Instant credit transfers continue to demonstrate enormous dynamism in Spain. However, this great financial and technological innovation can also facilitate the circulation of some forms of fraud and transactions linked to money laundering or financing of terrorism. Legislative changes in progress and the joint banking sector action, supported by Iberpay’s service Payguard, pioneer in Europe, emerge as essential instruments to prevent, detect, anticipate and fight against fraud in instant payments.

The revolution of instant payments

The birth of the euro as a common currency in 2002 was a great milestone in Europe and marked the beginning of a new economic era on the continent. The introduction of euro noted and coins as official currency in Europe was intended to harmonize cash payments. But to create a truly single monetary market, the harmonization of electronic payments was also required through the development of common payment instruments, procedures and standards, replacing the domestic procedures and practices in force until then.

This is how the Single Euro Payments Area (SEPA) was born, which includes a total of 36 countries in Europe and more than 4000 banks, and which pursued the harmonization of electronic payments from account to account in euros to, in turn promote the digitalization and competitiveness of the European economy. SEPA is a self-regulatory project led by the European banking community though the European Payments Council (EPC), an initiative that is supported by the European Commission, the governments and central banks of the countries in this area.

Following the standardization of credit transfers and direct debits in SEPA, in 2008 and 2009 respectively, in November 2017 the standard of the SEPA scheme for instant credit transfers, also known as SCT Inst, came into force.

Instant credit transfers have transformed the way in which citizens and companies make their payments throughout the SEPA area: they can be made at any time of the day, 7 days a week and the money is paid instantly, allowing the beneficiary to have the funds in their account immediately to make other transactions.

Their use in digital payments and the speed of these type of transactions may also facilitate some criminal and fraudulent mechanisms, being more difficult to combat and representing a risk for the full development of instant account-to-account payments, in addition to a significant economic and reputational cost for the banking sector.

According to data from the United Kingdom, the only country that publishes information in this regard, during 2022 losses due to fraud in instant payments reached the concerning figure of 249 million pounds.

The importance of sectorial collaboration

Until the arrival of instant payments, fraud specialists' focal point was set on card payment, as they were the most used payment method in physical and online stores. In the case of card fraud, and unlike account-to-account payments, the bank or card-issuing bank is completely autonomous and independent to investigate and monitor its client’s payment transactions. For each operation carried out by a client, the issuing bank previously approves the transaction based on the information on the cardholder's balances, credit or risks, so, in the event of fraud, the bank has the most relevant card data, allowing to analyse and investigate the entire transaction circuit.

This is not the case of account-to-account payment transactions, where the bank issuing the credit transfer only has the data of its customer and the movement of funds occurs to an unknown beneficiary account, bank or client, making it complex for the issuing bank to analyse and investigate fraud autonomously. Furthermore, in the event of fraud, fund movements can be made to several different accounts and then transferred into new accounts in the banking system, so monitoring the information and the movements for the issuing bank is practically impossible.

For all these reasons, to prevent fraud, protect clients and ensure their operations in account-to-account payments, banking sector collaboration is key. Banks need to share information and data so as to combat fraud, and this exchange cannot be partial or bilateral, it must be addressed by all banks in a collaborative, secure and neutral way.

Personal data when combating fraud

Until recently, the exchange of information between banks to prevent and fight fraud was addressed from a very restrictive interpretation of the data protection Regulations (Organic Law 3/2018, on the protection of personal data and guarantee of digital rights and the General Data Protection Regulation, or GDPR).

Banks and financial institutions, like other companies and individuals, are subject to rigorous compliance with the GDPR and, given that the data related to bank account owners and numbers are considered sensitive information, it is legally challenging to share personal data between banks, even with the aim of preventing and fighting fraud.

In 2020, Iberpay, in close coordination and cooperation with the Spanish Data Protection Agency, was a pioneer in Europe in launching a sectoral service for the exchanging of information, based in the legitimate interest in the prevention of fraud, which allows entitied to share information on fraudulent transactions, classfied as confirmed transactions, suspicious transactions or considered as fraud attempts.

The possibility of exchanging information between payment service providers for the prevention of fraud has been recognized at a legislative level in the draft of the Regulation of the European Parliament and of the Council on payment services in the internal market, known as PSR, which introduces data sharing between entities as a fundamental instrument to combat fraud, recognizing that banks, individually, do not have the necessary data to fight effectively against fraud. This Regulation also establishes, at a legal level, the fundamental role of banks and payment systems as a key element to ensure the proper functioning of the internal market for payment services, authorizing them to process the special categories of personal data necessary.

Iberpay, as a payment system and neuralgic node of the European account-to-account payment network, with all Spanish entities connected and processing their payments through its central and neutral technological platform, has fight against fraud as a top strategic priority.

Iberpay is credited with having launched, together with Spanish banks, a comprehensive sectorial service to prevent, detect, anticipate and fight against fraud in account-to-account payments: Payguard, with over 70 banks currently connected and in operation since 2020.

Payguard is a service for fighting fraud with a sectorial approach and integrated into the value chain of instant payments, which has the following 6 tools:

1. Share: tool for the exchange of fraudulent transactions. Share is a centralized database that facilitates information exchange on fraudulent transactions, suspicious operations and fraud attempts in real time and standard, for all participants in the service.
2. Rescue: tool for recovering funds. Banks request to recover funds from fraud or scam through the Rescue tool. Following the detection of a non authorizedcredit transfer,  the client's ordering bank can request the recovery of the funds from the beneficiary bank. This procedure is applicable to all ordinary credit transfers and instant credit transfers processed and settled though Iberpay, including Bizum.
3. Prevalidate: a tool that allows banks and their clients to verify the ownership of an account before making a payment. Payguard allows banks connected to the service and their clients to confirm that a CIF/NIF is the owner, or not, or a payment account in another bank connected to the service. Since this service has the participation of all entities in the Spanish banking system, it allows the confirmation of over 80 million existing payment accounts (99% of Spanish bank account).
4. Intelligence: predictive fraud model. This tool permanently evaluates the system’s transactions and identifies possible new mule accounts or irregular transactions (fraudulent, money laundering or terrorism financing) though a predictive model, applying artificial intelligence and machine learning. Connected banks are periodically informed on the accounts with anomalous operation for their investigation. Each entity must in turn confirm whether the accounts are truly suspicious and facilitate feedback to the analytical engine.
5. Score: real-time risk assessment tool. This tool identifies, before issuing a payment, different patterns and behaviours that correspond to a greater presence of fraud. Banks can consult these indicators in real time through two APIs, decoupled from the payment flow, which allow the risk of the transactions to be evaluated, so that the bank can make the decision whether to issue the payment, or not .
6. Networks: Based on technological and neural network models, this tool aims to analyse in real time the movements of funds between different accounts, to identify mule account and fraudulent transaction networks, money laundering or terrorist financing networks, and inform and feed the analytical engine.

For the development and evolution of Payguard, experts in the fight against fraud and artificial intelligence from the main particiapting banks work together with Iberpay to keep Payguard tools aligned with the banks's needs fighting fraud.

*****