails in some countries.p.22