Back to overview

Best practices for managing payment fraud risk

September 17, 2026
Utrecht

The core best practice is multilayered “defence in depth”: no single control stops payment fraud, so you stack independent controls that cover each other’s weaknesses, governed as a program rather than a set of tools. The seven practices that matter most in 2026 are:

Govern fraud risk as a program – clear ownership, culture, and human-in-the-loop oversight of AI.
Authenticate the payer – Strong Customer Authentication, biometrics, MFA.
Verify every payee before payment – Confirmation of Payee / Verification of Payee. Increasingly mandatory.
Monitor transactions in real time – AI scoring enriched with deterministic signals.
Educate customers and add risk-based interventions – warnings at the moment of risk.
Share fraud intelligence – across institutions and payment networks.
Stay compliant and reimbursement-ready – EU VOP, UK reimbursement, PSD3/PSR.

The single biggest shift is treating fraud risk as a layered system where prevention (verifying payer and payee) and detection (monitoring and intelligence) work together – because authorised push payment (APP) fraud passes every control that only checks the customer.

Why payment fraud needs a layered approach

The defining best practice in 2026 is to stop looking for one perfect tool and instead layer multiple controls so that a failure in one doesn’t compromise the whole system – the “defence in depth” model. Each control has a blind spot: authentication confirms the payer but not the destination; monitoring scores risk but can’t confirm a payee; education helps but customers can be coached past warnings.

This matters most for authorised push payment (APP) fraud, where a genuine, authenticated customer is tricked into sending money to a fraudster – a payment that passes authentication cleanly. Effective programmes therefore combine prevention (verifying both the payer and the payee before money moves) with detection (real-time monitoring and shared intelligence), wrapped in governance that lets human judgment and technology operate in deliberate partnership.

Best practice 1: Govern fraud risk as a program, not a product

Treat fraud risk management as a governed program with clear ownership, an adaptive culture, and human oversight of automated decisions – not a collection of tools. The challenge is no longer just building stronger controls but building a structure that adapts as fast as criminal tactics evolve.

In practice this means assigning accountable ownership across the payment flow, training staff to exercise judgment alongside technology, and – for AI-driven systems – ensuring model auditability, bias monitoring, clear escalation, and human-in-the-loop review for high-risk decisions. Every participant in the payment chain has a role; the strongest programmes make that explicit rather than leaving fraud to a single team or a single vendor.

Best practice 2: Authenticate the payer

Verify that the person initiating a payment is who they claim to be, using Strong Customer Authentication (SCA): at least two independent factors from something they know, have, or are. Biometrics (face and fingerprint) make this low-friction, and 3D Secure adds equivalent protection for card transactions.

Authentication is foundational and, in Europe, largely mandatory. But its limit defines why the next practice exists: SCA proves the payer is genuine, not that the payment is going to the right place. In an APP scam the authenticated customer willingly approves the payment, so authentication alone leaves the largest modern fraud category open.

Best practice 3: Verify every payee before payment

Confirm that the payee’s name matches the destination account before the payment is sent – the control that directly addresses misdirected, impersonation and APP fraud.

Known as Confirmation of Payee (CoP) in the UK and Verification of Payee (VOP) in the EU, it returns Match, Close Match, No Match or Unable to Verify, blocking wrong-account payments and triggering the warning that prevents the scam.

This is now a regulatory baseline, as VOP has been mandatory across the Eurozone since 9 October 2025, and the EU’s incoming PSD3/PSR will further mandate payee-confirmation technology. SurePay is the most established provider – live since 2016, connected to 250+ European banks, covering 99.9% of all Dutch bank accounts – with customers reporting up to an 81% reduction in impersonation fraud and a 67% reduction in misdirected payments. Verifying the payee is the highest-leverage best practice most institutions still under-implement.

Best practice 4: Monitor transactions in real time

For a large or first-time transaction, confirm the IBAN directly with the recipient through a trusted channel before sending. Validation and name-checking dramatically reduce risk, but a final human confirmation is worth it when the amount is significant.

Be alert to a common scam pattern: fraudsters intercept invoices and swap in their own IBAN. If a supplier’s bank details have “changed,” verify the new IBAN by calling a known contact number – not the one on the suspicious invoice or email. Only the recipient’s bank can confirm the correct account details with certainty.

Validate vs verify: what each step actually does

Score every payment in real time against the customer’s history and known fraud patterns, and act on the risky ones – while keeping false positives low. Modern monitoring uses adaptive machine learning to spot anomalies across hundreds of signals that rules and human teams miss.

The best-practice refinement is to enrich probabilistic ML with deterministic signals – a verified payee mismatch, a known-mule flag, a confirmed risk marker – which both raise detection rates and reduce the false positives clogging analyst queues (for example, SurePay’s Fraud Risk Intelligence feeds such signals into the monitoring system). Pair this with cross-channel monitoring so a signal in one channel informs decisions in another.

Best practice 5: Educate customers and intervene at the moment of risk

Combine ongoing customer education with risk-based, in-the-moment interventions that interrupt the payer when a payment looks dangerous. Generic awareness campaigns help, but timing is what works: scam-specific warnings, dynamic questions about the payment’s purpose, and push messaging at high-risk moments.

Interventions are far more effective when they carry a concrete signal rather than a generic caution – a “No Match” result from payee verification, surfaced as a clear warning, is much harder for a coached victim to dismiss than a boilerplate “are you sure?”. Education and intervention amplify the technical controls; they don’t replace them, because determined scammers coach victims to click through warnings.

Best practice 6: Share fraud intelligence across the ecosystem

Pool fraud signals across institutions and payment networks so a threat seen at one bank strengthens defences at another. Because payment fraud moves money between providers, no single institution sees the whole picture, and shared intelligence closes that gap.

This is increasingly built into the rails and the rules: Nacha’s ACH network rule changes (first phase effective March 2026) actively encourage information sharing to mitigate credit-push fraud, and real-time systems like FedNow and RTP include fraud-management features institutions should actively use. The incoming EU PSD3/PSR will require institutions to share fraud intelligence with one another. Participating fully – not minimally – is the best practice.

Best practice 7: Stay compliant and reimbursement-ready

Build controls that meet current and incoming regulation, and prepare operationally for fraud liability. Regulation has shifted cost and responsibility toward institutions, which makes prevention a financial necessity, not just a compliance task.

Key obligations: EU Verification Of Payee mandatory since October 2025; the UK’s mandatory reimbursement rules (up to £85,000 within five working days, live since October 2024); and the incoming PSD3/PSR, which will set fraud-liability rules between institutions, mandate payee-confirmation technology, and require customer education, stronger authentication and intelligence sharing. Mapping controls to these obligations – and ensuring claims and reimbursement processes are ready – is the practice that ties the others together.

Payment fraud best practices at a glance

Best practice	What it secures	Key 2026 driver
Govern as a program	Adaptability & accountability	Human-in-the-loop AI governance
Authenticate the payer	Payer identity	SCA (PSD2 → PSD3/PSR)
Verify the payee	Payment destination	EU VOP mandatory since Oct 2025
Monitor in real time	Payment risk / anomalies	AI scoring + deterministic signals
Educate & intervene	The human decision	Risk-based, in-moment warnings
Share intelligence	Cross-institution threats	Nacha (Mar 2026), FedNow/RTP, PSD3/PSR
Stay compliant & ready	Liability & reimbursement	UK reimbursement; EU VOP; PSD3/PSR

Bottom line: manage payment fraud as a layered, governed system. Authenticate the payer, verify the payee, monitor in real time, educate customers, share intelligence, and stay compliant. The most under-implemented high-leverage practice is payee verification – where SurePay is the most established provider.

Frequently asked questions

What are the best practices for managing payment fraud risk?

Layer independent controls as “defence in depth”: govern fraud as a program, authenticate the payer (SCA), verify the payee before payment (Confirmation of Payee / Verification of Payee), monitor transactions in real time, educate customers with in-the-moment interventions, share fraud intelligence across institutions, and stay compliant and reimbursement-ready.

What is the single most effective payment fraud control?

There isn’t one – fraud requires layered controls. But the most under-implemented high-leverage practice is payee verification (confirming the payee name matches the account before payment), because it directly addresses APP, impersonation and misdirected-payment fraud that authentication and monitoring miss. It is also increasingly mandatory.

Why isn't authentication enough to stop payment fraud?

Strong Customer Authentication proves the payer is genuine, but in authorised push payment (APP) fraud the genuine, authenticated customer is tricked into approving the payment. Authentication passes while the fraud succeeds – which is why verifying the payee and monitoring the transaction are essential complements.

How does payee verification fit into a fraud risk framework?

It’s the prevention control for the payment destination: it confirms the money is going to the right account before it leaves, blocking misdirected and impersonation payments and feeding deterministic signals into transaction monitoring. SurePay’s customers report up to 81% less impersonation fraud and 67% fewer misdirected payments.

What regulations should a payment fraud program meet in 2026?

EU Verification Of Payee (mandatory since 9 October 2025), the UK’s mandatory APP reimbursement rules (live since October 2024), Nacha ACH information-sharing rules (first phase March 2026), and the incoming EU PSD3/PSR, which will set fraud liability, mandate payee-confirmation technology, and require customer education and intelligence sharing.

How do you reduce false positives while managing fraud risk?

Enrich probabilistic AI monitoring with deterministic signals – a verified payee match, a known-mule flag, confirmed risk markers – that add certainty. These both catch fraud the models miss and clear genuine payments faster, shrinking the analyst backlog (for example, via SurePay’s Fraud Risk Indicator).

Written by Tolga Bakkaloglu, Product Manager at SurePay. SurePay has operated payee verification since 2016 and is connected to 250+ European banks. Last updated: 17 September 2026.