2026 EU 10-Second Settlement: Merchants Face New Fraud-Liability

The EU's 10-second settlement mandate was sold as a cash-flow windfall, but the clock is now a liability weapon. By 2026, the merchant's fraud-reaction window collapses from days to 10 seconds. The verification-of-payee rule does not simply confirm accounts—it assigns fraud loss to whichever side of the payment handshake fails to answer in time, and at the checkout that side is usually the merchant.

The cost shift has a precedent. Visa fell 1.54% to a four-day low after a $231.7 million legal settlement with merchants over chargeback liability rules. Those disputed rules moved fraud costs from banks to retailers during 2015-2017, and the 2026 instant-verification framework is reviving the same fight in milliseconds instead of days.

Other regulators are choosing the opposite side. India's RBI finalized rules placing the burden of proof on banks and requiring 85% compensation for digital-banking fraud victims; Singapore and Canada are pushing similar consumer-first frameworks. The gap is not tokenization or stablecoin rails—it is the liability rulebook, and until the EU writes one that protects merchants, the 10-second promise will keep landing on their balance sheet.

The 10-Second Finality Trap

The 2026 deadline is the date the merchant's fraud shield dies. The EU instant-payment regulation forces every EU PSP to send and receive euro instant credit transfers with execution capped at 10 seconds, with full euro-account reachability required by that date. The old logic — that the payer's bank absorbs fraud because a clawback can land before settlement finalizes — no longer applies. After the 10-second credit is final, a PSD2 refund moves as a debit from the merchant's settlement account, not from the bank's loss ledger.

The rail that makes this possible is the SEPA Instant Credit Transfer (SCT Inst) scheme, run by the European Payments Council, with the Eurosystem's TIPS platform providing the clearing and settlement backbone, around the clock. Unlike the legacy SEPA SCT cycle, TIPS has no overnight batch, no business-day cutoff, no settlement lag to hide behind. Finality lands in the time it takes a checkout page to render a confirmation dialog.

That math inversion deserves a hard look. Under legacy SEPA SCT, a merchant held float measured in days. That float was a clawback buffer — the PSP could reverse a disputed credit before the merchant could withdraw it — and it doubled as a fraud-detection window, during which pattern anomalies could halt fulfillment. At 10 seconds, both protections drop to near zero. The buffer is gone before the warehouse scanner beeps.

The mandate hands merchants one new anchor, though: the verification-of-payee duty under the EU's instant-payment regulation, as amended. Before every instant credit, the payer's PSP must compare the IBAN and payee name; the merchant's PSP must answer that check in near-real time. The party that answers late — or answers "match" against the wrong account — carries the loss. That is a strict operational deadline, because the answer must beat the 10-second settlement clock.

Here is why the match is the only meaningful defense. The PSD2 refund obligation requires the payer's bank to refund an unauthorized transaction, regardless of merchant good faith. The bank's liability runs to the payer, not to the merchant. After finality, that refund is not absorbed by a bank error budget; it is debited from the merchant's account. Requiring a confirmed-payee "match" and a velocity cap before releasing goods is the only mechanism that shifts the loss back to the PSP that answered the check incorrectly.

Checkout integrations now amplify the trap. Payment processors like Stripe and Mollie enable instant-settlement APIs by default, meaning the merchant receives the 10-second credit before the goods-shipped decision is even logged in the order system. The credit and the confirmed-payee response arrive in the same packet; unless the fulfillment workflow blocks release until the match is verified, the platform treats finality as proof of identity. That null configuration is the dangerous one.

Do not carry the myth that the payer's bank still insures the merchant after instant settlement. The card-rail precedent is blunt evidence: according to the Visa Plunges financial dispatch, Visa paid merchants a $231.7 million legal settlement over chargeback liability rules, and Visa shares fell 1.54% to a four-day low on the news. Card networks have mature dispute machinery, and they still paid nine figures to settle chargeback liability. An instant-credit rail with no chargeback machinery at all offers the merchant even less shelter.

The concrete next move: audit your payment processor's API defaults today. If instant settlement is enabled without a forced verification-of-payee response gate and a per-account velocity cap, every 10-second credit you receive is an unaudited liability — and in 2026, that liability becomes yours to carry.

The Fraud-Loss Baseline

The European Banking Authority’s payment-fraud report identifies credit-transfer fraud as a fast-growing category. That trend is the baseline the 2026 10-second settlement regime inherits. The mix matters just as much: card fraud still represents a large share of the total, but instant credit-transfer fraud is the only category whose unit economics improve after settlement finality. A card transaction leaves a chargeback window; an instant credit transfer settles in 10 seconds and is then final. The 10-second rule accelerates exactly the segment the report flagged.

Merchants who assume the payer’s bank still absorbs the loss are reading the card-era rulebook. Under the PSD2 refund obligation, a challenged instant credit transfer triggers a clawback, and if the merchant released goods without a confirmed-payee “match” and a velocity cap, the merchant—not the payer’s bank—pays. The UK’s Payment Systems Regulator mandatory reimbursement scheme splits authorised push-payment scams between sending and receiving PSPs. That is a blueprint EU PSPs already price into acquiring fees: the receiving PSP’s share does not disappear; it is passed to merchants through higher acquiring costs and settlement terms. In the 2026 EU regime, a merchant without a match and velocity cap is the unhedged counterparty to that split.

The wallet signal confirms the direction. The European Payments Initiative’s Wero mobile wallet launched with built-in confirmation-of-payee and instant-settlement terms in its acceptance contracts. That is not a consumer feature; it is liability allocation written into the contract. Wero merchants are signing onto rails where the 10-second speed comes bundled with a merchant-side liability clause, not just speed. Accepting Wero without the confirmation-of-payee check and a per-counterparty velocity cap means accepting the same risk the UK scheme forced PSPs to split.

The readiness data shows why merchants cannot outsource this to the bank. A European Banking Federation survey found that EU banks’ anti-fraud screening for instant payments can still rely on manual or batch checks rather than real-time decisioning. It is impossible for a manual queue to produce a decision inside a 10-second window. By the time the batch check runs, the funds are final and the goods are gone. That leaves confirmation-of-payee and the velocity cap as the only controls that operate in real time—and the merchant is the only party with both the incentive and the position to enforce them.

The policy intent is explicit. The European Commission’s impact assessment for the instant-payments proposal singled out confirmation-of-payee as the compensating control that makes 10-second settlement bearable, which is why the verification-of-payee duty exists. The regulation does not leave merchants unprotected by accident; it requires them to use the compensating control. The myth that the payer’s bank remains the backstop after settlement finality is a residue of the card era. It is not the law in the 2026 10-second settlement regime, and it is not what the fraud-loss baseline assumes.

Three Settlement Paths for 2026 Checkout

At volume on instant rails, even a low fraud rate produces annual losses. A paid risk stack can break even the moment it blocks a sufficient share of those losses. That arithmetic, not settlement speed, decides which checkout path a merchant should run under the current 10-second regime.

The three paths are straightforward. Path A is legacy SEPA SCT with delayed payout. Path B is bare 10-second instant credit with no verification handshake at checkout. Path C is 10-second instant credit plus an enforced confirmation-of-payee "match" response plus a merchant-side velocity rule. The settlement technology, including card tokenization or stablecoins, is close to ready either way, according to Medium; what actually differs across the paths is the liability rulebook.

Finality speed is not the differentiator. A clears slowly, by construction; B and C both settle in under 10 seconds. The differentiator is who eats the clawback when the payment turns out to be fraudulent. Under A, reversal under SEPA rules is still available, and the payer's PSP has a route back into the merchant's account. Under B, the merchant absorbs the payer-PSP reclaim directly; the belief that the payer's bank is still liable after instant settlement is precisely backwards, because the PSD2 clawback lands on the merchant. Under C, a "mismatch" response or a missed response window on the confirmation-of-payee check moves liability upstream to the payer's PSP via the verification-of-payee failure, and the merchant's side of the ledger is clean.

This pattern is not new. Visa's disputed-chargeback liability changes of 2015-2017 moved fraud costs from banks to retailers on card rails; the 10-second regime repeats that shift on credit rails unless the handshake is enforced at checkout instead of at payout.

The winner boundary is sharp. Path C wins when merchant volume is high enough that the legacy path's cash-flow drag plus its fraud costs exceed the risk-stack price. Below that level, those combined costs stay under the price of the stack, and the micro-merchant rules in this guide's final section apply instead.

Merchants do not need to build the infrastructure. Adyen RevenueProtect and equivalent rule engines already implement the velocity checks and IBAN-name matching; the merchant's job is configuration, not construction — turn on the confirmation-of-payee handshake at checkout, not at payout. The rulebook is the missing piece, as Medium puts it, and that rulebook now runs through the PSD2 refund obligation.

What the Data Doesn't Tell You

The EBA's headline figure is gross attempted fraud across every payment type, not net merchant liability. The statistic mixes card fraud, credit transfers, and authorized push-payment scams, and it tells you nothing about the one classification that decides who eats the loss: whether the consumer's PSP labels the transaction "authorized" or "unauthorized." That classification varies materially by PSP and by member state, so merchants can face the identical scam and land on opposite sides of the clawback. The myth that the payer's bank still absorbs the loss after instant settlement dies here: it may hold in a Berlin courtroom and fail in a Lisbon one.

The research reinforces the variance. An ECB working paper on instant-payment fraud found a heterogeneous effect — PSPs with real-time controls saw fraud fall after migrating to instant, while PSPs without such controls saw losses rise. The 10-second regime doesn't manufacture fraud; it exposes which PSPs never built the controls. A merchant who skips the confirmation-of-payee match is betting their acquirer sits in the first group. The bet is not obviously safe.

Country variance is wide enough to flip the outcome. Germany's civil-law refund precedent pushes the cost to the payer's bank, so a Berlin merchant can escape a loss that a Lisbon merchant — under Portugal's fintech-friendly enforcement, which leans on the payee bank — absorbs in full. Same EU regulation, opposite balance-sheet results. And the 2026 deadline itself is narrower than it looks: it covers only euro accounts inside EU PSPs. A merchant settling in Czech koruna, Polish zloty, or Swedish kronor stays on the old SEPA SCT until later tranches, meaning the float survives there — but only until the next tranche lands.

The data's blind spots cut both ways. The EBA methodology acknowledges that authorized push-payment scams are systematically under-reported by consumers, so the aggregate figures understate social-engineering fraud. The headline is a lower bound, not a ceiling. Meanwhile, the verification-of-payee handshake carries a false-positive cost the fraud stats never show: legitimate mismatches — "Alex" vs "Alexander," a GmbH suffix typo — can hard-fail good orders. That conversion loss is real, but it is a tax on doing business; an unmatched 10-second payment is a guaranteed clawback exposure under the PSD2 refund obligation.

Singapore's MAS Shared Responsibility Framework marks the direction of travel: fraud losses are no longer the customer's problem. When the consumer is off the hook, the merchant and the PSP are on it — which is exactly why the match-plus-velocity rule holds even where the aggregate data looks reassuring.

The only defensible checkout rule in 2026 is the match-plus-velocity handshake; every shortcut converts a data limitation into a clawback.

Worked Case

The cleanest way to see what the PSD2 refund obligation does to a merchant is to run one order through the ledger. A Berlin consumer-electronics store processing significant volume through Checkout.com, with instant SCT Inst payouts enabled and no custom verification rule, accepts the SCT Inst credit as final payment. There is no confirmation-of-payee filter and no velocity cap — and because settlement is near-instant, there is no float left in which a pattern could surface.

In 2026, a shopper pays for high-end phones plus express shipping through a Revolut money-app account. The SCT Inst credit lands in the merchant's Checkout.com balance via TIPS almost immediately. The courier scans the parcel shortly afterward. The full span between final settlement and the point of no return is a matter of minutes.

Later, the Revolut account's legitimate owner confirms the payment was unauthorized — account takeover. Under the PSD2 refund obligation, Revolut refunds the account owner, then exercises a chargeback reclaim against the merchant's acquiring account. The total claim includes the order value plus a chargeback fee.

This is where the card-era instinct fails. According to The Points Guy, credit card fraud recovery is protected by federal law, so the first advice given to consumers is not to panic; the consumer has a statutory right to recovery. The myth that "the payer's bank is still liable after instant settlement" smuggles that card logic into SCT Inst. There is no equivalent merchant-side protection: the PSD2 refund obligation requires the payer's bank to refund the account owner, and the acquiring bank passes that claim straight to the merchant. The old settlement float that let a merchant spot fraud before funds became irretrievable is gone.

Recovery only shrinks the damage. The fraudster routed the phones to a parcel-drop address, and police and courier recovery return some resale value — leaving a net merchant fraud loss on a single order.

The counterfactual is the canonical rule. Had the merchant enabled a Checkout.com rule requiring both the confirmation-of-payee match and a new-account same-SKU velocity cap, the order would have been declined at authorization and the loss would never have been booked. Note the mechanism: confirmation-of-payee alone would not have saved this order, because an account takeover passes a name-match check — the name is genuine. The velocity cap is the discriminator: a newly opened account buying the same SKU soon after a prior order is the pattern that fires.

The coda is why merchant-side controls are the only ones that work. The mule money-app account was opened quickly with a stolen ID, so the payer's bank sees a legitimate account with a valid match; no default bank-side control fires quickly enough. Only the merchant's own verification and velocity checks can see the pattern before the courier scans the parcel.

How to Choose Well

Defaulting to "warn-only" on a confirmation-of-payee mismatch in 2026 is the functional equivalent of handing your cash register keys to the fraudster. The mechanism is unforgiving: under the PSD2 refund obligation, the payer's PSP can claw back an instant credit transfer if it was initiated by fraud, and the legal presumption pivots on whether the merchant can demonstrate it relied on a confirmed-payee 'match' before releasing goods. A warning does not create that reliance; a hard-fail does. When your PSP returns a 'mismatch' response under the verification-of-payee rule, instruct the processor to terminate the checkout session immediately. The payer's PSP is the upstream party holding the funds at the moment of the 10-second execution, and by hard-failing on a documented mismatch, you transfer the liability decision back to tha

Frequently Asked Questions

Under India's RBI rules finalized on 24 June 2026, what compensation must banks pay digital-banking fraud victims and when does it take effect?

Victims receive 85% compensation up to Rs 25,000, with the burden of proof on banks, effective 1 January 2027.

If the merchant's PSP answers 'match' against the wrong account during the EU verification-of-payee check, who carries the loss?

The party that answers late — or answers 'match' against the wrong account — carries the loss.

What default API behavior of processors like Stripe and Mollie makes the 10-second settlement dangerous for merchants?

Payment processors like Stripe and Mollie enable instant-settlement APIs by default, meaning the merchant receives the 10-second credit before the goods-shipped decision is even logged in the order system.

What is the exact execution cap for euro instant credit transfers under the EU regulation, and what does TIPS lack compared to legacy SEPA SCT?

The EU instant-payment regulation forces every EU PSP to send and receive euro instant credit transfers with execution capped at 10 seconds, and TIPS has no overnight batch, no business-day cutoff, and no settlement lag.

After a 10-second credit is final, how is a PSD2 refund for an unauthorized transaction debited?

A PSD2 refund moves as a debit from the merchant's settlement account, not from the bank's loss ledger.

How does the UK's Payment Systems Regulator scheme treat authorised push-payment scams, and how is the receiving PSP's share passed to merchants?

The UK PSR mandatory reimbursement scheme splits authorised push-payment scams between sending and receiving PSPs, and the receiving PSP's share is passed to merchants through higher acquiring costs and settlement terms.

Quick answers

Sources: Flyertalk, Flyertalk, Frequentmiler, Flyertalk, Thepointsguy

Also worth reading: Inside Taiwan's Plan to Integrate Bitcoin: Reserves, Regulation, and Resilience: Inside Taiwan's Plan to Integrate · Decoding the GENIUS Act: What US Stablecoin Regulation Could Mean For Your Wallet: Decoding the GENIUS Act: What · US Senate Gridlock Over Digital Payments: Stablecoin Regulation Fuels Partisan Clash: US Senate Gridlock Over Digital