PSD3, PSR and IPR: What the New EU Payment Rules Mean for Social Engineering Defense

PSD3 and the Payment Services Regulation (PSR) make payment service providers pay for more fraud, including scams where a criminal poses as bank staff. Verification of payee and transaction monitoring will stop part of it. The rest depends on people: the employee who takes the call and the customer who approves the payment.

What are PSD3, the PSR and the IPR?

PSD3, the PSR and the IPR are three EU instruments that rewrite how payments are executed, protected and refunded. PSD3 is a directive covering licensing and supervision of payment institutions. The PSR is a directly applicable regulation that sets conduct and fraud rules. The IPR, already in force, makes euro instant payments and payee checks mandatory.

The provisional agreement was announced by the European Parliament on 27 November 2025 (European Parliament, November 2025). The Council published the final compromise texts on 23 April 2026, and Parliament's ECON committee approved them on 5 May 2026. Plenary vote, Council adoption and publication in the Official Journal were still pending at the time of writing (Open Banking Tracker, reviewed August 2026).

Why do PSD3 and the PSR put social engineering at the center of compliance?

Because most payment fraud losses now come from scams where the legitimate customer is manipulated into sending money, and the PSR moves part of that cost from customers to PSPs. A fraud type the bank used to absorb only occasionally becomes a direct line in its loss budget.

The 2025 joint EBA and ECB report puts the numbers on it. Payment fraud in the EEA reached €4.2 billion in 2024, up from €3.5 billion in 2023. Credit transfer fraud alone reached €2.2 billion, up 16% in a year, driven mainly by scams that trick users into initiating payments. Users bore about 85% of those credit transfer losses (EBA and ECB joint report, via Banque de France, December 2025).

The same report found that strong customer authentication clearly reduces card fraud, but its effect on credit transfers is less clear. The reason is simple: in a manipulation scam, the right person authenticates the payment. Strong authentication confirms who is acting, not why.

What changes in fraud liability under the PSR?

The PSR turns several fraud scenarios from "the customer authorised it" into "the provider pays". The table below summarizes the cases set out in the provisional agreement.

Sources: European Parliament, November 2025 and EY, updated May 2026.

Why does the bank staff impersonation rule matter most?

It is the first EU rule that makes a PSP pay for a payment the customer approved, purely because the fraudster borrowed the PSP's identity. A spoofed call from "your bank's fraud team" is a social engineering attack on the customer, but the loss now lands on the bank. Every channel through which a customer can be convinced that they are talking to you becomes part of your exposure.

Does verification of payee stop impersonation fraud?

Only partly. Verification of payee checks that the payee name matches the account. It does not check whether the payment makes sense. A customer coached by a fake adviser can still be told to ignore a mismatch warning, or be sent to a mule account opened under a matching name. The control holds when the customer and your staff know how to react to it.

What does the PSR require from people, not just systems?

Beyond technical safeguards, the PSR sets obligations that only people can fulfil: staff who recognize fraud patterns and customers who know how your institution communicates. According to EY's reading of the agreed text, PSPs will have to deliver the following (EY, updated May 2026):

• Staff training: at least annual training for personnel on payment fraud risks and emerging trends. EY recommends basing it on real criminal modus operandi.
• Customer awareness: proactive warnings through appropriate channels when new fraud types emerge, clear guidance on recognizing and reporting fraud, and attention to vulnerable customers.
• Transaction monitoring: more data points than under PSD2, with risk factors such as known fraud scenarios, and outcomes that can be explained to customers and supervisors.
• Fraud data sharing: exchange of specified fraud data with other PSPs when there are objective grounds to suspect fraud.

The agreement also guarantees access to human customer support, not only chatbots (European Parliament, November 2025). Those human agents are exactly who impersonation scammers imitate, and who they target.

Where are financial institutions most exposed to social engineering?

Exposure sits wherever a person can authorize, unblock or redirect money on someone else's word. Under the PSR, that includes your customers being called by fake staff, and your own staff being called by fake customers, executives or suppliers.

Instant payments compress the window. Under the IPR, a euro credit transfer is executed immediately, so a payment approved by a manipulated employee or customer is gone before a manual review can start.

How should financial institutions build a human firewall for PSD3 and the PSR?

Treat human resilience as a fraud control with owners, tests and evidence, the same way you treat transaction monitoring. Training once a year meets the minimum. Evidence that staff verify before acting is what supports the argument that your safeguards were appropriate.

• Map impersonation scenarios to each channel you use: phone, email, SMS, messaging apps and video calls.
• Write one verification rule per scenario, such as a callback on a known number before any change of bank details, and teach it.
• Train staff on real modus operandi at least annually, then reinforce with short lessons through the year.
• Test contact center and branch staff with vishing simulations based on your own processes.
• Test finance, treasury and executive assistants with CEO fraud and deepfake scenarios.
• Align customer warnings with staff scripts, so both sides hear "we will never ask you to move money to a safe account".
• Keep training records and simulation results per entity, ready for supervisors and refund disputes.

How does Arsen help financial institutions prepare?

Arsen trains and tests the people that impersonation scams target, on the channels those scams use. For financial services, Arsen runs phishing simulations, vishing simulations that use real-time voice AI and voice cloning, and deepfake video call simulations in Microsoft Teams, sold as an add-on.

Scenarios can be built for treasury, branch, wealth and payment operations, covering account takeover, CEO fraud and instant payment scams. Employees who fail a simulation receive just-in-time training, micro-learning runs through the year, and reports show training coverage and phishing KPIs across entities (Arsen, financial services).

Learn more about vishing training for financial services teams →

Deepfakes add a video layer to the same scams. Deepfake fraud in financial services: what CISOs need to do now covers the controls, and the financial services CISO white paper on cyber and AI regulations places PSD3 alongside DORA and the AI Act.

When will PSD3 and the PSR apply?

Not before 2028 for most provisions. Based on the compromise texts, most PSR rules and the PSD3 transposition deadline are expected about 21 months after entry into force, and the extended verification of payee about 27 months after. Entry into force comes 20 days after publication in the Official Journal (Open Banking Tracker, reviewed August 2026).

IPR dates: Bird & Bird. Staff behaviour takes longer to change than a monitoring rule, so the human part of the programme is the one to start now.