Evaluation of the existing policy and legislative framework and preparation of impact assessment regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non-cash means of payment : final report.
Date: 2018-03-06
Institutions: Directorate-General for Migration and Home Affairs
Subjects: EU Member State, counterfeiting, criminal law, cross-border cooperation, electronic money, fraud, judicial cooperation in criminal matters in the EU, payment, report

Evaluation of the existing policy 
and legislative framework and 
preparation of impact 
assessment regarding possible 
options for a future EU initiative 
in combatting fraud in and 
counterfeiting of non-cash 
means of payment 

Final Report 

9 June 2017 

This report has been prepared  by EY and RAND Europe for the European Commission DG Migration and 
Home Affairs. 

 
 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

European  Commission 

Directorate-General for Migration and Home Affairs 
Directorate D Security  
Unit D4 — C ybercrime 

Contact: Michele Socco 

E-mail:  HOME-CYBERCRIME@ec.europa.eu   

European Commission 
B-1049 Brussels 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Evaluation  of the existing  policy and legislative  framework and preparation  of impact 
assessment  regarding  possible  options  for a future  EU initiative  in combatting  fraud in and 
counterfeiting  of non-cash  means of payment 

Final Report 

Directorate-General for Migration and Home Affairs  

 
 
 
 
 
 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Europe Direct is a service to help you find answers  
to your questions about the European Union. 

Freephone  number  (*): 

00 800 6 7 8 9 10 11 

(*)  The information given is free, as are most calls (though some o perators, phone boxes or 

hotels may charge you). 

LEGAL NOTICE 

This document has been prepared for the European Commission however it reflects the views only of 
the authors, and the Commission cannot be held responsible for any use which may be made  of the 
information contained therein. 

More information on the European Union is available on the Internet (http://www.europa.eu). 

Luxembourg: Publications Office of the European Union, 2018 

ISBN 978-92-79-80322-2 

doi: 10.2837/232849   

DR-02-18-234-EN-N    

© European Union, 2018 
Reproduction is authorised provided the source is acknowledged. 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Table of contents 

1 

INTRODUCTION ...........................................................................................................16 

1.1 

Purpose and scope of the study ..........................................................................16 

1.2  Methodological approach ....................................................................................17 

1.3 

Limitations – robustness of findings ....................................................................18 

2 

BACKGROUND OF THE STUDY ......................................................................................19 

2.1 

The Framework Decision 2001/413/JHA ..............................................................19 

2.1.1 

The Framework Decision and its provisions ...........................................19 

2.1.2 

The intervention logic ...........................................................................21 

2.2 

EU and international policy context .....................................................................22 

2.2.1 

EU policy context..................................................................................22 

2.2.2 

International policy context ..................................................................25 

2.3 

The non-cash payments industry ........................................................................25 

PART I – EVALUATION REPORT.............................................................................................28 

3 

IMPLEMENTATION STATE OF PLAY ................................................................................28 

3.1  Non-cash payments frauds .................................................................................28 

3.2 

Level of transposition of the Framework Decision ................................................32 

Definition of payment instruments ........................................................33 

Criminal offences..................................................................................34 

Legal person liability.............................................................................35 

Penalties…............................................................................................36 

Jurisdiction...........................................................................................39 

Extradition and prosecution ..................................................................40 

Cross border cooperation and exchange of information .........................42 

3.3 

Implementation of the Framework Decision ........................................................42 

3.3.1 

Obstacles to investigations and prosecutions ........................................43 

Limited relevance of the EU criminal law framework to the recent criminal 
offences and technological developments in the NCP industry43 

Differences in national criminal law frameworks ....................................44 

Current  fragmentation  in  the  implementation  or limited scope of data 
protection rules between MS.................................................45 

Lack of skills among LEAs and judicial authorities .................................46 

Limited priority given to NCP frauds......................................................47 

Lack  of  standardised  statistics  on  investigations,  prosecutions, 
convictions and reported incidents relating to cybercrime......48 

Obstacles to public-private cooperation.................................................48 

3.3.2 

Issues of territoriality and jurisdiction ...................................................49 

3.3.3 

Cooperation among law enforcement and judicial authorities ................52 

NCP frauds are becoming increasingly complex and with a cross -border 
component. ..........................................................................52 

Cross-border cooperation practices .......................................................54 

4 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

4 

EVALUATION RESULTS .................................................................................................59 

4.1  Relevance ..........................................................................................................59 

Definition of payment instruments ........................................................59 

Criminal offences..................................................................................61 

4.2 

Effectiveness ......................................................................................................62 

4.2.1 

Baseline situation .................................................................................62 

4.2.2 

Effectiveness of the Framework Decision ..............................................64 

Harmonisation of the scope of criminal offences....................................64 

Sanctioning of offences by Member States ............................................65 

Cross-border cooperation and exchange of information .........................66 

Conditions for investigations and prosecutions ......................................66 

4.2.3 

Reporting to Law Enforcement Authorities ............................................67 

Reporting obligations of offences criminalised by the FwD .....................68 

Adequacy of the level of reporting ........................................................68 

4.2.4 

Public-private cooperation ....................................................................71 

Enabling factors ...................................................................................74 

Limitations and obstacles .....................................................................75 

4.2.5 

Victims’ rights protection ......................................................................77 

Main effects of NCP related frauds on individuals ..................................77 

The protection ensured to victims by EU and national legislation ...........79 

4.3 

Efficiency ...........................................................................................................85 

4.3.1 

The cost of frauds ................................................................................85 

4.3.2 

Earnings for Organised crime groups ....................................................93 

4.4  Coherence..........................................................................................................96 

4.5 

EU Added value ................................................................................................105 

PART II – IMPACT ASSESSMENT REPORT............................................................................108 

5 

PROBLEM DEFINITION................................................................................................108 

5.1  Rationale of the identified problem ...................................................................108 

5.2 

Identification of the problem.............................................................................109 

5.2.1 

Uncertainty  and  obstacles  for  law  enforcement  activity  and  judicial 
cooperation ........................................................................................109 

5.2.2 

Limited harmonisation of the legislative framework.............................111 

5.2.3 

Financial and social costs incurred by economic operators and consumers112 

5.3  Drivers and consequences of the identified problems ........................................113 

5.3.1 

Drivers ...............................................................................................114 

5.3.2 

Consequences ....................................................................................118 

Evolution of the problem ..................................................................................118 

EU right to act, necessity test and EU added value............................................119 

5.4 

5.5 

6 

DEFINITION OF THE OBJECTIVES ...............................................................................121 

6.1 

Identification of the main objectives .................................................................121 

6.2  Rationale of the identified objectives ................................................................122 

6.3  Assessment  of  the  consistency  with  the  the  EU  and  international  policy 
developments...................................................................................................125 

5 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

7 

POLICY OPTIONS........................................................................................................127 

7.1  Approach to the identification of the policy options ...........................................127 

7.2  Description of the policy options .......................................................................129 

7.2.1 

7.2.2 

7.2.3 

Policy option 0 - Status quo ................................................................129 

Policy option 1 - Soft law ....................................................................129 

Policy option 2 - Revision of the regulation in the area of criminal law and 
law enforcement cooperation ..............................................................130 

7.2.4 

Policy option 3 - New legislation .........................................................132 

7.2.5 

Policy option 3bis - New legislation and new procedural rules ..............133 

7.3  Rationale of the identified policy options and options discarded .........................134 

7.3.1 

Rationale of the identified policy options .............................................134 

7.3.2 

Options and measures discarded ........................................................135 

8 

ANALYSIS OF IMPACTS OF EACH POLICY OPTION .......................................................136 

8.1 

Impact Identification: the impact causal model .................................................136 

8.2  Assessment criteria ..........................................................................................137 

8.3  Qualitative assessment of the policy options .....................................................139 

8.3.1 

Policy option 0 - Status quo ................................................................142 

8.3.2 

Policy option 1 - Soft law ....................................................................145 

8.3.3 

8.3.4 

8.3.5 

Policy option 2 – Revision of the regulation in the area of criminal law and 
law enforcement cooperation ..............................................................150 

Policy option 3 - New legislation .........................................................156 

Policy option 3bis - New legislation and new procedural rules ..............161 

8.4  Quantitative assessment of the policy options ...................................................164 

8.4.1 

8.4.2 

Quantification of the financial and administrative costs .......................164 

Quantification of the main benefits .....................................................169 

8.4.3 

Summary of the quantification exercise ..............................................170 

9 

COMPARISON OF OPTIONS AND THE PREFERRED POLICY OPTION ..............................170 

9.1  Comparative assessment of the policy options ..................................................170 

9.2 

Identification of the preferred policy option.......................................................171 

9.2.1  Main advantages ................................................................................171 

9.2.2  Main disadvantages ............................................................................172 

9.2.3 

Subsidiarity ........................................................................................172 

9.2.4 

Proportionality....................................................................................173 

10  MONITORING AND EVALUATION ARRANGEMENTS ......................................................173 

6 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

7 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

List of Abbreviations 

Acronym  Meaning 

AML 
AROs 
Asso and 
DPA 

Anti-Money Laundering  
The Asset Recovery Offices  
Associations and Data Protection 
Authorities 

ATM 

Automatic Teller Machine 

CaaS 

Crime-as-a-Service  

CAGR 

Compound Annual Growth Rate  

CARIN 

The Camden Asset Recovery Inter-Agency 
Network 

CEO 

Chief Executive Officier 

CERT 

Computer Emergency Response Team 

JR 

CiSP 
CNP 
CP 
DCPCU 

DECO 

DPA  
DPC 
EAW 

EBA 

COM 
EC3 
ECB  
ECTF 
EEA 

EGM 

Cyber information security partnership 
Card-Not-Present 
Card Present 
Dedicated Card and Payment Crime Unit 
Portuguese Association for Consumer 
Protection 
Data Protection Authority 
Data Protection Commissioner 
European Arrest Warrant 

European Banking Authority 

European Commission 
European Cybercrime Centre 
European Central Bank 
Electronic Crime sTask Force 
European Economic Area 

Expert Group Meeting 

EIO 

European Investigation Order 

EJN 
EMMA 

European Judicial Network 
European Money Mule Action 

E-Money  Electronic Money 

Acrony
m 
EMV 
EO 

Meaning 

Europay, MasterCard and Visa 
Economic Operator 

FPAP 

Fraud Prevention Action Plan 

FwD 

IBAN 

IOCTA 

IP 
Addres
s 
JITs 

LEAs 
MS 
NBF 
NCP 

Council Framework Decision 
2001/413/JHA 
International Bank Account Number 
Internet Organised Threat 
Assessment 

Internet Protocol Address  

Joint Investigation Teams 
Judiciary and judicial cooperation 
representatives 
Law Enforcement Agencies 
Member State 
National Banking Federations 
Non-cash payments 

NCSC  National Cyber Security Center  

Near Field Communication  
Network and Information Systems 

NFC 
NIS 
OCGs  Organised Crime Groups 
OF2CE
N 
OPC 
PO 
POS 
PP 
PPP 

Online Fraud Cyber Centre and 
Expert Network  
Open Public Consultation 
Policy Option 
Point Of Sale 
Public-Private  
Public-Private Partnership 
Payment Service Directive 
2007/64/EC  
Payment Services Directive 
2015/2366  
Payment Service Providers 
Single Euro Payments Area  
Secure Information Exchange 
Network Application 
Small Medium Enterprise 
Short Message Service 

PSD1 

PSD2 

PSP 
SEPA 

SIENA 

EMPACT 

European multidisciplinary platform against 
criminal threats 

SME 
SMS 

MS 

AT 

BE 

BG 

CY 

Meaning   

Austria  

Belgium 

Bulgaria 

Cyprus 

Meaning 

Ireland 

Italy 

Lithuania 

Luxembourg 

MS 

IE 

IT 

LT 

LU 

8 

 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

CZ 

DE 

DK 

EE 

EL 

ES 

FI 

FR 

HR 

HU 

Czech Republic 

Germany 

Denmark 

Estonia 

Greece 

Spain 

Finland 

France 

Croatia 

Hungary 

Latvia 

Malta 

Netherlands 

Poland 

Portugal 

Romania 

Sweden 

Slovenia 

Slovakia 

United Kingdom 

LV 

MT 

NL  

PL 

PT 

RO  

SE 

SI 

SK 

UK 

9 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Glossary 

Term 

Definition 

PAYMENT INSTRUMENTS 

Bill of exchange  A bill of exchange is a written order from one party (the drawer) to another (the 
drawee)  instructing  the  drawee  to  pay  a  specified  sum  on  demand  or  on  a 
specified  date  to  the  drawer or to a third party specified by the drawer. It is 
widely used to finance trade and, when discounted with a financial institution, to 
obtain credit.1 

Cheque 

Coupon 

A cheque is a written order from one party (the drawer) to another (the drawee, 
normally  a  credit  institution)  requiring  the  drawee  to  pay a specified sum on 
demand to the drawer or to a third party specified by the drawer.2 

A coupon is a discount offer printed in newspapers or magazines, attached to a 
packaging, or mailed out. A consumer redeems a coupon by presenting it at the 
time of paying for the discounted product.3  

Credit 
transfer/Wire 
transfer 

A wire transfer is a transaction carried out on behalf of an originator person (both 
natural and legal) through a financial institution by electronic means with a view 
to  making  an  amount  of  money  available   to  a  beneficiary  person at another 
financial institution. The originator and the beneficiary may be the same person. 

Money remittance is a type of wire transfer and namely a payment service where 
funds are received from a payer, without any payment accounts being created in 
the  name  of  the  payer  or  the  payee,  for  the  sole  purpose  of  transferring  a 
corresponding amount to a payee or to a nother payment service provider acting 
on behalf of the payee, and/or where such funds are received on behalf of and 
made available to the payee .4 

Direct debit is a payment service for debiting a payer’s payment account, where a 
payment transaction is initiated by the payee on the basis of the consent given by 
the payer to the payee, to the payee’s payment service provider or to the payer’s 
own payment service provider.5 

Direct debit 

Electronic 
money (e-
money) 

Electronic  money  is  an  electronically,  including  magnetically,  stored monetary 
value as represented by a claim on the issuer which is issued on receipt of funds 
for  the  purpose  of  making  payment  transactions  and  which is accepted by a 
natural or legal person other than the e -money issuer.6 E-money can be either 

1 European C entral Bank. (2010). The Payment System. Tom Kokkola. Page 343. 
2 European C entral Bank. (2010). The Payment System. Tom Kokkola. Page 345. 
3 Business Dictionary. (2017). ‘coupon’. Business Dictionary. Available here.  
4 European Parliament and Council of the European Union. (2015). Directive (EU) 2015/2366 of the European 
Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending 
Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 
2007/64/EC . 
FATF and GAFI. (2001). FATF IX Special Recommendations. Article 4, Definitions. 
5 European Parliament and Council of the European Union. (2007). Directive 2007/64/EC of the European 
Parliament and of the Council of 13 November 2007 on payment services in the internal market amending 
Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC. Article 4, 
Definitions. 
6 European Parliament and Council of the European Union. (2009). Directive 2009/110/EC of the European 
Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the 
business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 
2000/46/EC . Article 2, Definitions. 

10 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Term 

Eurocheque 

Definition 
hardware-based (i.e. stored on a device, typically a card)7 or software-based (i.e. 
stored on a computer server).8 

A Eurocheque is the equivalent of a traveller's check issued in the Euro currency. 
The check must be issued by a European bank and can be cashed at banks that 
display the "European Union" crest. Security measures have been put in place to 
ensure that a holder can still retrieve the funds of a Eurocheque should it be lost 
or stolen. The Eurocheque is no longer issued, as of 2002.9 

Fidelity/loyalty 
card 

A loyalty card is a card offered by some stores to their customers on which the 
card owner can store points that can be converted into vouchers that provide 
discounts on products or services. Customers are awarded a set number of points 
when they shop at the store, depending on how much they spend.10 

Meal 
voucher/Ticket 
restaurant   

Mobile money 

Payment cards 

A meal voucher is a ticket given by an employer to an employee in addition to 
their wages, which can be exchanged for food in a restaurant.11 

Mobile money is the provision of financial services through a mobile device. This 
broad definition encompasses a range of services, including payments (such as 
peer-to-peer transfers), finance (such as insurance products), and banking (such 
as account balance inquiries). In practice, a variety of means can be used such as 
sending text messages to transfer value or accessing bank account details via the 
mobile Internet. 

Carrier  billing  means making purchases that are charged to the customer's phone 
account.12 

Credit cards: A credit card is a card that enables cardholders to make purchases 
and/or withdraw cash up to a prearranged credit limit. The credit granted may be 
either settled in full by the end of a specified period, or settled in part, with the 
balance taken as extended credit (on which interest is usually charged).13 
Debit card: A debit card is a card enabling its holders to make purchases and/or 
withdraw cash and have these transactions directly and immediately charged to 
their accounts, whether these are held with the card issuer or not.14 
Commercial  card:  A  commercial  card  is  a  payment  instrument  used  only  for 
business expenses charged directly to the account of the undertaking or public 
sector entity or the self-employed natural person.15  

7 For instance, prepaid cards are included in this definition. 
8 European C entral Bank. (2010). The Payment System. Tom Kokkola. Page 351. 
9 InvestorWords. (2017). ‘Eurocheque’. Investor Words. Retrieved from 
<http://www.investorwords.com/9597/Eurocheque.html> 
10 BBC . (2017). ‘loyalty cards’. BBC. Retrieved from 
<http://www.bbc.co.uk/schools/gcsebitesize/ict/implications/1lifestylerev2.shtml> 
11 InvestorWords. (2017). ‘Luncheon voucher’. Investor Words. Retrieved from 
<http://www.investorwords.com/10237/luncheon_voucher.html> 
12 Donovan, K. (2012). Mobile Money for Financial Inclusion. Information and Communications for Development. 
PcMag. (2017). ‘direct carrier billing’. PC Mag. Retrieved April 19, 2017, from 
<http://www.pcmag.com/encyclopedia/term/63496/direct-carrier-billing> 
13 European C entral Bank. (2010). The Payment System. Tom Kokkola. Page 348. 
14 European C entral Bank. (2010). The Payment System. Tom Kokkola. Page 349. 
15 European Payments Council. (2015). ‘Commercial cards’. Retrieved from 
<https://www.europeanpaymentscouncil.eu/news-insights/insight/impact-interchange-fee-regulation-card-
schemes-view> 

11 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Term 

Definition 

Fuel card: A fuel card is used as a payment card most commonly for diesel, petrol 
and lubricants at filling stations.16  

Travellers’ 
cheque 

A  travellers’  cheque  is  a  prepaid  paper-based  product  issued  in  specific 
denominations for general-purpose use in business and personal travel. It does 
not  specify  any  particular  payee, is non-transferable once signed and can be 
converted into cash only by its specified owner. It is generally accepted by banks, 
with many large retailers and hotels (and some restaurants) doing likewise.17 

Virtual currency    Virtual  currency  (e.g.  Bitcoin)  is  a  digital  representation  of  value  that can be 
digitally traded and functions as (1) a medium of exchange; and/or (2) a unit of 
account; and/or (3) a store of value, but does not have legal tender status (i.e., 
when  tendered  to  a  creditor,  it  is  a  valid  and  legal  offer  of  payment) in any 
jurisdiction. It is neither issued nor guaranteed by any jurisdictions, and fulfils the 
above functions only by agreement within the community of users of the virtual 
currency.18 

CRIMINAL  OFFENCES 

Acting  as a 
money mule 

Carding 
websites 

Data breach 

The term “acting as a money mule” indicates a person who transfers proceeds of 
crime between different countries. Money mules receive the proceeds into their 
account; they are then asked to withdraw them and wire the money to a different 
account,  often  overseas,  ke eping  some  of  the  money  for  themselves.19 
Sometimes  they  know  the  funds  are  crime  proceeds;  sometimes  they  are 
deceived into believing that the funds are genuine. 

Carding websites are websites where bundles of credentials are sold in varying 
sizes. Prices depend inter alia on whether the card data are taken from corporate 
cards which might have higher limits and be verified less frequently; on the time 
that has elapsed since the data theft has taken place; and on the completeness of 
the data file (e.g. additional information on the card holder might enable higher 
prices).20 

A  data breach is an incident in which sensitive, protected or confidential data 
have been potentially viewed, stolen or used by an individual unauthorise d to do 
so.  Data  breaches  may  involve  personal  data,  such  as  for instance  personal 
health information, trade secrets, or intellectual property.21 

Eavesdropping 
(or sniffing) 

Eavesdropping  is  the  process  of  actively  capturing  datagram  and  packet 
information  from  a  selected  network.  Sniffing  acquires  all  network  traffic 
regardless of where the packets are addressed.22 

16 UKFuelC ards. (2017). ‘payment cards’. UK Fuel Cards. Retrieved from 
<http://www.ukfuelcards.co.uk/faq/glossary> 
17 European C entral Bank. (2010). The Payment System. Tom Kokkola. Page 32. 
18 FATF. (2014). Virtual Currencies Key Definitions and Potential AML/CFT Risks. Financial Action Task . Page 4. 
19 ActionFraudUK. (2017). ‘money muling’. Action Fraud. Retrieved from <http://www.actionfraud.police.uk/fraud -
az-money-muling> 
20 European C ommission. (2016). Inception Impact Assessment. Combatting Fraud and Counterfeiting of Non-Cash 
Means of Payment. Page 3. 
21 TechTarget. (2010). ‘Data Breach. Retrieved from < http://searchsecurity.techtarget.com/definition/data-
breach> 
22 Symantec. (2017). ‘Sniffing’. Symantec. Retrieved from 
<https://www.symantec.com/security_response/glossary/define.jsp?letter=s&word=sniffing > 

12 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Term 

Malware 

Man-in-the-
middle 

Skimming 

Definition 

A  malware  is  a  malicious software that  consists of programming, for example 
code or scripts, designed to disrupt the performance of PCs, laptops, handheld 
devices, and so on. Malware can also collect information or data from infected 
devices  and  pass them on to another device. Malware is often  referred to as 
viruses,  worms,  trojan  horses,  spyware,  dishonest  adware,  scareware,  and 
crimeware.23 

The term “man-in-the-middle” indicates an attack in which an attacker is able to 
read, insert, and modify messages between two users or s ystems. The attacker 
must be able to observe and intercept messages between the two victims.24 

Skimming  occurs when a fraudster counterfeits a bank card by using a device to 
capture  the  card  and  account  information  embedded  in  the  card’s  magnetic 
strip.25 

Social 
engineering 
attacks  

Social  engineering  attacks  are  attack  vectors  that  heavily  rely  on  human 
interaction  and  often  involve  tricking  people  into  breaking  normal  security 
procedures. There are various techniques.26 

Phishing is a method used by fraudsters to access valuable personal details, such 
as usernames and passwords. Most commonly, an email that appears to be from 
a well-known and trusted company is sent to a large list of email addresses. The 
email may direct the recipient to a spoofed Web page, where he or she is asked 
for personal information.27 

Pharming is a form of online fraud very similar to phishing as pharmers rely upon 
the same bogus websites and theft of confidential information. However, where 
phishing must entice a user to the  website through ‘bait’ in the form of a phony 
email or link, pharming re-directs victims to the bogus site even if the victim has 
typed the correct web address.28 

Smishing occurs when fraudsters obtain personal details of a victim by SMS text 
messages. SMS phishing uses phone text messages to deliver the bait to induce 
people to divulge their personal information.29 
A  romance  scam occurs when dating fraudsters form online relationships with 
individuals over weeks and months and then make a request for money when 
they feel they have established enough trust.30 
A CEO attack occurs when a fraudster purports to be a senior partner (or CEO 
equivalent)  and  contacts  a member of staff with responsibility for authorising 

23 ActionFraudUK. (2017). ‘Malware’. Action Fraud. Retrieved from <http://www.actionfraud.police.uk/fraud-az-
malware> 
24 Symantec. (2017). ‘Man-in-the-middle’. Symantec. Retrieved from <https://us.norton.com/Internetsecurity -wifi-
what-is-a-man-in-the-middle-attack.html> 
25 Financial Fraud Action UK. (2017). ‘skimming’. Action Fraud. Page 44. 
26 TechTarget. (2017). ‘Social Engineering’. <http://searchsecurity.techtarget.com/definition/social-engineering>. 
Financial Fraud Action UK. (2017). ‘skimming’. Action Fraud. 
27 Action Fraud. (2017). ‘Phishing’. <http://www.actionfraud.police.uk/fraud-az-vishing> 
28 Symantec. (2017). ‘Online fraud: pharming’. Symantec. Retrieved from <https://us.norton.com/cybercrime-
pharming> 
29 Action Fraud. (2017). ‘SMSishing’. < http://www.actionfraud.police.uk/news/alert-fraudsters-are-sending-spoof-
text-messages-to-victims-that-appear-to-come-from-banks-jun15> 
30 Action Fraud. (2017). ‘Romance scam’. <http://www.actionfraud.police.uk/news/watch-out-for-new-methods-
used-by-dating-fraudsters-sept14> 

13 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Term 

Definition 

financial transfers, requesting payments to be made into bank accounts under the 
pretence of a highly sensitive or urgent transaction.31 

OTHER  

Card-not-
present 
transaction 

Card present 
transaction 

Darknet 

EMV standards 

Near Field 
Communication 
(NFC)  

CNP transactions are transactions based on payment cards with “MO/TO” (Mail 
Order/Telephone Order) commerce or e -commerce. In addition to these, card-
not-present payments at the physical point of sale have emerged. Indeed, the 
capabilities of modern mobile telephones, or smartphones, also allow for the use 
of “remote payments”, such as credit transfers at the physical point of sale.32 

Card-present transactions are transactions based on payment cards which can be 
made either in contact-mode (for which the card is inserted into the terminal) or 
as contactless payments (for which near-field communication technology is used 
and  for  which  it  is  sufficient  to  bring  the  card  clo se  enough  to  the  terminal 
without physical contact). For contactless payments, the “card” can also take the 
form of a mobile telephone,33 or any object that can be equipped with a chip and 
an NFC-antenna.34 

Darknet (or dark web) refers to “encrypted online content that is not indexed on 
conventional search engines. The dark web is part of deep web, a wider collection 
of content that does not appear through regular Internet browsing. A specific 
browser  like  Tor  is  required  to  access  dark  web  sites.  Th e  dark  web  holds 
anonymous  message  boards,  online  markets  for drugs, exchanges for stolen 
financial and private data, and much more. Transactions in this hidden economy 
are often made in bitcoins and physical goods are shipped in a way to protect 
both the buyer and the seller from being tracked by law enforcement”.35 

EMV® is a global standard for credit and debit payment cards based on chip card 
technology, taking its name from the card schemes Europay, MasterCard, and 
Visa,  the  original  card  schemes  that  developed  it.  The  standard  covers  the 
processing  of  credit  and  debit  card  payments  using  a  card  that  contains  a 
microprocessor chip.36 

Near  field  communication  is  a  form  of  contactless  communication  between 
devices like smartphones or tablets. When developing near field communication 
devices and new technology, NFC standards must be met. Standards exist to 
ensure all forms of near field communication technology can interact with other 
NFC  compatible  devices  and  w ill  work  with  newer  devices  in the future. Two 
major  specifications  exist  for  NFC  technology:  ISO/IEC  14443  and  ISO/IEC 
18000-3. The first defines the identity cards used to store information, such as 

31 Action Fraud. (2017). ‘CEO fraud’. <http://www.actionfraud.police.uk/news/medical-practices-targeted-by-ceo-
fraud-feb17> 
32 European C entral Bank. (2014). Cards payments in Europe - a renewed focus on SEPA for cards. Page 16. 
33 “The capabilities of modern mobile telephones, or smartphones, also allow for the use of previous “remote 
payments”, such as credit transfers at the physical point of sale. It also allows for making card -not-present 
payments at the physical point of sale. The latter raises specific concerns, as it circumvents the use of the chip on 
the physical card for card authentication”. 
34 European C entral Bank. (2014). Cards payments in Europe - a renewed focus on SEPA for cards. Page 17. 
35 Investopedia. (2017). ‘Dark web’. Investopedia. Retrieved from <http://www.investopedia.com/terms/d/dark-
web.asp> 
36 Level2Kernel. (2017). ‘What is EMV C hip Card Technology?’. Level 2 Kernel. Retrieved from 
<https://www.level2kernel.com/emv-guide.html> 

14 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Term 

Definition 

Payment -
service provider 

that  found  in  NFC  tags.  The  latter  specifies the radio  frequency identification 
communication used by NFC devices.37 

Payment service providers are natural or legal persons providing one or several of 
the  following  services:  (i)  Services  enabling  cash  to  be placed on a payment 
account as well as all the operations required for operating a payment account; 
(ii)  Services enabling cash withdrawals from a payment account as well as all the 
operations required for operating a payment account; (iii) Execution of payment 
transactions, including transfers of funds on a payment account with the user’s 
payment  service  provider  or  with  another  payment  service  provider;  (iv) 
Execution of payment transactions where the funds are covered by a credit line 
for a payment service user; (v) Issuing of payment instruments and/or acquiring 
of payment transactions;(vi) Money remittance; (vii) Payment initiation services; 
(viii)  Account information services. 
They can be credit institutions and e -money institutions including their branches 
located in the EU, post office giro institutions, payment institutions, the European 
Central Bank (ECB), national central banks, Member States or their regional or 
local authorities when not acting in their capacity as public authorities.38 

37 NearFieldCommunication. (2017). ‘Near Field Communication’. Near Field Communication. Retrieved from 
<http://nearfieldcommunication.org/> 
38 European Parliament and Council of the European Union. (2015). Directive (EU) 2015/2366 of the European 
Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending 
Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 
2007/64/EC . Article 4, Definitions. 

15 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

1 

INTRODUCTION   

1.1  Purpose and scope of the study 

Purpose of the study 

The  study  aimed  at  evaluating  the  existing  policy  and  legislative  framework  (and  namely the 
legislative  measures  transposing  the  Council  Framework  Decision  2001/413/JHA  -hereafter  also 
Framework Decision or FwD) in combatting fraud in and counterfeiting of non-cash payment (NCP) 
instruments  and  at  preparing  an  impact  assessment  regarding  possible  options  for  future  EU 
initiatives. In detail, the study pursued three specific objectives: 

The results of the evaluation are presented in Part I of the report; the results of the impact assessment 
are presented in Part II of the report.  

Scope of the study 

Content:  

  National legislation (laws, regulations and administrative procedures and protocols of 
general applicability) transposing the FwD and addressing fraud and counterfeiting of 
non-cash means of payment;  

  Case law of the European Court of Justice and of national courts ;  
  Relevant EU and international legislative and policy context; 
 
Practices of public-private cooperation and successful examples to replicate ;  
  The main types of NCP instruments (see Table 1), and related types of fraud.  

Table 1 – Key payment instruments  and  related channels 

Channels 

Payment instrument 

Payment cards 

Credit/wire transfers 

Direct debits 

Cheque, travellers’ cheques and bills 
of exchange, eurocheques 39  
Meal vouchers/Ticket restaurant 

Coupons 

Fidelity/Loyalty cards 

e-money  

Virtual currencies 

Mobile money 

Merchant 
(including 
POS) 

ATM 

Physical 
bank 

Online 
commerce 

Online 
banking 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

The evaluation study  covers the following key areas of analysis. 

Source: Authors’ elaboration based on desk research 

  The  dimension  of  crime  including  the  costs  of  fraud  and  counterfeiting  of  non -cash 

means of payment and trends in identity theft. 

39 Eurocheques have been left out from the following analysis since they are not issued anymore. 

16 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

  The  criminal  law  framework  including  national  laws  transposing  the  FwD,  and  key 
European and international legislation regarding non-cash means of payment frauds and 
counterfeiting.  
Procedural  criminal  law,  including  obstacles  to  investigations  and  prosecutions  and 
conditions for good law enforcement and judicial cooperation. 

 

  Conditions  for  reporting  and  public-private  cooperation  covering  reporting  obligations, 
practices of cooperation between law enforcement, judiciary, financial institutions and 
payment service providers, and bottlenecks and enablers to cooperation. 

  Victims’ rights with a focus on the main consequences for individuals that are victims of 
fraud and/or identity theft and the current level of protection ensured to victims by EU 
and national legislation.40 

The evaluation is undertaken against five evaluation criteria, analysing to which extent the existing 
policy and legislative framework is effective (in terms of results and impacts), efficient (in terms of 
implementation costs), relevant to the needs, coherent with other EU and international measures and 
has demonstrated an EU added value. Specific evaluation questions are answered (see Annex 1).  

The impact  assessment  contains the definition of the problem and the objectives of the future policy 
interventions,  the  description  of  the  proposed  policy  options  including the baseline scenario, the 
assessment of each policy option, and their comparison.  

Timeline: 

The study covers the implementation of the Framework Decision since 2001 (date of the adoption) to 
as late in 2016 as possible . 

Stakeholders: 

services, 

Law Enforcement Agencies (LEAs); 

 
  National Banking Federations (NBF); 
including:  Banking 
  private  sector 
system, Cards schemes, Card mobile 
payment 
Peer-to-peer 
mobile  payment  services,  Internet 
payment  companies,  Third  party 
providers, Money transfer companies, 
Airlines 
companies,  E-commerce 
companies,  Commercial  platforms 
(e.g.  eBay,  Amazon),  Retailer's 
associations 
judiciary  and  judicial  cooperation 
representatives (JR);  

 

  Associations  and  Data  Protection 
Authorities 
and  DPA) 
(Asso 
including: stakeholders in the field 
of data protection, Stakeholders in 
the  field  of  fundamental  rights, 
Victims’ 
consumers' 
associations, Academia; 
legal  professions  –  defence 
lawyers; 
  public-private 

partnership 

and 

 

representatives; 

  EU Institutions and bodies. 

Territory: 

EU28 Member States (thus including the UK that has opted out from transposing the FwD and SI that 
has not notified COM on transposition),41 with a specific focus on 10 Member States  (DE, FI, FR, IE, IT, 
NL, PL, PT, RO, UK).   

1.2  Methodological  approach 

The study started in August 2016 and ended in June 2017 and relied on:  

 

the  reconstruction  of  the  FwD  intervention  logic  showing  the  objectives  of  the 
intervention and the chain of expected effects (outputs, outcomes and impacts); 

  desk research on EU and national documents (see Annex 15 for references); 

40 Along the study victims’ rights refer mainly to individuals that are victims of fraud.  
41 See <https://www.ejn-crimjust.europa.eu/ejn/EJN_Library_StatusOfImpByCat.aspx?CategoryId=68> 

17 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

field research, including interviews, a web based survey targeted to NBF, LEAs, Asso and 
DPA, and the Private Sector, a validation focus group and two expert group meetings 
gathering representatives of the public and private sectors . Overall, 125 stakeholders 
have been involved in the study covering all MS except CY, HU and HR. Moreover, the 
study used the results of the Open Public Consultation that the European Commission 
(EC)  launched  in  March  2017  to  collect  opinions  on  the effectiveness of the current 
legislative and policy framework and on existing problems and possible options for future 
initiatives.  

1.3  Limitations  – robustness  of findings 

The analysis encountered some limitations. 

  The  transposition  analysis  encountered  limitations  in  comparing  the  significant 
number of provisions on NCP fraud adopted at Member State level in the last 16 years, 
often  included  in  legislation  relating  to  frauds  in  general  or  using  non-comparable 
wording. This is why for instance in a few cases the analysis resulted in saying that it is 
unclear whether a payment instrument or a conduct is covered by a national law. It is 
noteworthy that the fact that it has been unclear for the evaluation team can also mean 
that the law in question may be subject to different interpretation within the MS. 
  The  assessment  of  the  impact  of  the  FwD  encountered  limitations  in  identifying 
changes  in  national  legislation  due  to  the  sole  FwD  rather  than  to  other  pieces  of 
legislation that complemented and partially integrated the FwD (such as the Payment 
Service Directives which extended its scope of application). Information gathered also 
through  the  implementation  reports  of  the  EC 42  often  did  not  allow  the  team  to 
reconstruct the full legislative history (i.e. amendments) of the transposition , therefore 
limiting the analysis of to which extent the FwD affected national laws. Also stakeholders 
consulted were not able to clearly identify the impact of the FwD. This limitation has 
affected in particular the analysis of the effectiveness and of the EU added value. 
  The quantification of NCP frauds and counterfeiting encountered limitations due to 
i) few EU level statistics, ii) statistics not covering recent and emerging forms of NCP 
such as virtual currencies, mobile money and electronic money (e-money); iii) statistics 
not always distinguishing between cash or non-cash means of payments or anyhow non 
harmonised in the categorisation of NCP frauds across MS;43 and iv) presence of a dark 
number (unreported or undiscovered crime) linked to the under-reporting of cases by 
the  victims.  In  order  to  minimise  the  effects  of  these  limits,  the  Evaluation  team 
integrated statistics with other information gathered through other sources (such as 
industry reports and reports focused on specific countries) and with input provided by 
stakeholders consulted. This has mainly affected the analysis of the efficiency. 
Lack of data on prosecutions and investigations and their impact on Organised Crime 
Groups limited the assessment of the effectiveness and efficiency of the FwD. 

 

  National44  judicial  representatives  proved  to  be  particularly  difficult  to  engage, 
and despite having expanded the original list, mobilised stakeholders, and the network of 
national fraud experts this category remains poorly represented. This has been partially 
compensated by the attendance of national judicial representatives at the two expert 
group meetings.  

  The results of stakeholder consultations represent subjective views and opinions of 
those who chose to participate, often providing input on selected aspects of the study. 
As  such,  these  data  are  presented  as  qualitative  and  not  generalised  to  a  wider 
population. 

42 “Report from the Commission based on Article 14 of the Council Framework Decision of 28 May 2001 combating 
fraud and counterfeiting of non-cash means of payment” and “Report from the Commission. Second report based 
on Article 14 of the C ouncil Framework Decision of 28 May 2001 combating fraud and counterfeiting of non-cash 
means of payment.” 
43 For instance one MS collects data specific to a crime while another aggregates them in the category of 
cybercrime. 
44 National judicial representatives exclude Eurojust representatives.  

18 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

  The  qualitative  assessment  of  impacts  of  different  policy  options  is  based  on 
evaluation findings and available data. Where these were not available, the team looked 
for  plausible  explanations  on  if  and  how  the  situation  is  likely  to  change  under  a 
particular scenario (e.g. if and how introducing a definition of payment instruments and 
a broad definition of crimes will affect rights to liberty and security: small positive impact 
can be expected as forms of NCP not covered by current legislation will be regulated and 
this improves chances for prosecuting fraud criminals and protection of victims of fraud 
crimes). However, such judgements can be subjective. To mitigate this limitation, the 
judgements and justifications of the scores were validated with focus group participants 
and external reviewers. 

  The  quantification  of  the  main  costs  and  benefits  of  each  policy  option is limited 
by the lack of data and by some key assumptions. Since there is little evidence and data 
available to provide a complete quantitative assessment of the different policy options, 
the quantitative assessment relies mainly on the findings of the qualitative assessment. 
Moreover,  in  order  to  monetise  some  of  the  costs,  additional  assumptions  were 
necessary  (see  section  7.4  for a detailed description of the main assumptions). The 
research team made specific assumptions on the costs of developing legislation at EU 
level and transposing it at national level, general assumptions on the costs for the MS of 
implementing new legislation, and on the continuous reporting costs for EOs and LEAs 
that are envisaged in some policy options. The re is also little evidence and data available 
on the economic impacts and benefits of the different policy options, since few statistics 
and little data are available across the EU on fraud and non-cash payments. For the sole 
purpose of comparing the policy options, the research team estimated the economic 
impact  stemming  from  the  estimated  change  in  the  number  of  criminal  acts  and 
organised  crime  gains  resulting  from  each  of  the  policy  options.  Overall,  while  the 
quantitative assessment is relevant for comparing the policy options, the estimates need 
to be interpreted cautiously. 

2  BA CKGROUND  OF THE  STUDY   

This chapter presents an overview of the Framework Decision 2001/413/JHA and its intervention logic 
(section 2.1), of the broader EU and international policy context (section 2.2), and of the NCP industry 
and frauds (section 3.1). 

2.1  The Framework Decision  2001/413/JHA  

2.1.1  The Framework Decision  and its provisions   

The  Council  Framework  Decision  2001/413/JHA  on  combating  fraud  and  counterfeiting  of 
non-cash  means  of  payment  sets  up  a  common legal framework for the definition of frauds and 
counterfeiting of non-cash means of payment and for the related sanctions/penalties. The Fw D aims to 
ensure an equivalent and good level of criminal-law protection of non-cash means of payment against 
fraud and counterfeiting in all Member States and requires them to take measures to a chieve the 
intended outcome.  

The FwD is part of the first EU Fraud Prevention Action Plan 2001 (European Commission, 2001), 
further described in section 2.2.1.  

The FwD provisions’ rationale is described in Table 2 while Annex 2 describes them in detail. 

Table 2 – Rationale of the  key provisions of the FwD 

Definition  of payment  instrument 

Any physical (“corporeal”) payment instrument which can be used to transfer money or monetary 
value and is protected against imitation or fraudulent use.  

The  FwD  includes  a  non-exhaustive list of payment instruments (i.e. cards, cheques, travellers’ 

19 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

cheques, bills of exchange). Even if it does not explicitly mention forms of value transfer such as 
wire transfers, direct debit, ticket restaurant, fidelity/loyalty cards, or coupons , these fall into its 
scope  only  when  they  are corporeal, used to transfer mone y or monetary value and protected 
against imitation or fraudulent use at least through a unique issuing number or their design. These 
forms of value transfer are then partially covered by the FwD.  

The FwD excludes any non-corporeal payment instruments such as e-money, virtual currencies, or 
mobile money.  

Criminal offences 

The FwD identifies different forms of behaviours requiring criminalisation in relation to fraud and 
counterfeiting of non-cash means of payments with the aim that such behaviours are classified as 
criminal offences in all Member States and sanctioned accordingly. 

Legal person  liability 

The FwD extends liability to legal persons when criminal offences are committed by natural persons 
with specific powers of representation and invite s legal persons to set appropriate control measures. 

Penalties 

The FwD provides MS with high-level guidelines to set penalties for covered offences. It leaves the 
MS room to ensure that the forms of conduct listed by the FwD are punishable, by stating that the 
criminal penalties should be “effective, proportionate and dissuasive”, without imposing specific 
levels  of  sanction  but  clarifying  that,  at  least  in  serious  cases,  penalties  should  involve  the 
deprivation of liberty. 

Jurisdiction 

The  FwD  establishes  that  national  jurisdiction on offences  relating to NCP applies if one of the 
following criteria is met: i) principle of territoriality (i.e. the offences are committed in whole or in 
part  within  its  territory);  ii)  principle  of  personality  (i.e.  the  offences  are  committed  by  a  MS 
national)  and  principle  of  dual  criminality  (i.e.  the  national  criminal  law  applies  to  the  offences 
committed abroad, only if the criminal law of the Member State  1 applies to offenses committed 
outside the country by a national or a legal entity set up in that MS, if the act is considered as an 
offense in the criminal law of the Member State  2/third country where it was committed or if it was 
committed in a place that is not subject to the jurisdiction of any state); iii) when the offences are 
committed for the benefit of a legal person that has its head office in the territory of that Member 
State. 

Extradition  and prosecution 

The FwD builds on the 1957 European Convention on Extradition which firstly introduced the right of 
MS not to extradite their nationals. It disciplines cases in which a MS decides not to extradite its 
nationals  who  have  committed/are  alleged  to  have  committed  outside  its  territory  one  of  the 
criminal offences in scope of the FwD. The rationale of this article is thus to create conditions for 
judicial cooperation between MS in order to ensure that fraudsters are punished and MS affected by 
the criminal offence are aware of the measures established and of the outcome of the prosecution. 

The FwD provides two main cases: 

1.  When a national has committed one of the offences in scope  outside the MS territory, the 

20 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

FwD requires the MS refusing the extradition to establish its jurisdiction over the specific 
offence;  

2.  When  a  national  is  alleged  to  have  committed  an  offence  in  scope  in  another  MS  and 
extradition  is  denied  solely  on  the  ground of the nationality of the perpetrator, specific 
procedures of exchange of information between the requesting and the requested MS need 
to take place for the prosecution by the requested MS to take place. The requesting Member 
State shall then be informed of the prosecution initiated and of its outcome. 

Cross-border cooperation  and exchange  of information 

In  order  to  ease  the  implementation  of  the  criminal  law  framework  set  through  the  previous 
provisions, the FwD invites MS to provide mutual assistance in criminal proceedings  and to consult 
with each other in case more than one MS has jurisdiction on the same case. The  nomination of 
national contact points specifically dedicated to the exchange of information is also envisaged to 
facilitate cross-border investigations and prosecutions. 

Source: Authors’ elaboration based on desk research 

2.1.2  The intervention  logic  

The figure below illustrates a map of the intervention logic of the FwD, displaying its provisions in 
relation to the strategic and specific objectives, as well as the causal links between the different levels. 

Figure 1 - Intervention  Logic of the Framework Decision  2001/413/JHA 

Source: Authors’ elaboration 

The  strategic  objective  of  the  FwD  is  to  create  the  conditions  for  effective  investigation  and 
prosecution of fraud in and counterfeiting of NCP, in order to address two specific needs:  

21 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

 

ensuring security of all the parties involved in transactions based on non-cash means of 
payment; 
combating  fraud  and  counterfeiting  of  non-cash  means  of  payment  as  they  cause 
significant costs to the EU economy.  

The strategic objective has been operationalised into three specific objectives: 

  harmonising the scope of what should be considered a criminal offence; 
  making sure Member States take action to sanction offences;  
 

stimulating cross-border cooperation and the exchange of information.  

In order to allow Member States to achieve these specific objectives, the FwD includes key provisions 
(as  described  in  section  2.1.1)  with  activities to be implemented by Member States  and namely: 
specific  forms  of  conduct  to  be  criminalised,  conditions for the liability of legal persons, setting of 
penalties, defining principles for establishing jurisdiction, ruling cases of non -extradition, and defining 
rules for cross-border cooperation.  

The  correct  and  full  implementation  of  all  these  activities  is  directed  at  achieving  some  specific 
results,  namely: a reduction of frauds and counterfeiting of non-cash means of payment; an increased 
cooperation among MS; and an increased exchange of information. These results are instrume ntal to 
answer the needs expressed by all the parties involved in NCP.  

In the long term, the foreseen impacts of the provisions of the FwD are: an increased EU public trust 
in digital services and a strengthened EU digital single market.  

The achievement of these impacts is also affected by contextual factors such as: the reporting of the 
crimes to Law Enforcement Authorities (LEAs), public-private cooperation initiatives, and the level of 
protection granted to victims by the existing rules . 

2.2  EU and international  policy context 

A number of EU and international policies and legal acts frame the implementation of the FwD. 

2.2.1  EU policy context 

Since the 1990s, there have been ongoing efforts at the EU level to combat fraud and counterfeiting of 
payment cards and other non-cash means of payment. The proliferation of organised criminal groups 
involved in fraud offences and the parallel increase of victims complaining on their financial losses were 
causes of concern. These efforts have been directed at setting up a European framework to promote a 
secure environment for payment transactions relating to these specific types of instruments. Following 
the adoption of the FwD in 2001, this process has resulted in a range of relevant EU legal milestones 
which integrated/overlapped/strengthened the FwD, as described in the following.  

The  revised  2015  Payment  Services  Directive  2015/2366  (PSD2)  defines  a  comprehensive 
framework  for  the provision of payment services in the European Economic Area  (EEA). It aims at 
increasing the efficiency, transparency and security of all retail payments while ensuring Single Market. 
The  PSD2  defines  some  key  terms,45  sets  up  rules  for  authorisation  of  payment  institutions and 
payment transactions, and specifies the conditions for the liability of the services provider or payer. 
The PSD2 has replaced the Payment Services Directive 2007/64/EC (PSD1) which first defined some of 
the key terms included in the PSD2, in particular the “payment instrument”. 

The  2016  Directive  on  security  of  network  and  information  systems  (EU)  2016/1148  (NIS 
Directive) aims at enhancing the overall level of cybersecurity in the EU. It provides Member States 

45 It defines for instance the ‘payment instrument’ as personalised device and/or set of procedures agreed between 
the payment service user and the payment service provider and used in order to initiate a payment order.  

22 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

with  a  coordination  mechanism  to  support  a  swift  and  good  operational  cooperation  on  specific 
cybersecurity incidents and the sharing of information about risks. 

The  2013  Directive  on  attacks  against  information  systems  2013/40/EU  (EU  cybercrime 
Directive) introduces new rules for harmonising the criminalisation and penalties for a number of 
offences which result in attacks against information systems. It defines the liability of legal persons, 
the sanctions that may apply to these criminal offences and defines the ru les for cooperation between 
MS on the issues in scope. 

The  2012  Directive  establishing  minimum  standards  on  the  rights,  support  and  protection of 
victims of crime 2012/29/EU (EU Victims Directive) lays down minimum rules for the protection of 
victims of crime in order to allow them to be recognised and treated with respect and dignity, to be 
protected and supported, to have access to justice and to obtain compensation and restoration. 

The  2014  Directive  on  the  protection  of  the euro and other currencies against counterfeiting 
by criminal law 2014/62/EU establishes minimum rules for the definition of criminal offences and 
the sanctions for counterfeiting of the euro and other currencies. It requires MS to take the necessary 
measures  to  ensure that the legal persons are held liable for such offences and are punished by 
effective, proportionate and dissuasive criminal sanctions.  

The 2015 Interchange Fee Regulation (EU) 2015/751 sets uniform technical and business rules 
for  card-based  payment  transactions  carrie d  out  within the EU, where both the payer's payment 
service provider and the payee's payment service provider are located therein. It also introduces key 
terms relating to the payment card schemes and transactions. 

In  addition,  the  EU  has  adopted  a  number  of  policy  instruments  which  have  supported  the 
implementation of the provisions of the FwD, including:  

 

 

 

the  EU  Fraud  Prevention  Action  Plan  (FPAP)  for  the  period  2001-2003  aiming  to 
improve the prevention of fraud and counterfeiting of all NCP among the Member States, 
especially by extending the cooperation and exchange of information for investigation 
and  prosecution  between  the  competent  authorities  of  the  Member  States  and  by 
boosting the fraud prevention measures also in the third countries. The following FPAP 
2004-2007, pursues the same objective and promotes a more coherent approach to 
fraud prevention by fostering non-legislative measures; 
the  Single  Euro  Payments  Area  (SEPA),  an  initiative  of  the  EC,  the  European 
Parliament,  the  Council  of the EU and of the  European Central Bank (ECB) aimed at 
supporting  the  integration  of  the  euro  payments  market by developing harmonised 
payment  schemes,  frameworks  for  electronic  euro  payments  and  mobile and online 
payments; 
the 2013 EU Cybersecurity Strategy, aimed at identifying the high-risk areas in the 
information and communications technology area, working with the private sector to 
close  loopholes  created  by  cyber-crime  and  providing  specialised  training  to  the 
stakeholders involved. An important element of the Strategy is the creation of the EU 
Agency  for  Network  and  Information  Security  (ENISA)  which  brings  an  important 
contribution on cybersecurity issues. 

  Regulation (EU) 2016/679, repealing the Data Protection Directive 95/46/EC,46 the 
most recent legislation adopted at EU level on the protection of natural persons with 
regard to the processing of personal data and on the free movement of such data, with 
several exceptions, such as processing of personal data in the course of an act ivity which 
falls outside the scope of Community law and processing of personal data by competent 
authorities for the purposes of the prevention, investigation, detection or prosecution of 
criminal  offences  or  the  execution  of  criminal  penalties,  including   the  safeguarding 

46 Regulation (EU) 2016/679 of the European Parliament and of the C ouncil of 27 April 2016 on the protection of 
natural  persons  with  regard  to  the  processing  of  personal  data  and  on  the  free  movement of such data and 
repealing Directive 95/46/EC . 

23 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

 

against and the prevention of threats to public security (provisions covered by the new 
Directive (EU) 2016/680).47 
the 1957 European Extradition Convention, according to which the extradition shall 
be granted in respect to offences punishable under the laws of the requesting state party 
and of the requested state party by deprivation of liberty or under a detention order for 
a maximum period of at least one year or by a more severe penalty. Starting with 1 
January 2004, the Council Framework Decision 2002/584/JHA48 on the European 
arrest warrant (EAW) and the surrender procedures between Member States replaced 
the corresponding provisions of the Convention as far as extradition is concerned. The 
EAW  assures faster and simplified surrender procedures and the EU MS cannot longer 
refuse to surrender their citizens to another MS for committing a serious crime or for 
being suspected of having committed such a crime  solely on the of nationality. 
the  Convention49  on  Mutual  Assistance  in  Criminal  Matters  between  the  Member 
States of the European Union, setting up the conditions when the mutual assistance shall 
be  afforded, respectively in proceedings brought by the administrative authorities in 
respect of acts which are punishable under the national law of the requesting or the 
requested Member State, or both, by virtue of being infringements of the rules of law, 
and where the decision may give rise to proceedings before a court having jurisdiction in 
particular  in  criminal  matters  AND  in  connection  with  criminal  proceedings  and 
proceedings which relate to offences or infringements for which a legal person may be 
held liable in the requesting Member State; 

  Directive  2014/41/EU  on  the  European Investigation Order in criminal matters ("EIO 
Directive"), envisaging the principle of mutual recognition of judicial decisions in criminal 
matters. It allows MS to carry out investigative measures by the request of another MS 
based  on  mutual  recognition.  The  investigative  measures  in clude,  among  others, 
interviewing witnesses, obtaining information or evidence already in possession of the 
executing authority, interception of telecommunications, monitoring of bank accounts 
and  controlled  delivery.  The  deadline  for  the  transposition  of  the  EIO Directive into 
national legislation of MS is 22 May 2017; 

  Directive  (EU) 2015/849 on the prevention of the use of the financial system for the 
purposes of money laundering or terrorist financing 50 (the 4th AML Directive), aimed at 
strengthening  the  AML/CTF  rules  at  European  level  by  aligning  to  the  2012  FATF 
international standards. The Directive focuses on risk assessment and corresponding risk 
based  approach;  increased  transparency  of  the  beneficial  owners;  customer  due 
diligence waiver for certain e-money products; a new third country policy. 

  Regulation  (EU) 2015/847 on information accompanying transfers of funds completes 

this "legislative package". 

Finally, specialised structures have been established to contribute to the prevention and fight aga inst 
fraud and counterfeiting of non-cash means of payment in support of EU Institutions.51 

47 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data by competent authorities for the purposes of the 
prevention, investigation, detection or prosecution of criminal offences or the exe cution of criminal penalties, and 
on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA .  
48 C ouncil Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender 
procedures between Member States - Statements made by certain Member States on the adoption of the 
Framework Decision. 
49 Adopted by C ouncil Act of 29 May 2000 establishing in accordance with Article 34 of the Treaty on European 
Union the C onvention on Mutual Assistance in Criminal Matters between the Member States of the European Union 
(2000/C  197/01). 
50 Directive (EU) 2015/849 of the European Parliament and of the C ouncil of 20 May 2015 on the prevention of the 
use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) 
No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European 
Parliament and of the Council and Commission Directive 2006/70/EC . 
51 Among the most relevant ones: the EPC Card Fraud Prevention Task Force, established to develop tactical 
initiatives to fight against card fraud, to promote card fraud prevention tools and to monitor the implementation of 
security standards and procedures (such as Internet fraud, ID The ft); the EU Fraud Prevention Expert Group (FPEG) 
assisting the C ommission concerning its policy with regard to payment fraud prevention.  

24 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

2.2.2  International  policy context 

Also at international level, there are some key international conventions relating to the scope of the 
FwD and namely:  

  1957 European Convention on Extradition and its Additional Protocol;  
  1959 European Convention on Mutual Assistance in Criminal Matters and its Additional 

Protocol; 

  1981 Convention for the Protection of Individuals with regard to Automatic Processing of 

Personal Data, and its Additional Protocol; 

  2000  United  Nations  Convention  against  Transnational  Organised  Crime  and  its 

Protocols; 

  2001  Convention  on  Cybercrime,  also  known  as  the  Budapest  Convention  on 

Cybercrime. 

  2005 Council of Europe Convention on Laundering, Search, Seizure and Confiscation of 

the Proceeds from Crime and on the Financing of Terrorism. 

All the acts listed above set up the framework for cooperation in criminal matters and should be taken 
into  account  when  designing  future  policy  options for the prevention and fight against fraud and 
counterfeiting of non-cash means of payment. 

2.3  The non-cash  payments  industry   

The NCP industry is living a period of evolutionary  turmoil  due to the combination of different factors 
that, while bringing innovation and technology advances, create the need for adaptation and action in 
order to adequately manage the downsides of such evolution. 

The main drivers of the recent evolution in the NCP industry can be summarised as follows. 

  The  increase  in  the  number  and  types  of  players  and  a  diversification  of  their offering. 
The currently most innovative players did not originally offer payment-related solutions 
(e.g. Facebook, Apple, Google, Samsung, Amazon, and so on) but eventually entered 
the  global  market  with  disruptive  solutions.  This  trend has been supported, among 
others,  by  the  evolving  regulatory  scenario  which  progressively  extended  the 
authorisation  to  operate  in the payments industry.52Moreover, a growing number of 
start-ups  (e.g.  Fintech)  enriches  the  offering  of  NCP  products  and  services,  often 
disintermediating  the  traditional  players (i.e. financial institutions), which in turn are 
evolving their own offers to keep up with competitors. 

  The  growth  of  online  commerce53  and  the  “generation  Y  customers ”54  created  a 
subsequent  demand  for  immediacy  and  convenience,  dramatically  changing  the 
customers’  expectations  on  services  (Banking  Technology,  2017).  This  led  to 
developments  in  the  forms  of  value  transfer  and  in  the  use  of  traditional  payment 
instruments.  

  The spread of new enabling technologies . Innovative products like Mobile Points of Sale 
and the diffusion of technologies such as contactless 55 contributed to increasing the use 
of  cards  also  in  face -to-face  transactions,  while  creating  some  public  and  political 

52 With the introduction of PSD2, the authorisation to operate in the payments market has been extended to Third 
Party Providers thus increasing the level of competition and reducing the entry barriers. 
53 The European B2C online commerce market showed a double-digit growth in 2015: with a growth rate of 13.3% 
(2014: 13.6%), the online B2C sales in Europe reached €455.3 billion in 2015. The European B2C e-commerce 
turnover is forecast to reach the €500 billion mark in 2016 (€509.9 billion). Source: Ecommerce foundation 
(commissioned by Ecommerce Europe) (2016) – European B2C Ecommerce report. 
54 The Generation Y are the persons born approximately between the beginning of the 80’s and at least mid 90’s 
which has a high use and understanding of IT technologies and in particular the Internet and smartphones.  
55 At the end of 2015 there were 41% more contactless cards (i.e. 346 million) than in 2014, and by 2021 one in 
five cards will be contactless (in 2015 the relation was one to twenty) (Retail Banking Research, 2016). 

25 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

anxiety.56  With  regard  to  technologies  applied  to  mobile devices, the most relevant 
example  relate  to  the  spread  of  mobile  wallets,57  which  combine  Near  Field 
Communication technology with mobile devices (i.e. smartphones and tablets) used to 
virtualise and store payment cards or account information to be used as point of sales to 
make purchases.  

  The  appearance  of  new  payment  instruments.  The  use  of  virtual  currencies 58  (e.g. 
Bitcoin) has emerged in recent years,59 bringing issues when it comes to tracking and 
regulations,  given  that  “the  nature  of  virtual  currencies  is  difficult  to  apprehend,  the 
underlying  technology  is  complicated,  their  operations  are  conducted  in  a  decentralised 
way, and they are almost unregulated”  (Scheinert, 2016). This problem is exacerbated 
by the rapidly evolving nature of decentralised virtual currency technology and business 
models, including the changing number and types of participants providing services in 
virtual currency payment systems (FATF, 2014).  

  The evolution of the regulatory  scenario. For instance, the Regulation (EU) 2015/751 set 
new maximum caps for the commissions applicable on card payments, thus reducing the 
cost of such payment instruments for end users and incentivising their adoption. 

As  a  result  of  the  combination  of  all  previous  elements,  NCP  transactions  have  been  steadily 
increasing  in  Europe  over  the  last years, in both volumes and values  (European Central Bank, 
2016). Overall, the total volume of NCP transactions in the EU increased by 5.6% from 2013 to 2014 
and by 8.6% in 2015, for a corresponding number of 112.2 billion transactions.60 The total value of 
non-cash transactions in 2015 amounted to more than €276.9 trillion, +9% with respect to 2014. 

This  section  presents  an  overview  of  the  key  market  trends  relating  to  the  most important NCP 
instruments based on data and information gathered through the desk research. The Evaluation team 
relied mainly on ECB statistics on NCP transactions in order to have an overview of this industry at the 
EU level.61 For payment instruments not covered by EU level statistics the Evaluation team gathered 
anecdotal evidence. 

Table 3 Table 3 – Overview on market features and trends of the main NCP instruments highlights the 
market trend for each payment instrument. The symbol “?” indicates that no clear evidence is available 
to define a trend. Annex 3 presents details on each of them. 

Table 3 – Overview on market features and trends  of the main  NCP instruments 

NCP 
instruments 

Payment 
cards (e.g. 
credit and 
debit cards, 
commercial 
cards) 

Main market features  

Trend 

  The  most  used  non-cash  means  of  payment (47% of the total 

number of transactions in 2015) 

  Number of transactions is growing since 2000 at a high rate  
  Low share of value of transactions (0.93% of the total value of 

transactions in 2015) 

  Increasing differentiation of types of cards (e.g. commercial cards, 

56 Feedback from one Advisory Board member. 
57 Global mobile wallet market is expected to reach USD 3,142.17 billion by 2022, growing at a C AGR of 32% 
between 2017 and 2022. Source: Zion Market Research (2017) -Mobile Wallet Market (NFC, Remote Wallet) for 
Retail payments Vending machines Public transportation, Restaurants and other application. 
58 Virtual currencies (or virtual money) have been defined in 2012 by the ECB as "a type of unregulated, digital 
money, which is issued and usually controlled by its developers, and used and accepted among the members of a 
specific virtual community." In 2014, the EBA defined virtual currency as "a digital representation of value that is 
neither issued by a central bank or a public authority, nor necessarily attached to a fiat currency, but is accepted by 
natural or legal persons as a means of payment and can be transferred, stored or traded electronically".  
59 Interview feedback: one representative from LEAs and one from Academia. 
60 C omprehensive data for 2015 are not available yet.  
61 Specifically ECB statistics cover: card payments with cards issued by EU28 Payment Service Providers, credit 
transfers/wire transfers, direct debits, e-money transactions and cheques, plus additional “other payment services” 
(for which no clear definition is provided in official documents). 

26 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

NCP 
instruments 

Main market features  

fuel cards, etc.) 

Trend 

Credit 
transfers/Wir
e transfers 

  Number of transactions steadily growing since 2000 
  Highest share of value of transactions (93.3% of the total value of 

transactions in 2015) 

  Expected  future increase in the importance of non-cash money 

remittance services. 

  Number of transactions overall steady from 2011 to 2015. Only 

+2% CAGR 

Direct debits 

  Value of transactions decreasing sharply (around 3% of all non -

Cheques 

Bills62 

Meal 
voucher/Tick
ets 
restaurant 

Coupons 

Fidelity/Loyal
ty cards 

cash transactions value) 

  The average ticket of the transactions is decreasing in value  

  Number  of transactions constantly  decreasing since 2000 (-9% 

CAGR 2011-2015) 

  Also transaction value decreased by a CAGR of 11% from 2011 to 

2015) 

 

  Market  is  growing  thanks  to  digitalisation  and  policies  for 

employees benefits 

  Paper tickets still represent the vast majority of the market 

  Coupons usage is growing, however figures are limited  
  Mobile coupons growth rate is outpacing traditional paper coupons 

one 

  Two-thirds  of  people  in  Europe  belong  to  one  or  more   loyalty 

program 

  Number  of  transactions  grew  at  a  CAGR  of  17%  from 2011 to 

2015 

e-money 

  The  growth  is  linked  to  the  spread  of  prepaid  payment 

Virtual 
currencies 

Mobile 
money  

instruments 

  Lowest share of transactions value (0.03% of total value of NCP)  
  Emerging phenomenon but limited knowledge on its scale; 
  Bitcoin  is  the  most  widely  used virtual currency and its market 
capitalisation at the end of 2013 was around US$5.3 billion  
  Mobile money are projected to grow, mainly as a consequence of 
the growth of digital contents purchasable through carrier billing  

Source: Authors’ elaboration based on desk research   

- 

? 

? 

62 No information is available to assess market features and trends in the use of bills.  

27 

 
 
 
 
 
 
 
 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

PART I – EVA LUA TION  REPORT   

3 

IMPLEMENTA TION  STA TE  OF PLA Y  

This Chapter provides evidence on the implementation state of play of the FwD. The findings will be 
used to evaluate the FwD according to the evaluation criteria in section 4. 

3.1  Non-cash  payments  frauds 

Table 4 provides an overview of the security issues and trends in frauds related to each instrument. 63 
The symbol “?” indicates that no clear evidence is available to define a trend. Details on frauds for 
each instrument are presented in section 4.3. 

Table 4 – Overview of security issues relating  to the main  NCP instruments 

NCP instrument  Main security issues 

Trend 

Payment 
cards 
(e.g. 
credit and debit 
cards, 
commercial 
cards, 
cards) 

fuel 

Credit 
transfers/Wire 
transfers 

Direct debits 

Cheques 

Bills 

  Overall  increase  in  card  frauds in  number and value (€1.44 billion in 

2013, +8.1% from 2012). 

  Frauds relate mainly to card-not-present transactions (66% of the total 
value  of  frauds  on  cards  issued  within  Single  Euro  Payments  Area 
(SEPA)  in  2013)  and  cross-border  transactions  (51%  of  all  ca rd 
fraudulent transactions in 2013). 

  European cardholders benefit from higher security standards in relation 
to card transactions if compared with extra -SEPA countries cardholders. 
  Increasing trend of fuel card fraud. This fraud is easier to detect than 

frauds on other types of cards. 

  Methods: Counterfeiting through skimming devices placed in POS/ATMs 
(for corporeal cards) and through data breaches, illegal interception of 
computer  data  and  social  engineering  (for  non-corporeal  cards). 
Purchase  of  cards  data  on  carding  websites  to  be  used  for  online 
purchases  or  to  manufacture  counterfeit  payment  cards.  Card -not-
received  and  lost/stolen  cards  are  additional  techniques  relating  to 
corporeal cards. With regard to mobile wallets, stealing mobile phones 
or using specific malwares seem to be the most used fraud method. 
  Transfers particularly subject to fraud and several websites subject to 

vulnerabilities 

  Some  specific  fraud  techniques  are  used  in  relation  to  money 
remittance (e.g. the mystery shopper, the vehicle purchase scam, false 
lotteries,  the  relative  in  need  scam,  charity  scams,  etc.).  However 
money remittance is mainly relating to cash transactions. 
  Methods:  Social engineering (e.g. phishing), money muling. 
  Frauds likely to rise as the use of SDD increases  
  Typically  stolen  small  amounts of money so that the victim does not 

immediately realise it 

  Methods:  Social engineering 
  Frauds are expected to decrease, given the decrease in the usage of 

cheques 

  Methods:  Counterfeit, forged or fraudulently altered cheques  
  Frauds are expected to decrease  
  Methods:  Counterfeit, forged or fraudulently altered bills of exchange  

63 The lack of comparable information on financial effects of frauds did not allow the Evaluation team to rank 
payment instrument frauds according to their economic relevance. 

28 

 
 
 
 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Trend 

? 

? 

NCP instrument  Main security issues 

Meal 
vouchers/Ticket 
restaurant 

Coupons 

Fidelity/Loyalty 
cards 

  Some  anecdotal  evidence  relating paper ticket counterfeiting but no 

overall statistics 

  Methods:  Counterfeiting relating to the corporeal dimension 

  Frauds with coupons seem to increase, mainly due to digital distribution 

of vouchers 

  Methods:  Counterfeit, fraudulent or multiple redemption (e.g. through 

illegal reproduction) 

  No overall statistics on growth or decrease of fidelity/loyalty cards only 

some isolated cases 

  Methods:  Loading points from cloned magnetic stripes of other loyalty 
cards. Illegal loading of loyalty points by a staff member of the store or 
illegal gaining of loyalty points breaking the loyalty scheme rules  

E-money 

  Fraud trends not clearly extractable from ECB fraud report 
  The Evaluation team conveyed that they are likely to be similar to card 

fraud trends and thus increasing 

Virtual 
currencies 

  Methods:  same as payment cards for e -money cards (prepaid cards) 
  Frauds likely to rise as the use of virtual currencies increases 
  Greater anonymity in transactions than traditional non-cash payment 

methods 

  Segmentation of services makes the responsibility of frauds unclear. 
  Methods:  Social  engineering  (e.g.  scams),  illegal  interception  of 

computer data 

Mobile money 

  Currently an unattractive target for fraudsters given the existence of 

multiple security levels 

  Mobile money frauds will likely increase in the future since digital goods 

? 

are projected to rise  

  Methods:  Phishing, stealing SIM cards or mobile phones  

Source: Authors’ elaboration based on desk research 

EQ3: What is the significance and evolution of identity theft?  

Identity  theft  and  NCP  frauds  seem  to  be  strictly  correlated.  Information  relevant  to  the 
identification of a real person is often used by criminals to commit fraud  and other financial crimes 
(European Commission, 2012). Non-cash means of payment are particularly exposed to this risk due 
to the vulnerabilities relating the collection and storage of personal datainherent to these means. Some 
issues could emerge also as concerns the identification of customers or clients: many transactions are 
conducted between individuals who are strangers to each other or even on a non-face to face basis. 
This easily results in an asymmetry of the information available to the parties, which may turn into an 
advantage for the fraudsters (Fraud Prevention Expert Group, 2007).  

Documents reviewed by the Evaluation team show that identity theft is mainly related to payment card 
fraud. This can be explained by the fact that cards are the most frequently used NCP instrument, and 
most  of  the  NCP  frauds  concern  payment  cards  (see  section  2.3).  However,  it  is not possible to 
conclude that payment cards are the payment instruments, which lead more frequently to identity 
theft. Individuals’ identity data such as PINs and security codes are indeed not easily accessible and 
may represent a barrier to fraudsters, especially in card -not-present transactions. 

Additional risks could arise wherever the identity chain management is fragmented among different 
actors, multiplying in such a way the transmission channels through which data circulate, and thereby 
increasing the risk of bugs. In the 2004 Action Plan on payment fraud prevention, identity theft was 
already highlighted as a growing issue together with the need to strengthen business and consumer 
confidence in the use of non-cash means of payment (European Commission, 2004). 

29 

 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

It  is  hard  to  quantify  volumes  and  values  of  identity  related crimes.  The main reason of such 
difficulty  is  the  lack  of  a  common  definition  for  identity  theft.  The  definitions  of  “identity  theft”, 
“identity fraud” and “identity-related crimes” seem to be blurred and, in some countries, they are used 
as synonimous (Fraud Prevention Expert Group, 2007). This reflects in poor data and subsequently in a 
distort  perception  of  the  scale  of  the  problem.  Statistics  often  do  not  provide  a  clear  picture  of 
“victims” that either covers individuals, governments, international organisations, business and/or 
industry, or the economy as a whole and do not measure the same types of frauds or crimes, raising 
issues of data comparability (OECD, 2008). Moreover, it seems that crimes relating to identity theft are 
usually reported to financial institutions rather than law enforcement or police . Victims often report 
suspicious bank accounts’ movements to their financial institutions  without beign aware they have 
been targeted by criminals or they just refuse to admit it (European Commission, 2012). A third aspect 
that further complicates the quantification of identity related crimes is the reluctance of companies and 
businesses to share data on cybercrime attacks, since they are afraid of undermining their reputation 
losing potential business opportunities and drawing attention on the weak points of their information 
systems.64 

Despite the threat,65 online shopping and NCP transactions continue to grow (2.3). In this respect, 
protection measures offered by commercial platforms such as Amazon and eBay are definitely useful to 
maintain the overall confidence in the digital single market (see Box 1). 

Box 1 – Examples of protection  offered by commercial  platforms 

E-commerce traders adopted solutions to assure consumers that their purchases are secured. For 
instance, Amazon offers a guarantee for the purchases from third-party sellers when payment is 
made via the Amazon.com website or when the customer uses Amazon Pay for qualified purchases 
on  third-party  websites.  “Customers  who  pay  for  purchases  from  an  Amazon  seller  via  the 
Amazon.com  website  are  eligible  to  receive  up  to  USD  2,500  of  the  purchase  price,  including 
shipping charges” (Amazon, 2017). 
Similarly,  when activated by the consumers eBay Buyer Protection allows eBay the right to intervene 
and resolve disputes between buyers and sellers. eBay also provide consumers with guidelines to 
recognise if their eBay account has been stolen (Hsiao, 2016).  

Source: Authors’ elaboration based on desk research 

there  is  an  increasing  tendency  of  cybercriminals  to  prefer  large  enterprises  to  small 
businesses  (less than 250 employees). In 2015, 43% of cyber-attacks via spear-phishing66 targeted 
small  businesses,  22%  medium  companies  and  35%  large  enterprises  (Symantec,  2016).  Spear 
phishing is growing faster than the traditional phishing and is expected to further increase in the next 
years  thanks  to  the  refinement  of  phishing  tools  and  services  (e.g.  organised  crime  groups  are 
increasingly  recruiting  native  speakers  in  order  to  raise  the  quality  of  phishing  emails)  (Europol, 
2016b). At the same time, there are also cases of Member States where phishing attacks have started 
to  decrease  (see  Box  2).  Evidence  from  stakeholders consulted along the study gave insufficient 
explanation for the reasons behind these trends. However, it can be reasonably assumed that they 
may be linked to an increased awareness of individuals of these fraud techniques and to subsequent 
behavioural changes (Williams, 2015). 

64 C ompanies choosing not to report the number of records lost increased by 85% in 2015 (Symantec, 2016). 
65 2nd EGM feeback: some representatives from both the public and the private sector highlighted the increase of e -
commerce fraud. 
66 Phishing attempts directed at specific individuals or companies . 

30 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Box 2 – Examples of Member States with decreasing  trends of phishing  attempts 

The  Netherlands  and  the  UK  have  been  reducing  phishing  attacks  in  the  last  years.  In  the 
Netherlands, losses caused by phishing techniques amounted to €11,5 million in 2012, decreased to 
€4,7  million  (60%)  in  2013,decreased  to  €3,9  million  in  2014  and  to  €3  million  in 2015 (Dutch 
Payment Association, 2015). In the UK, the total number of phishing websites targeted against 
banks and building societies fell from 256,641 to 26,995 (90%) in 2013 and continued to decrease 
in 2014 and 2015, falling to 16,462 (Financial Fraud Action UK, 2016).  

Source: Authors’ elaboration based on desk research 

Large companies suffer an average higher number of attacks per organisation than small and medium 
companies (3.1 compared to 2.2 and 2.1 for medium and small companies respectively). Most of the 
attacks focuses on harvesting banking and credit card credentials  (Symantec, 2016).  

Among phishing techniques, the  Chief Executive Officer (CEO) fraud appears one of the most used 
method  while  pharming  seems  to  be  on  the  rise. The first technique leverages false identities to 
commit frauds: criminals target senior staff to take advantage of organisational hierarchies and of 
junior  staff  who  are  less  likely  to  challenge  senior  management  (Europol,  2016b). Pharming is a 
variant of phishing (Europol, 2014b): instead of relying completely on users clicking on an enticing link 
in fake email messages, it re -directs victims to the bogus Web site even if they type the right Web 
address 67, thus making, pharming scams more difficult to detect. Furthermore, since they eliminate 
the need for “bait” emails they are potentially more dangerous than other techniques and can hit a 
wider population of victims, affecting many more users at once .68 Despite pharming is not currently as 
common  as  traditional  phishing,  security  experts  predict  that   pharming  attacks  will  continue  to 
increase.69 

Money  muling can be linked to identity theft, given that “through the money mules, the criminals 
gain access to the stolen goods or funds without revealing their identity”.70 Therefore, criminals use 
someone else’s identity in order to wire illegally obtained funds from a bank account to another. Money 
mules may act consciously or unwittingly but they can be prosecuted in either case.71 

The widespread access to the Internet increased the risk for individuals and companies to become 
victims of identity-related crimes. People increasingly provide personal data on the Internet and store 
sensitive information when using online banking, e -Commerce and e-Government services. Carding 
w ebsites have further broadened the impact of the Internet in identity-relate crimes. These websites 
function as illegal marketplaces where personal information linked to payment instruments are sold to 
carders. Selling cards data and personal information o n carding websites allow s criminals to reach a 
higher number of potential customers, even though time is needed for these website to build their 
“positioning” on the illegal market.72 Such websites represent a controversial phenomenon. Shutting 
them down does not seem to bring great advantages given that administrators can easily open a new 
website under a new domain: this is one of the factors that makes it eas y for criminals to operate in 
the darknet. As shown in a CNN movie ,73 there could be more chances of catching criminals by letting 

67 http://securityresponse.symantec.com/norton/cybercrime/pharming.jsp 
68 In pharming, very little social engineering is needed, except to take advantage of the typical user's lack of 
suspicion about small differences in the website experience . Even phishing-savvy web users could fall victim to a 
pharming scam without realising it. 
69 http://www.hoax-slayer.net/pharming-information-about-pharming-scams/ 
70 https://www.europol.europa.eu/newsroom/news/europe-wide-action-targets-money-mule-schemes 
71 http://www.actionfraud.police.uk/fraud-az-money-muling 
72http://espresso.repubblica.it/visioni/2014/06/17/news/carding-viaggio-tra-i-trafficanti-di-carte-di-credito-del-
web-nascosto-1.169689 
73 https://www.youtube.com/watch?v=-1sjtjqTmYk 

31 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

the carding website operate and getting in contact with the carders community (by pretending to be 
part of it and participating in encrypted chats), eventually tracking some of them down. 

The  growing  impact  of  the  Internet  o n  identity  related  crimes  is  reflected  by  the  progressively 
increasing infringements of data protection laws (Symantec, 2016).  

Box 3 – Recent trends  in personal data breaches 

There is evidence of an increasing trend in personal data breaches at both EU and national level. 
Worldwide,  1,673  personal  data  breaches  led  to  around  707  million  data  records  being 
compromised during 2015 (GEMALTO, 2015). However, real figures are likely to be higher given the 
only  partial  disclosure  of  breaches  experienced by companies. The most affected industries by 
personal data breaches were: 

  governmental sector with 43% of the total compro mised data records; 
  healthcare sector with 19% of total compromised records and 23% of all data breaches; 
 

financial services sector with 0.1% of total compromised data records and 15% of the total 
number of breaches;  
retail sector accounted for 6% of compromised records and 10% of the total breaches in 
2015. 

 

As for the national level, , in Ireland the Office of the Data Protection Commissioner74 is dealing with 
an increasing number of queries (14,427 queries received by email75 in 2015 compared to 13,500 in 
2014 and 12,000 in 2013). This brought to a high number of complaints (932 in 2015 compared to 
960 in 2014). Around 60%reflected the difficulties that some individuals experience in the exercise 
of their “right of access”. The second most frequent type of complaints concerned electronic direct 
marketing76 (around 11%).  
Over 54% of total data breach notifications received in 2015were unauthorised disclosures such as 
postal  and  electronic  disclosures,  the  majority of which occurred in the financial sector. Typical 
examples of data breaches include inappropriate handling or disclosure of personal data (e.g. third -
party access to personal data) and losses of personal data held on laptops and computers.  
According  to  the  Information  Commissioner  annual  report,  603  complaints  and  allegations  of 
mishandling  sensitive  information relate to banks . However, the true scale of privacy and data 
breaches in the UK could be higher, since the private sector is not obliged to report complaints t o 
the Information Commissioner.77 

Source: Authors’ elaboration based on desk research 

3.2  Level of transposition  of the Framework Decision78 

EQ4:  What  is  the level of transposition and implementation of the Framework Decision in EU Member 
States? 

74 The Office of DPC is an independent body that derives its power and authority from the Data Protection Acts 1988 
and 2003, which hears the complaints of individuals who believe that their data protection ri ghts have been 
contravened. It requires the safe collection, storing and processing of ind ividuals’ personal information (Dixon, 
2015)(Dixon, 2015). 
75 The Office of DPC received also 16,173 queries by phone, and 855 queries by post. 
76 These are investigated under the Privacy in Electronic Communications Regulations; SI 336 of 2011.  
77 Under the EU General Data Protection Regulation (GDPR), the notification of data breach becomes mandatory in 
cases where there is a high risk to affect the rights and freedoms of the natural person in order to allow him or her 
to take the necessary precautions. The data processors will be required to notify without undue delay after 
acknowledging about the data breach their data controllers. Moreover, the data controllers will also have to notify 
the data protection supervisory authority after become aware of the data breach, but within the limit of 72 hours. 
Please see: GDPR Portal: Site Overview (http://www.eugdpr.org/eugdpr.org.html). 
78 This analysis does not substitute the notification of the tra nsposition of the FwD to the C OM. 

32 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Definition of payment instruments 

All  MS  have  transposed  the  definition  of  payment  instrument  of  the  FwD  (see  section  2.1.1) 
and national  legislation  cover all the main  corporeal payment  instruments  (see Table 5). 

Table 5 - EU/national  legislation  coverage of payment  instruments79 

Source: Authors’ elaboration based on the analysis of national  legislation 

All MS cover also non-corporeal forms of payment instruments mentioned in the FwD (namely cards) 
and other NCP instruments that are not explicitly mentioned in the FwD and that can be both corporeal 
and non-corporeal (e.g. fidelity/loyalty cards, wire transfers, direct debits, ticket restaurant). There is 
mixed  evidence  with  regard  to  coupons .  Most  of  MS  definitions cover only personalised payment 
instruments, thus leaving out coupons in case they are not personalised. In other cases, like Finland, 
that also means for which no personalisation is required (e.g. some types of coupons) are consider as 
payment instruments .80 

Mobile money and e-money are currently considered payment instruments by all national legislation, 
since MS (except FI, IE, and LV) have transposed - most of the times literally - the PSD181 definition 
that  included  these non-corporeal forms of payment.82 In some cases, MS went beyond the PSD1 
definition and adopted a wider approach, with eight MS83 covering also virtual currencies. Finally, FR 
has a wider definition of payment instruments84 that can be used alternatively or cumulatively with the 
PSDs definition 

79 A NC P instrument is “covered” when specifically mentioned in the national legislation or in case of a wider 
definition that includes it, it “seems uncovered” when the legislation seems not to include it, it is “unclear or 
partially covered” when the legislation is not specific enough to determine with certainty whether the NCP 
instrument is fully covered in all its forms (e.g. corporeal forms). 
80 In the FI C riminal Code: means of payment refers to bank cards, debit cards, credit cards, cheques and other 
objects and records which can be used in payment or for withdrawals or account transfers, or the use of which is 
essential for this purpose. 
81 PSD1 definition of payment instrument is identical to the one included in the PSD2 and in the Directive 
2015/2366. 
82 The scopes of the payment service directives are narrower than the one of the PSDs definition of payment 
instrument as the directives include a list of limitations of scope. In this section of the report, the Evaluation team 
takes in consideration the PSDs definition of payment instruments alone, without the list of limitations of the 
directives, as it has been transposed in the national legislation.  
83 BE, BG, DE, EE, FI, FR, LV, MT.   
84 In the FR Monetary and financial code: any instrument which enables any person to transfer funds shall be 

33 

PAYMENT INSTRUMENTSFwDATBEBGCYCZDEDKEEELESFIFRHRHUIEITLTLULVMTNLPLPTROSESISKUKcoveredMainly corporealCheques, travellers’ cheques and bills of exchangecoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcovered28Payment cardscovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercovercover28Fidelity/ loyalty cardscoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredunclearcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcovered27Wire transfer - Direct debitcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcovered28Ticket restaurantcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcovered28Couponsunclearunclearunclearunclearunclearunclearunclearunclearunclearunclearcoveredcoveredunclearunclearunclearunclearunclearunclearunclearunclearunclearunclearunclearunclearunclearunclearunclearunclear2Mobile moneycoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcovered28Virtual currenciesnot covercoveredcoverednot covernot covercoverednot covercoverednot covernot covercoveredcoverednot covernot covernot covernot covernot covernot covercoveredcoverednot covernot covernot covernot covernot covernot covernot covernot cover8e-moneycoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcovered28coveredseems uncoveredunclear or partially coveredCan be corporeal and non corporealExplicitely mentionedNon mentionedNon-corporeal only 
 
 
                                                 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Criminal offences 

Overall,  criminal  conduct  included  in  the  FwD  is  criminalised  in  most  MS  with  few 
exceptions.  Only  12  MS85  have  fully  transposed  the  FwD,  and  therefore  criminalised  all  conduct 
hereby included. Other 15 MS86 have criminalised most of the offences of the FwD (see Table 6). 

Table 6 - EU/national  legislation  coverage of criminal  offences87 

Source: Authors’ elaboration based on the analysis of national  legislation 

The  FwD  had  a  different  effect  on  national  legislation  depending  on  the  MS.  While  some 
countries (e.g. DE and FR)88 were already sanctioning the offences included in the FwD, some others 
had to update their national legislation through measures included in the Criminal Code and/or other 
special laws. For instance, LT and LV have introduced specific provisions and PT revised its criminal 
law.  

The  mental  element,  and  namely  the  fact  that  the  fraudster  needs  to  commit  the  offence 
intentionally in order to be criminalised, is fully transposed in all MS. 89 25 MS use the term “intention”, 
and BG, FR and PT extend criminalisation also in cases of “knowledge 90”. 

National  legislation  has  provisions  covering  the  counterfeiting  and  falsification  of  payment 
instruments  (Art.  2  –  (b)).  The  only  exception  is  SE  that  covers  only  the  falsification but not the 
counterfeiting.91  

deemed to be a means of payment, regardless of the medium or the technical process used.  
85 BE, C Z, DE, EE, ES, FI, FR, IT, NL, RO, SI, SK. 
86 AT, BG, C Y, DK, EL, HR, HU, IE, LT, LU, LV, MT, PL, PT, UK. 
87 An offence is “covered” when specifically mentioned in the national legislation or in case of a wider definition that 
includes it, it “seems uncovered” when the legislation seems not to include it, or it is “unclear or partially covered” 
when the legislation is ambiguous or not specific enough to determine with certainty whether the offence is fully 
covered. 
88 For instance in France, such offences were already covered by the  national legislation (law on “escroquerie”). The 
Implementation report 2004 says that in France (escroquerie), the fraudulent use is punishable under legal 
provisions covering fraud in general. This has been confirmed by one interview feedback from a representative from 
LEAs. 
89 Analysis of national legislation summarised in the Transposition Tables.  
90 Knowledge, intent or purpose required are the subjective elements of a criminal intent. The intentional element is 
proved when the criminal had the intention to cause a certain result or the defendant acted with knowledge that 
his/her conduct was illegal. 

34 

FwDATBEBGCYCZDEDKEEELESFIFRHRHUIEITLTLULVMTNLPLPTROSESISKUKcoveredTheft and unlawful appropriation of payment instrumentcoveredcoverednot coverednot coveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoverednot coverednot coveredcoveredcoverednot coveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcovered23Counterfeiting and falsification of a payment instrumentcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredunclearcoveredcoveredcovered27Possession and transfer of unlawfully appropriated payment instrumentscoveredcoveredcoverednot coveredcoveredcoveredcoveredcoverednot coveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredunclearcoveredcoveredunclearcoveredcoveredcoveredcoveredcoveredcoveredcoveredcovered24Fraudulent use of unlawfully appropriated payment instrumentscoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredunclearcoveredunclearcoveredunclearnot coveredcoveredcoveredcoveredunclearunclearcoverednot coveredcoveredcoveredcovered21Offence related to computercoveredcoveredcoveredcoveredcoveredcoveredunclearcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredunclearcoveredcoveredunclear25Offences related to specifically adapted devicesunclearcoveredcoveredcoveredcoveredcoveredunclearcoveredunclearcoveredcoveredcoveredcoveredcoverednot coveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredunclearcoveredcoveredcovered23Participation, instigation and attemptcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcoveredcovered28coveredseems uncoveredunclear or partially covered 
 
 
                                                                                                                                                              
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Participation,  instigation  and attempt  (Art. 5) are covered in all MS. Almost all MS (25) cover the 
offences relating to computers (Art. 3). Out of these, four MS (BE, HU, NL, PL) go beyond the FwD 
and include also offences that do not necessarily result in a loss of property. The remaining three MS 
(DK,  SE, UK) cover only a part of the conduct described in the FwD provision.92 

The offences relating to specifically adapted device  (Art. 4) are covered by most of the MS (23). 
IE does not cover this provision. AT, DK, EL, SE cover it only partially with for instance AT not covering 
“instruments”, and DK not covering “computer programmes” and “instruments”. 

Almost all the MS (23) cover these offences regarding the possession, transportation and sale of 
an unlawfully appropriated, counterfeited or falsified payment instrument (Art. 2 – (c)). CY and EL do 
not  cover  this  offence,  LT  covers  it  only for electronic payment instruments , and SE and MT have 
transposed it only partially.93  

Most national legislation (23) covers also theft and misappropriation  of payment instruments (Art. 2 
– (a)). Most of these MS (17)94 do not refer specifically to payment instruments in the description of 
the  offence  and  adopt  a  broader  scope ,  which  may include them. For instance in France, theft is 
defined by the French Criminal Code (Art. 311-1) as the fraudulent appropriation of a thing belonging 
to another person. National legislation of these MS covers the current scope of the FwD and is likely to 
include also future forms of payment given the wide definition adopted. Few MS (CZ, LV) specify that 
their legislation on theft applies to payment instruments. However, since their definition covers more 
payments instruments than the ones indicated in the FwD, they also adopted a broader scope. 

The situation is more diversified for the fraudulent use of payment instruments (Art. 2 – (d)) with 21 
MS  covering  it  and  seven  MS95  adopting  a  general  approach  without  a  specific  reference  to  the 
“payment instrument”. In these last cases, the fraudulent actions refer to currency or money, legal 
tender, cheques, acts, writings, instruments or docume nts or something of which another has been 
dispossessed (e.g.).96 

Legal person liability 

Most  of  the  MS  (21)97  have  fully  transposed  the  FwD  provision  relating  to  the  liability  of 
legal  persons  (Art.  7).  Seven  MS  do  not  include  the  criminal  liability  of  the  legal person  (DE, 
IT, BG, LV and NL),98 the categories of persons who can trigger the liability (CY),99 or the conditions for 

91  The analysis took into consideration the difference between the terms of falsification and counterfeiting. The 
falsification  requires  that  a  payment  instrument  is  modified,  altered,  in  order  to  become  false ,  while  the 
counterfeiting refers to making a copy of the original, thus becoming entirely falsified. 
92 DK (missing “without right introducing, altering, deleting or suppressing computer data, in particular identification 
data”  or  “without  right  interfering  with  the  functioning  of  a  computer  programme  or  system”);  SE  (missing 
“introducing,  altering,  deleting  or  suppressing  of  identification  data”  and “interfering with the functioning of a 
computer programme or system”); UK (missing the reference to loss of property and “introducing, altering, deleting 
or suppressing of identification data”). 
93 LV legislation does not cover “preparing” and “obtaining”. Polish legislation covers only certain corporeal 
instruments: Polish Criminal Code, C hapter 37, Art. 310 (1): “document serving as a legal title for a sum of money, 
or containing an obligation to pay out capital, interest, share of profits, or certifying business participation in a 
company. SE legislation does not cover counterfeited payment instrument.  
94 BE, DE, DK, EE, EL, ES, FI, FR, IE, IT, LU, MT, PL, RO, SE, SI, SK, UK. 
95 C Y, IE, EL, MT, PL, PT, SE.  
96 Polish C riminal Code, C hapter 37, Art. 310 (1): “document serving as a legal title for a sum of money, or 
containing an obligation to pay out capital, interest, share of profits, or certifying business participation in a 
company”.  
97 All MS except BG, C Y, DE, IT, LV, NL, PT. 
98 In DE, when talking about liability of a legal person, only regulatory fines are imposed on Legal Persons and on 
Associations of Persons, according to the Act on Regulatory Offences. In IT, the Legislative Decree 231/2001 
introduces the principle of administrative liability for crimes committed by executives and employees of companies, 

35 

 
 
                                                                                                                                                              
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

liability of legal persons (PT).100 Three MS (FR,  ES, and RO) have a broader definition of “legal person” 
and wider criteria used nationally to define persons that can trigger liability, thus extending the cases 
where  a  legal  person  is  considered  liable  for  the  criminal offences . . For instance, while the FwD 
definition of legal person excludes “States or other public bodies in the exercise of State authority and 
for public international organisations ” (Art.1-(b)),  the French and Romanian legislation considers public 
authorities to be legal persons and therefore liable fo r offences committed by natural persons for the 
benefit of the legal entity.101 With regard to persons that can trigger liability, the Spanish legislation 
goes beyond the scope of the FwD which is restricted to specific positions inside the legal entity, and 
extends  liability  for  legal  person  to  all  cases  where  the  offence  is committed in the course of its 
business and on its behalf and for its benefit, whoever corresponding to these criteria commits the 
offences.  

In terms of application of sanctions, all 28 MS have transposed Art. 8 of the FwD on sanctions for 
legal persons. Nine MS102 have implemented all sanctions indicated in the FwD and 10 MS103 almost all 
of them. Three MS (ES, LV and PT) impose administrative measures rather than fines. 

Penalties 

Before  presenting the comparative analysis of national penalties for the FwD offences, it is worth 
mentioning some limitations and namely:  

  National laws have defined the FwD forms of conduct in many different ways, making it 

difficult to compare related penalties; 

  As stressed by stakeholders, 104 national levels of penalties are not harmonised between 

MS; 

  Comparability  is  further  limited  since  national  laws  often  add  conditions  and 

 

circumstances non covered by the FwD;  
Information  on  fines  was  difficult  to  retrieve  from  national  legislation  and  when  an 
indication was provided it was difficult to understand the rationale for their application .  

In view of the difficulties mentioned above the Evaluation team chose to  perform an in-depth analysis 
of penalties and: 

including IT crimes. In NL, the only provisions regarding the liability of legal person refer to the possibility for 
natural and legal persons to commit a criminal offence but there is no specific provisions stating that the legal 
person is criminally liable. According to the law, if a criminal offence is committed by a legal person, criminal 
proceedings may be instituted and such punishments and measures as prescribed by law, where applicable, may be 
imposed on the legal person. According to the Bulgarian legislation (art. 35 of the Criminal Code), the criminal 
responsibility is personal. A punishment may be imposed only on a person  who has committed a crime provided for 
by the law. There is no defined law that directly impose liability/blame on a legal person. In Latvia, a natural person 
who has committed a criminal offence acting in the interests of a legal person governed by priva te law, for the 
benefit of the person or as a result of insufficient supervision or control thereof shall be held criminally liable, but 
the legal person may be applied the coercive measures provided by the law. 
99 All the members of the board of directors or management or the council which deals with the legal person's 
business and the General Director or director or managing Director of the legal persons are criminal liable . 
100 The Portuguese criminal code states that collective entities rarely have criminal responsibility, except in cases of 
embezzlement (i.e. in case the fraudster had been entrusted the fraudulently acquired assets) , and in other 
situations that are not relevant in the scope of the FwD. 
101 Specifically, the French Criminal code provides for the criminal liability of the local public authorities and their 
associations when the offence has been committed in the course of their activities. The Romanian Criminal code 
states that public institutions cannot be held criminally liable for offences committed in the performance of activities 
which cannot be the object of the private domain, meaning that, in addition to what is provided by the FwD, the 
Romanian public institutions can be held criminally liable when they perform activities which can be the object of 
the private domain. 
102 C Y, C Z, FR, HR, IT, MT, RO, SI, SK. 
103 BE, DE, EE, EL, HU, LT, LU, PL, SE, UK. 
104 Validation Focus Group feedback: one participant. 2nd EGM feedback: some representatives of the Private sector. 

36 

 
 
                                                                                                                                                              
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

 

 

identify  for  each  FwD  offence  the   definition  of  the  standard  conduct  and  the 
corresponding  minimum  level  of  maximum  penalties;  an  analysis of the aggravating 
circumstances  was  prepared  based  on  the  information  on  the  types  of  conduct 
incriminated in the national legislation (i.e. organised crime related to theft and fraud, 
qualified theft) and penalties levels (where indicated by the criminal laws);  
focus the analysis on imprisonment (rather than fines) in order to ensure a higher level 
of comparability of MS and a sounder ground for conclusions . 
analyse  the  maximum and the minimum number of years of imprisonment set by MS 
and  identify  the  average maximum/minimum level of penalty for the specific offence. 
Based  on  these  values,  to  calculate  the  coefficient  of  variation 105  of  the  maximum 
number of years of imprisonment for each offence and consider it as an indicator of the 
proportionality of the penalties at EU level.106 

Overall,  criminal  conduct  defined  by  the  FwD  is  punished  through  specific  penalties  in  most 
of the MS. Exceptions include MS not covering: theft of payment instruments (five), the fraudulent 
use of payment instruments (four) and offences relating to specifically adapted devices (one).  

All MS include penalties involving deprivation of liberty (such as imprisonment). 

As regards penalty proportionality, the Evaluation team identified high coefficients of variation 107 and 
subsequently a poor level of proportionality. This conclusion should however be taken cautiously since 
there is a large variety of national legal systems and traditions in terms of penalties  and the legislator 
gave wide room to MS when setting penalties for the FwD offences  (Thomson Reuters, 2013).  

Counterfeiting  and  falsification  of  payment  instruments  (Art.  2  (b))  is  the  most  heavily 
punished  FwD  offence,  bing  punished  with imprisonment in all MS. This offence has the highest 
average maximum level of penalty (6.8 years of imprisonment). It is also the only offence for which 
more than half of the MS (16)108 provide a minimum number of years of imprisonment and for which 
the average minimum is the highest (2 years). However, both maximum109 and minimum110 number of 
years of imprisonment are not fully harmonised among  MS, with the outstanding case of PL where 
this offence is punished with a high maximum offence of 25 years. In any case, even if PL is excluded 
from the calculation the average maximum imprisonment remains above average levels of penalties 
for the other offences (6.1 years). 

At  the  opposite  extreme,  the  offences  related  to  specifically  adapted  devices  (Art.  4)  are 
punished with the lowest levels of penalties. This offence has the lowest average maximum level 

105 The coefficient of variation is defined as the ratio of the standard deviation to the mean. It allows to compare the 
variability of different series of data. The highest it is, the highest the variability. The standard deviation is a 
measure used to quantify the variation of a set of values to the mean. When MS adopted similar levels of penalties 
(low values of standard deviation), the penalties set for the specific offence are considered overall proportionate at 
EU level. When there are significant differences between the levels of penalties set by MS (high values of coefficient 
of variation), penalties set for the specific offence are not proportionate and do not create a minimum common 
level. 
106 The Evaluation team assumed that the penalties for the forms of conduct under the Fw D are proportional with 
the domestic scale of penalties set up by the Member States in its general sanctionatory approach. When MS 
adopted similar levels of penalties (low values of standard deviation), the penalties set for the specific offence are 
considered overall proportionate at EU level. When there are significant differences between the levels of penalties 
set by MS (high values of coefficient of variation), penalties set for the specific offence are not proportionate and do 
not create a minimum common level. 
107 The average coefficient of variation of the maximum numbers of years of imprisonment in national legislation is 
72%. 
108 BG, LU, PL, ES, C Z, LT, MT, PT, RO, BE, DE, EL, HR, IT, SI, SK. 
109 C oefficient of variation of the maximum numbers of years of imprisonment in the national legislation: Art 2 let. a 
– 73%; Art 2 let. b – 69%; Art 2 let. c – 65%; Art 2 let. d – 52%; Art 3 – 74%; Art 4 – 96%. 
110 C oefficient of variation of minimum numbers of years of imprisonment in the national legislation: Art 2 let. a – 
8%; Art 2 let. b – 65%; Art 2 let. c – 33%; Art 2 let. d – 14%; Art 3 – 9%; Art 4 – 0%. The high coefficient of 
variation for Art 2 let. b can also be explained by the fact that it is the offence for which the highest number of MS 
have set a minimum penalty. 

37 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

penalty (2.5 years of imprisonment). It is also the offence for which the smallest number of MS (7)111 
foresee  a  minimum  number of years of imprisonment and for which the average minimum  level of 
imprisonment is the lowest (one year). However, it is the offence for which the  maximum112 numbers 
of years of imprisonment are the least harmonised among MS.113 

Annex 6 provides the main results of the analysis on the maximum and minimum levels of penalties 
for each of the FwD offences.  

The three most common aggravating circumstances are the following: 

  offences  committed  by  two  or  more  persons  together  (association)  or 
organised  crime  groups:  All  MS  included  the  organised  criminality  factors  as 
aggravating circumstances when the offence is committed by a criminal organisation.114 
The analysis identified eight MS (AT, FR, HU, GE, LV, SK, SL, and ES) that directly linked 
these  features  to  the  offences  defined  by  the  FwD.  For  these  offences,  all  the  MS 
establish imprisonment with FR applying also a fine of maximum €1 million. In case of 
Art. 2-(a), the maximum  penalty applicable with aggravating circumstances is 20 years 
with imprisonment, for Art. 2-(b) and (c) the maximum penalty is 10 years, for Art. 2-
(d) five years, for Art. 3 and 4 two years. Except DK and SE, all other MS incriminated 
organised  crime  (namely  participation  in  a  criminal  organisation  or  conspiracy  in 
organised crime) also as a self-standing offence.  

  offences  committed  by  means  or  methods  likely  to  endanger  other  persons  or 
property in eight MS (AT, BE, FI, FR, EL, LT, PT, and SL). For Art. 2-(a), in this case the 
maximum  penalty  is  life  imprisonment  (FR),  for  Art.  2-(b)  and  (c)ten  years  of 
imprisonment (EL). Moreover, fines applied in addition to the imprisonment can reach 
€150,000 (FR). 

  offences taking advantage of a person particularly vulnerable due to age, health, 
infirmity  or  other  causes  are  incriminated  in  four  MS  (BE,  FI,  FR  and  SL).  For  the 
offences under Art. 2-(a), the maximum penalty is 10 years of imprisonment (FR) and 
the maximum fine is of €150,000 (FR). 

  Other  offences,  such  as  security  of  state,  severe  consequences,  mercenary 
motives,  considerable  damages,  are  incriminated  in  16  MS  (AT, BE, BG, HR, DK, FI, 
HU, EL, DE, LV, LT, NL, SK, SI, ES, FR).  When these aggravating circu mstances apply to 
the  FwD  offences,  the  maximum  of  penalty  is  20  years  (BE  and  EL)  and  the  fines 
applicable can reach the amount of €750,000 (FR). 

The situations met in the national laws cover aggravating features with potential application to all 
offences  envisaged  by  the  criminal  law.  Moreover,  the circumstances refer to gravity of the harm 
brought to a person or property (taking into consideration the vulnerability of the victim, the high 
value of the property to the victim or substantial loss, creating endangered situations to harm the 
victims etc), rather than to the culpability of the perpetrator (his/her professional quality, racially or 
religiously factors, repeat offending, use of weapons to produce an harm to the victim). 

More detail on the analysis of the aggravating circumstances can be found in Annex 7. 

111 BE, EL, ES, HR, LU, PL, RO. 
112 C oefficient of variation of the maximum numbers of years of imprisonment in the national legislation : Art 2 let. a 
– 73%; Art 2 let. b – 69%; Art 2 let. c – 65%; Art 2 let. d – 52%; Art 3 – 74%; Art 4 – 96%. 
113 The Evaluation team considers that the analysis of the coefficient of variation of the minimum numbers of year s 
of imprisonment is not relevant here as it concerns only seven MS. 
114 

C OM Report based on Article 10 of C ouncil Framework Decision 2008/841/JHA  on the fight against organised 

crime, C OM(2016) 448 final. 

38 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Jurisdiction 

Overall,  all  MS  transposed  at least one of the principles for establishing jurisdiction set in the 
FwD.  Nine  MS  (CY,  CZ,  EE,  ES,  FI,  FR,  MT,  PT,  SE)  transposed  all  the  three  principles .  22  MS115 
provided for wider interpretations of the FwD principles  covering more circumstances than the ones 
listed in the FwD. Thus, it can be considered that the FwD contributed to creating a common basis and 
a minimum level of approximation of national jurisdiction covering NCP offences. 

All  MS  adopted  the  territoriality  principle  and  address  offences  committed  in  whole  or  in  part 
within  their  territory.  Many  MS  (at  least  16)116  went  further in the interpretation of this principle, 
including  additional  circumstances  such case when the offence is committed on a national ship or 
aircraft (e.g. DK,  DE), or when the consequences of the offence became apparent in national territory 
(e.g. FI). 

Several  MS  (21)117  adopted  also  personality  and  dual  criminality  principles.  Most  of  them 
(15)118 went beyond the description provided in the FwD by adding new and more specific elements .119 
BE, IT and RO establish their jurisdiction when committed by a national only in some specific cases. LU 
and LV do not apply the personality criteria. No information has been gathered regarding BG and IE.  

Only  some  MS  (11)120  establish  their  jurisdiction  when  the  offences  are  committed  for  the 
benefit  of  a  legal  person  that  has  its  head  office  in the territory of  a MS (last criterion set by 
the FwD). Also in this case some of them widened their interpretation of the definition provided in the 
FwD covering offences committed for the benefit of legal persons that carry on business activities on 
the national territory without having established their head office in the MS (e.g. CZ). Information is 
missing for BG. 

Besides  the  criteria  foreseen  in  the  FwD,  there  is  evidence  of  adoption  in  the  MS  national 
legislation  of specific criteria to establish their jurisdiction on NCP frauds such as: the nationality of 
the  victims  (i.e.  AT,  BG,  EE,  SI)  and  the  existence  for  the  MS  of  damages/losses  caused  by  the 
criminal offence (i.e.SI), committing a crime against the security of the State (i.e. BE, DE, DK, IT). 

Even  though  the  analysis  highlighted  that  at  least  the  territoriality  criteria  of  the FwD has been 
transposed  by all MS, thus ensuring a common minimum ground for the establishment of national 
jurisdiction, the existence of additional criteria might affect the level of harmonisation of the national 
frameworks in this field. In case of cross-country offences, for instance, differences may increase the 
need for consultations and exchanges of information between MS to decide the applicable jurisdiction, 
extend the timeline for prosecutions and eventually limit the efficiency of the overall system. These 
may require the establishment of Joint Investigation Teams (JITs), or other operational mechanisms 
for cooperation. 

Severe  problems  in  the  jurisdiction  occur  in  relation  to  the  (digital)  evidence and the e -evidence 
process as more general rules are needed. Many experts and Europol underline that the jurisdiction in 
cyberspace, data in cloud and the global dimension are the emerging issues. However, experts confirm 
that there are no obstacles due to substantive jurisdiction as problems relate to practicalities. 121 

115 AT, C Y, CZ, DE, DK, EE, EL, ES, FI, FR, HR, HU, LT, LV, MT, PL, PT, RO, SE, SI, SK, UK.  
116 C Z, DE, DK, EE, EL, FI, HR, LT, LV, MT, PL, PT, RO, SI, SK, UK.  
117 AT, C Y, CZ, DE, DK, EE, EL, ES, FI, FR, HR, HU, LT, MT, NL, PL, PT, SE, SI, SK, UK. 
118 AT, C Y, CZ, DE, DK, EE, ES, FI, FR, HU, LT, MT, SE, SK, UK. 
119 For instance, as for the personality, the Czech Republic covers also criminal acts committed abroad by a person 
with no nationality, who has been granted a permanent residence in its territory. In Estonia jurisdiction applies 
when the offender is a citizen of Estonia at the time of the perpetration of the offence. 
120 C Y, C Z, EE, ES, FI, FR, LV, MT, PT, RO, SE. 
121 Input provided during the 1stEGM. 

39 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Extradition and prosecution 

When assessing the level of transposition of the FwD provisions on extradition and prosecution, it is 
worth highlighting that the scope of their application is limited to two cases. Firstly, MS that decided 
not to extradite their nationals. Secondly, to criminal offences with specific levels of penalties when 
there  is  not  an  obligation  to  extradite deriving from  EU rules on extradition and namely from the 
Council  Framework  Decision  2002/584/JHA  on  the  European  arrest  warrant  (EAW).  This  piece  of 
legislation limits the possibility of a MS to refuse the extradition of a national to another MS under 
certain circumstances, and therefore makes irrelevant the requirements set in the FwD to ensure that 
the MS takes the necessary measures to establish its jurisdiction. 

As for the MS that do not extradite their nationals, the analysis of the national criminal legislation on 
extradition shows that 16 MS122 do no generally extradite their nationals, due to constitutional barriers 
to extradition of nationals or other legal limitations.123 

As for the offences in scope, the applicability of the FwD has been limited to criminal offences with 
lower levels of penalties. When the EAW is applied , MS are obliged to extradite their nationals to 
another MS irrespective of their overall national decisions. Table 7 shows the current applicability of 
the FwD and clarifies the scope of the analysis of the transposition o f its provisions on extradition and 
jurisdiction. 

Table 7 – Overview on the applicability  of the FwD provision  on extradition  and prosecution 

Extradition  between MS 

FwD offences 

Custodial 
sentence  or 
detention 
for 
order 
max  of  at 
least 3 years 

Counterfeiting and 
falsification 

Offences relating to 
computers 

Offences relating to 
adapted device 

EAW 

EAW 

EAW 

Imprisonment 
or 
detention  for  max 
of at least 1 year or 
custodial 
sentence/detention 
order  of  at  least  4 
months 
EAW (optional124) 
FwD 

Imprisonment 
or 
detention  for  max 
of  less  than  1  year 
custodial 
or 
sentence/detention 
order  less  than  4 
months   
EAW 125 
FwD 

EAW (optional) 
FwD 

EAW (optional) 
FwD 

EAW  
FwD  

EAW 
FwD 

Extradition 
with 
countries 

third 

Extradition 
convention 
FwD 

Extradition 
convention 
FwD 

Extradition 
convention 
FwD 

122 AT, BE, C Y, CZ, DE, EL, ES, FR, HR, LT, LU, LV, PL, PT, SI SK.  
123 For instance: AT, HR, PL, PT, CY and SI cannot grant extradition of own nationals due to a constitutional 
restrictions; BE does not extradite its nationals, not even for prosecution purposes only and under the condition of 
the ‘return’ of the person sought in order to serve his or her sentence in Belgium; extradition of FR nationals shall 
not be permitted, as the national's status shall be assessed at the time of the commission of the offense for which 
extradition is requested; DE, EL, CZ, LT do not extradite its own nationals outside EU MS. 
124 We indicated that the application of the EAW was “optional” when it is applicable only if there are no 
constitutional barriers to extradition in the national law. Further details on the coherence of the FwD with other 
relevant pieces of legislation are included in section 4.4. 
125 According to art. 2 para 2 of FwD 2002/584/JHA, “For offences other than those covered by paragraph 2, 
surrender may be subject to the condition that the acts for which the EAW has been issued constitute an offence 
under the law of the executing MS, whatever the constituent elements or however it is described.” In these cases, 
the EAW applies when the imprisonment or detention is settled for a maximum of less than 1 year or custodial 
sentence/detention order is less than four months. 

40 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

FwD offences 

Extradition  between MS 

Custodial 
sentence  or 
detention 
order 
for 
max  of  at 
least 3 years 

or 
Imprisonment 
detention  for  max 
of at least 1 year or 
custodial 
sentence/detention 
order  of  at  least  4 
months 

or 
Imprisonment 
detention  for  max 
of  less  than  1  year 
or 
custodial 
sentence/detention 
order  less  than  4 
months   

Extradition 
with 
countries 

third 

Possession, 
transportation and sale 

EAW 

Theft and 
misappropriation 

Fraudulent use 

EAW 

EAW 

Participation, 
instigation 
attempt 

EAW 

and 

EAW (optional) 
FwD 

EAW (optional) 
FwD 

EAW (optional) 
FwD 

EAW (optional) 
FwD 

EAW 
FwD 

EAW  
FwD  

EAW 
FwD 

EAW  
FwD 

Extradition 
convention 
FwD 

Extradition 
convention 
FwD 

Extradition 
convention 
FwD 

Extradition 
convention 
FwD 

Source: Authors’ elaboration based on desk research 

With  regard  to  offences  where  the  FwD  still  applies,  most  of  the  MS  that  do  not  extradite their 
nationals have put in place measures to assure that no crime remains unpunished, and that there is a 
compensation to the exception of nationality based on the aut dedere aut judicare principle provided 
for in the 1957 Convention on Extradition.126 The current situation is presented synthetically in Table 8. 

Table 8 – Overview of the transposition  of FwD extradition  provisions 

offences 
by 

FwD 
when 
committed 
own 
the  MS 
nationals  outside 
territory (Art 10, Par. 1 let. a)  

its 

Allegations  of  committing  a 
FwD  offence  by 
its  own 
nationals  in  another  MS  and 
refusal  of  extradition  on  the 
sole  ground  of  nationality 
(Art 10, Par. 1 let. a)127 

AT, BE, CZ, CY, DE, EL, ES, HR, 
LT, LV, PT, SK, SI 

AT,  CZ,  DE,  HR,  LT, LV, PT, SI, 
SK, BE, LU, ES, CY, PL 

MS  that  do  not  extradite  the 
nationals, and have measures 
in 
not 
(if 
applicable) 

place 

EAW 

Countries that do not extradite 
the nationals and do not have 
measures in place (if EAW not 

FR, LU, PL 

FR, EL 

126 “Aut Dedere Aut Judicare” means extradite or prosecute. “It represents the legal obligation on the states under 
public international law to prosecute persons who commit serious international crimes where no other state has 
requested extradition. Accordingly, the state having the custody of a suspect has to either extradite the person to 
another state having jurisdiction over the case or to instigate its own judicial proceedings. The object of the 
principle is to avoid crimes being left unpunished because there is no extradition or prosecution. ” 
<https://definitions.uslegal.com/a/aut-dedere-aut-judicare/> 
127 In this case the MS should submit the case to its competent authorities for the purpose of prosecution if 
appropriate and inform the other Member State on the prosecution initiated and its outcome. 

41 

 
 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

applicable) 

Source: Authors’ elaboration based on desk research 

Cross border cooperation  and exchange of information 

All  MS  adopted  measures  of  mutual  legal assistance in respect of proceedings relating to the 
offences  established  in  the  FwD  (Art.  11  (1))  either as part of specific treaties and conventions 
(see Box 23) or by implementing specific cooperation mechanisms.  

It was not possible to identify national provisions establishing cooperation mechanisms for cases where 
several MS have jurisdiction on the same offence  (Art. 11 (2)).  

MS  use  different  channels for cooperation such as: Interpol mechanisms for bilateral exchange of 
information,128  rogatory  letters,129  the  European  Judicial  Network  (EJN),130  the  Joint  Investigation 
Teams (JIT),131 and more informal communication exchanges.132  

All  MS  designated  contact  points  in  charge  of  international  judicial  cooperation  and  national 
correspondents,  according  to  European  Judicial  Network133  (Art.  12(1)).  Some  MS  (9)134  have 
identified more than one contact point for implementing Art. 12.All the MS for which there is evidence 
judicial cooperation activities are carried out by actors already responsible for liaising with other MS or 
EU Agencies on different matters. Many MS (12)135 designated judicial representatives, in particular 
members of the Ministries of Justice 136, some MS (8)137 designated members of the police, a few  MS 
(BG,  EE, RO, SE) designated the EJN138 contact point (European Judicial Network and Eurojust, 2014) 
and  SK  designated  the  Europol  National  Unit  (ENUs) already serving as liaison between national 
authorities and Europol.139 

3.3 

Implementation  of the Framework Decision  

This section aims at assessing whether there are obstacles to law enforcement and judicial action 
focusing on procedural criminal law  (section 3.3.1). It also assesses the need for revising provisions on 
jurisdiction and territoriality (section 3.3.2) and for additional improvements in terms of cooperation 
among law enforcement and judicial authorities (section 3.3.3). 

128 Interview feedback: five representatives from LEAs. 
129 Interview feedback: one representative from LEAs and one from NBF. Survey feedback: two representatives 
from LEAs, one from NBF and one from the private sector. According to DG JUST website, a letter rogatory is a 
letter of request sent by a judicial authority to a foreign judicial authority to perform an action in its territory.  
130 Interview feedback: one judicial representative. According to DG JUST website, the EJN promotes judicial 
cooperation in criminal matters between EU countries, namely through facilitating direct contacts between judicial 
authorities. The network is composed of contact points in EU countries and has privileged relations with Eurojust, 
based on consultation and complementarity.  
131 Interview feedback: three representatives from LEAs and one judicial representative. Survey feedback: one 
representative from LEAs. 
132 Interview feedback: two representatives from LEAs and one from EU institutions and bodies. 
133 European Judicial Network website - https://www.ejn-crimjust.europa.eu/ejn/EJN_StaticPage.aspx?Bread=2. 
134 AT, C Z, EE, EL, FI, HR, PL, SE, SI. 
135 AT, BG, EE, EL, FI, FR, HR, LU, PL, RO, SE, SI. 
136 AT, EE, EL, FI, FR, HR, PL.  
137 C Y, C Z, DE, EE, FI, LV, NL, SI. 
138 The EJN is a network of national Contact Points for the facilitation of judicial cooperation in criminal matters.  
139 ENUs are tasked with information exchange and should ensure that actionable criminal intelligence is 
communicated to Member States’ law enforcement authorities. A list of ENUs can be f ound 
<https://www.europol.europa.eu/publications-documents/europol-national-units-of-european-member-states> 

42 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

3.3.1  Obstacles to investigations  and prosecutions 

EQ11: What are the obstacles to investigations and prosecutions?  

Investigations and prosecutions on NCP frauds and other related cyber-criminal acts are frequently 
impacted  by  the  challenges  experienced  by  police  and  prosecutors.  These  include  legal  powers, 
competence, human and technical resources , and mechanisms of cooperation for obtaining evidence, 
especially in cross-border cases.  

As specifically regard cross-border situations, the main obstacles to investigations and prosecutions 
are: 

1. 

limited  relevance  of  the  EU  criminal  law  framework  to  the  recent  criminal  offences  and 
technological developments in the NCP industry; 

2.  differences in national criminal law  frameworks;  

3. 

fragmentation in the implementation or limited scope of data protection rules among MS  

4. 

lack of skills among LEAs and judicial authorities;  

5. 

limited priority given to NCP frauds;  

6. 

lack  of  standardised  statistics  on  investigations,  prosecutions,  convictions  and  reported 
incidents relating to cybercrime; 

7.  difficulties in cooperation among law enforcement and judicial authorities ; 

8.  obstacles to public-private cooperation. 

The following paragraphs illustrate in detail each of the above mentioned obstacles. While assessing 
them, it is noteworthy that some areas of international cooperation (such as exchange of information, 
European Investigation Orders and data protection laws in cross border criminal justice cooperation) 
are strictly linked to the MS legal traditions (i.e. common law and civil law).  

Limited relevance of the EU criminal law framework to the recent criminal offences and technological 
developments in the NCP industry 

Even though several measures were adopted to face the increasing number of threats and risks posed 
by  cybercrime,  the  current  EU  legislative  framework  does  not  appear  to  be  fully  relevant  to 
face most  recent trends  in criminal  offences.   

As mentioned in section 4.1, new technological developments make the scope of the FwD partially 
outdated in terms of both forms of value transfer and types of criminal offences. Several pieces of 
legislation integrated the FwD widening its scope and the Single Euro Payments Area (SEPA) was set 
up  with  the  aim  to  ensure  consistency  in the controls over payment instruments.140 However, as 
discussed in section 3.2, the current EU legislative framework does not cover properly some emerging 
forms  of  NCP  such  as  virtual  currencies   and  non-corporeal  payment  instruments.  Evidence  of 
fraudulent  use  of  this  mean  of  payment  is  still  limited  (see  section  4.3.1),  however  the  level  of 
anonymity ensured by these transactions and the large number of actors involved make traceability of 
transactions  more  difficult  and  increase  the  potential  risks  for  users  therefore  creating  security 
concerns.141 

140 By identifying when existing or new payment instruments reach market significance, performing risk assessment 
and assessment of each payment instrument against common standards.  
141 Recent cases of hacking of crypto currencies exchangers (with consequent theft of virtual currencies) and the 
use of Bitcoin mixers (to avoid traceability of VC exchanges) were described by Europol and other experts in the 1 st 

43 

 
 
                                                 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

This  is  further  confirmed  by  the  analysis  of  the  online  survey, with some LEAs 142 considering the 
limited  coverage  of  emerging  payment  instruments  by  national  legislation  as  one  of  the  most 
important obstacles to investigations and prosecution. . Furthermore, stakeholders answering the 
survey  highlighted  the  growing  importance  of  payment  instruments  such  as  e -money,143  mobile 
money,144 virtual currencies (such as Bitcoin).145 

Differences in national criminal law frameworks  

The most relevant differences are the following. 

  Criminalisation of forms of conduct: the FwD offences are not criminalised by all MS 
or  they  are  not  criminalised  in  the  same  way.  Beside  the  FwD  offences, other NCP 
related offences - such as identity theft - are not equally criminalised. These differences 
may create obstacles especially in cross -border cases. 

  Limitation period: MS have different limitation periods for affected parties to enforce 
their  rights  or  to  seek  redress  after  a   damage,  being  this  linked  to  the  maximum 
sanction  applicable in the MS.146 Moreover, the date when the prescription/limitation 
period  starts  differs  across  MS.147  Differences  in  the  limitation  period  might  be  an 
obstacle  especially  in  large  scale  frauds   involving  several  MS,  where  many  victims 
located in different countries report the same crime, generating a significant workload 
for  LEAs.  The procedures to obtain personal data from another MS are complex and 
lengthy  (especially  when  the  case  is  not  a  priority  for  the  MS),148  this  bringing  to 
situations where the limitation period of one MS is too s hort for punishing the offender 
before the prescription occurs.  

  Offences  for  which  a  special  investigative  tool  may be authorised and period of 
cross-border surveillance.  It may occur that a LEA surveillance in MS1 is shorter than 
in MS2 where the suspect for committing an illegal act in MS1 is hiding. The expiration of 
the allowed period might threaten a breach of procedures in MS2 or force MS1 to apply 
for  an  extension,  thus  making  the  administrative  process  burdensome   (Di  Nicola, 
Gounev, Levi, Rubin, and Vettori, 2015). Moreover, it is unclear how an investigation 
should proceed when the authorisation covers offences with different minimum penalty 
thresholds. According to the mentioned 2015 COM study, the types of surveillance vary 
due  to  the  level  of  intrusion  (volume   of  data  gathering,  number  of  persons  under 
surveillance, method of surveillance), the period for which the surveillance is authorised 
(short-term or long-term), the crime-threshold, the administrative burden and others.  

  National 

criminal 
proceedings 149 and non-conviction based confiscation in civil proceedings ).150 While some 

(conviction-based 

confiscation 

confiscation 

systems 

in 

EGM. 
142 Survey feedback: four representatives from LEAs and one from EU Institutions and bodies. 
143 Survey feedback: two representative from Asso and DPA, one from LEAs, two from NBF, and five from the 
private sector. Interview feedback: one representative from the private sector and one from data protection 
agency. 
144 Survey feedback: three representatives from LEAs and one from NBF. Interview feedback: one judicial 
representative, one representative from PPP, one from data protection, one from NBF and four from the private 
sector. 
145 Survey feedback: one representative from Asso and DPA, two from LEAs and five from the private sector. 
Interview feedback:two representatives from LEAs, two judicial representatives and one representative from legal 
professions. 
146 For example, in DE and RO, five years in the case of offences punishable by a maximum term of imprisonment of 
more than one year but no more than five years; ten years in the case of offences punishable by a maximum term 
of imprisonment of more than five years but no more than ten years; or six years in the UK in case of fraud. 
147 For example, in DE and RO the prescription commences to run as soon as the offence is completed or if a result 
constituting an element of the offence occurs later, the limitation period commences to run from that time; in other 
cases, such as in the UK, the limitation period is not to begin to run until the claimant has discovered the fraud.  
148 Survey feedback: one from EU Institutions and bodies. 
149 Proceedings are brought by the State against an individual and form part of an action brought against a specific 

44 

 
 
 
 
                                                                                                                                                              
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

MS actively pursue a “follow-the-money” approach, thus prioritising the asset recovery 
through the forfeiture process (at least in some cases), others primary focus on tracking 
and retaining the perpetrator. It appears that there is a significant under utilisation of 
asset confiscation laws throughout the EU.151 

Current fragmentation in the implementation or limited scope of data  protection rules between MS 

Differences in MS legislation and fragmentation of national approaches to privacy, data protection and 
sovereignty aspects 152 bring challenges to investigation and prosecution.  

First  of  all,  there  issues  as  regards  the  existence  of  different  data  retention  rules.  In  April 
2014  the  Court  of  Justice  of  the  European  Union  (CJEU)  declared  the  Data  Retention  Directive 
invalid.153 At that moment, several Member States (BE, BG, DE, FI, LU, NL, PL, SK, UK) had already 
adopted legislative amendments on data retention for the prevention, investigation, detection, and 
prosecution of criminal offences (FRA, 2016). Consequently, there are MS with a different applicable 
legal framework on data retention. The CJEU provided guidance on the aspects of national legislation 
on data retention that would be deemed unlawful under EU law in the Tele2 Sverige and Watson cases 
(Joined Cases C-203/15 and C-698/15). 
Further  difficulties  are  due  to  the  fragmentation  of  national  legal  frameworks  on  data 
protection  in  view  of  technological  developments.  Due  to  the  technological  developments  and 
use  of  Internet,  it  is  increasingly  difficult  to  limit  the  volume  of  personal  data  processing.  Police 
regularly encounter devices connected to cloud computing, such as Virtual Private Network (VPN), web 
mail  and  social networking platforms. Due to automated backup, data are often replicated across 
various cloud-computing environments. Data interce ption procedures may facilitate access to data 
stored and transmitted via cloud services and data for individual cloud users may be geographically 
dispersed and potentially pooled with data from other users.  
This affects the legal provisions governing data access and disclosure (Brown, 2015), that must fully 
comply with applicable legal frameworks on the protection of personal data  (Infosec Institute, 2013). 
At the same time, investigative authorities must comply with applicable legislation on the protection of 
personal  data.  Any  transfer of personal data to third countries must also respect data protection 
legislation.  
With regard to the most recent technological developments, Member States ensure that the legal 
powers granted to the LEAs correspond with the level of technological developments and risk of the ft 
of personal data.154 In parallel, LEAs powers should be used respecting “the need to know” principle 
in their investigations and prosecution, in order to respect legislation on personal data processing. In 
this respect, MS are adopting measures that aim either at modifying the legislative framework155 or at 

person (in personam) (European Commission, 2016a).  Proceedings are brought by the State against an individual 
and form part of an action brought against a specific person (in personam) (European C ommission, 2016a).  
150 Proceedings are initiated by the State against the property (in rem) (European Commission, 2016a). Proceedings 
are initiated by the State against the property (in rem) (European Commission, 2016a). 
151 “There are cultural differences in the Member States that affect the general approach to confiscation. Some 
judges consider confiscation almost as an additional punishment of an already convicted person and are reluctant to 
apply it systematically. Moreover, at law enforcement level, in some Member States the tracing and identification of 
criminal assets are neglected in favor of the criminal investigation. Within the judicial system prosecutors have a 
discretionary power to request freezing and confiscation orders and the courts have a discretionary power to issue 
them” (European Commission, 2016a, p. 12)(European Commission, 2016a, p. 12). 
152 Interview feedback: three representatives from LEAs, three from the private sector, one from victims 
associations and two from EU institutions and bodies. 
153 “While the C ourt noted that the use of electronic communications is important in the prevention of offences and 
the fight against crime, in particular organised crime, judges concluded that the Directive ‘entails a wide -ranging 
and particularly serious interference with those fundamental rights in the legal order of the EU” (European C ourt of 
Justice, 2014). 
154 As pointed out during the 1st EGM the need to secure electronic evidence should be considered first and 
foremost. 
155 Adopting legislative acts targeted to achieve specific personal data protection rules, with powers limited to those 
agencies and authorities for whom lawful access to personal data are essential rather than desirable. 

45 

 
 
                                                                                                                                                              
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

better using investigative tools.156 However, these measures are still limited and there is room for an 
increased adoption. 
Directive 157 (EU) 2016/680 on processing personal data for purposes of the prevention, investigation, 
detection or prosecution of criminal offences or the execution of criminal penalties require the MS to 
ensure  a  high  level  of protection of personal data, due to the latest t echnical developments that 
facilitates the processing of personal data at large scale. Member States have to adopt adequate 
measures to enforce the provisions of EU General Data Protection Regulation by May 2018. 

Lack of skills among LEAs and judicial  authorities  

investigative  challenges 

Investigations  relating  to  NCP  frauds  bring  new  challenges  to  LEAs  working  methods  and 
investigative  techniques.158  The  main 
for  LEAs  are  attribution, 
anonymisation and encryption of data. In cybercrime cases, it is difficult to identify the offender and to 
trace perpetrators’ actions due to the anonymity and involvement of a high number of actors , such as 
in the case of organised crime schemes. In the majority of cases, the identity of the offender is difficult 
to find because some steps in investigations, such as the identification of an Internet Protocol Address 
(IP address), an email address, a phone number or a bank account, may require complex procedures 
(Bank  of  America  and  International  Association  of  Chiefs  of  Police,  2006,  sec.  5).  The  length  of 
proceedings  and  the  requirements  of  obtaining  court  warrants  often  prevent  LEAs  from  rapidly 
intercepting the computer server linked to the cybercrime  (Council of the European Union, 2016b). In 
addition, when intercepting communications, LEAs face encryption of electronic data.159 Even though 
providers  are  obliged  to  co-operate  in  disabling  encrypted  communication,  they  are  sometimes 
incapable of doing so. Some programmes are designed to be non-decodable to protect data, the data 
located abroad are not accessible, or the location of data cannot be reasonably identified  

Moreover,  NCP  frauds  often  require  that  LEAs  have  highly  specialised  technical skills (e.g. IT 
acquisitions,  processing  of  unstructured  electronically  stored  information  (ESI),  IT  forensics).  For 
example,  it  is  technically  difficult  to  trace back the Internet connections made from smartphones. 
Many  proxies,  Virtual  Private  Networks  (VPN) or other IT system equipment often do not  perform 
logging160 of their system even though the functionality is available . This results in full anonymity for 
criminals in case of online frauds either because there is no tracing of the identity or because of the  
limited period of data storage. Europol also reported that the anonymity of data exchange and financial 
transactions is a challenge to law enforcement.161 As a result, investigative techniques and tools are 
not fully adapted to fight NCP frauds, in particular to fight mass phenomena such as online scams or 
card-not-present  frauds  (Council  of  the  European  Union,  2015c)(Council  of  the  European  Union, 
2015c)(Council of the European Union, 2015c). 

Finally,  there 
is  also  evidence  that  judicial  representatives  sometimes  lack  needed 
competencies in cybercrime offences. In general, due to the low level of training for judges and 

156 For instance tools that reflect the fact that one person can have access to multiple devices (laptops, tablets and 
smartphones) and online accounts and identities and that are defined by what is necessary to protect the 
confidentiality of information about victims. 
157 Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by 
competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal 
offences or the execution of criminal penalties, and on the free movement of such data, and repea ling Council 
Framework Decision 2008/977/JHA. 
158 Interview feedback: three representatives from LEAs and two from EU institutions and bodies.  
159 Special programs for the encryption of data files are available on the Internet and criminals can use this 
encryption solution and transmit information anonymously via certain services. 
160 Data logging is the process of collecting and storing data over a period of time in order to analyse specific trends 
or record the data-based events/actions of a system, network or IT environment. It enables the tracking of all 
interactions through which data, files or applications are stored, accessed or modified on a storage device or 
application. 
161 Input provided during the 1st EGM. 

46 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

the lack of case law, the knowledge of the courts on cybercrime and financial crime is quite low (e.g. 
BG,  CZ,  EE, ES, LT, PL, PT, RO) (Council of the European Union, 2016a). In addition, there are MS 
where  law  enforcement  authorities  have  competence  in  deterring  informatics  criminality,  but  not 
judges and judicial structures.162 They may rule on cybercrime cases once per year or never.  

Some respondents to the survey163 mentioned some good practices to overcome LEAs skills, such as 
the creation of dedicated units, with specialised police officers and prosecutors that understand the  
international nature of non-cash payment crimes. An improved knowledge of the relevant EU legal 
framework and institutions (e.g. Europol, Eurojust and OLAF) might also be promoted among judges, 
prosecutors and high-ranking law -enforcement officers to increase their awareness and investigative 
performances. 

Limited priority given to NCP frauds 

The  limited  priority  to  NCP  frauds  hinders  the  impact  of  LEAs  activities  and  the  exchange  of 
information,  especially  in  cross-border  cases.164  Different  factors  contribute  to  this  problem,  as 
explained below.  

Underreporting  practices: underreporting reduces the number investigations and prosecutions  (see 
also section 0). Underreporting occurs frequently when it comes to Internet crime threats aiming at the 
so-called “Critical Infrastructures” 165 because of the potential reputational damages. In this regard, 
Symantec provided anecdotal evidence, stating that the number of data breaches on the web where 
the full extent of the breach was revealed decreased (Symantec, 2016). Specifically, in 2015 there has 
been  an  increase  of  +85%  of  the  data  breaches  reported  without  including  figures  of  identities 
exposed. Symantec estimated that if these data breaches were to be fully conveyed the total number 
of identities exposed would be around half a billion compared to the 429 million recorded in 2015. 

Limited  capacity to analyse NCP frauds:  the limited capacity of several LEAs to connect small value 
operations bring to a low priority of NCP frauds (Europol, 2016b).166 When looked in isolation, small 
value operations - that concern a high number of NCP frauds (see Annex 4) - difficultly allow for the 
identification and dismantling of organised crime groups. This brings MS with no possibility to select 
the cases to be investigated (i.e. those following the legality principle)167 to a significant workload with 
potentially  limited  results.  Criminals  know  this  and  target  large  scale  cross —country  operations, 
creating large amounts of financial losses through small individual frauds. In MS such as the UK, that 
allowed LEAs to prioritise cases based on their size or links to their own investigations , and thus to 
focus their efforts on most relevant cases, the priority to NCP frauds seems to be higher. In this view, 
additional effort is required, through more focused information sharing within LEAs and/or partnerships 

162 In Bulgaria and Romania, for instance, the main entity for investigating and combating cybercrime (the C yber 
Unit) is composed of experienced specialised police officers and prosecutors. They have a good technical knowledge 
and are specialised in investigations relating cybercrime cases. They are also involved in prevention of cybercrime 
and in awareness campaigns. There are no dedicated judges who deal exclusively with cybercrime cases. However, 
in practical terms, judges who are familiar with cybercrime issues are usually appointed to deal with this kind of 
cases, at least the most serious ones (Council of the European Union, 2016a)(Council of the European Union, 
2016a). 
163 Survey feedback: three representatives from LEAs and one from EU institution and bodies. 
164 Survey feedback: one representative from LEAs, one from the private sector and three from EU institutions and 
bodies. 
165 C ritical Infrastructures refer to assets that are necessary for societies and economies to function (e.g. including 
facilities for financial services). 
166 Experts participating in the 1st EGM stressed the need for training (using the same analytical tools as Europol to 
be able to communicate effectively) in order to improv e the capacities of LEAs and to raise their awareness. 
167 There are MS that follow an opportunity principle –where LEAs have discretion over whether or not to prosecute 
a criminal offence- and MS that follow the legality principle –where LEAs are denied any discretion and every case in 
which there is enough evidence has to be brought to court. In this latter case , police have to allocate their 
resources to cases that brought small losses as well as to cases bringing more prejudice.  

47 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

with private industry, to link cases. This would facilitate the identification of organised crime groups 
and eventually to give more importance to NCP cases.  

Availability  of  resources:  the  MS  different  availability  of  human  resources  (i.e.  specialised 
personnel,  well  trained,  having  know -how  and experience), financial resources (i.e. LEAs to have 
adequate financial resources to be allocated when using investigative techniques) and technological 
resources (i.e. access to e-discovery technology and forensic storage and analysis capabilities ) also 
influences  the  priority  given  to  NCP  frauds   investigations (Levi, Doig, Gundur, Wall, and Williams, 
2015; Levi, Rajeev V., Wall, Doig, and Williams, 2017). 

Lack of standardised statistics on investigations, prosecutions, convictions and reported  incidents 
relating to cybercrime 

The  analysis  conducted  on  publicly  available  data  sources high lighted a strong heterogeneity of 
data  collection  systems  at  national  level.168  MS  adopt  different  classifications  of  offences ,  and 
subsequently  record  data according to different categories that are not easily compa rable. These 
differences limit the full understanding of the criminal phenomenon, and the assessment of the results 
of preventive and repressive measures adopted nationally.  

The lack of focused information specifically relating to NCP frauds makes it difficult to create links and 
correlations among different cases and therefore to identify responsible organised crime groups. This is 
due  to  the  modality  of  registering  specific  details  about  the  number  of  fraud  offences identified, 
number of cases under investigation and prosecutions, provisiona l measures applied and data on 
conviction (e.g. some authorities register the fraud cases without specifically mentioning that they 
relate to non-cash payments and thus the data go into the bulk named “fraud”, there is no information 
about aggravating circumstances retained in the case, the data on judge final decision refer to the 
offence having the highest penalty in a concurrent offences, such as the case of money laundering 
based on proceeds obtained from fraud). 

Moreover, differences in categorisation  may also complicate the exchange of information between 
Member States in case of cross-border investigations and prosecutions (see also  4.2.3). 

Obstacles to public-private  cooperation   

Considering  the  fragmentation  of  relevant  information  among  actors  affected by NCP frauds, the 
creation of public-private cooperation initiatives is generally welcomed. Evidence needed by police is 
often held by the private sector, which is also subject to fewer restrictions to cross-border cooperation 
than LEAs.  

Financial services are among the most affected sectors by NCP frauds, and can actively contribute to 
implementing  good  investigations.  Similarly  consumers’  protection  authorities  and  the  academic 
community can play an important role in the research and development of preventive and repressive 
measures. 

Initiatives analysed proved to have positively contributed to the improvement of investigations and to 
the design of preventive and repressive measures. A stronger support to such initiatives emerged 
throughout the analysis together with the progressive strengthening of the capacities of public sector 
representatives in order to maximise the potential benefits deriving from cooperation. 

However,  cooperation  between  the  public  and  the  private  sector  is often limited by a number of 
obstacles including the existence of data protection rules on the exchange of information. Feedback 
gathered  from  one  JR  highlighted  that,  even  though  financial  institutions  are  allowed  to  share 

168 This obstacle is confirmed also by experts participating in the 1stEGM. 

48 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

information on victims, they are often not inclined to do so given that they are afraid of being sued by 
clients over privacy issues.169 According to one interviewed representative from LEAs the la ck of access 
to  bank  accounts  databases  is an obstacle to investigations.170 According to another interviewed 
representative from LEAs, data protection rules may also create obstacles to private -public cooperation 
in so far as they limit some of their activities such as the freezing of bank accounts to the issuance of a 
prosecutor’s  order  (e.g.  PL).171  In  this  regard, there are countries  - such as the UK - where data 
protection  rules  allow  for  a wider exchange of information. This is one of the reasons behind the 
creation in the UK of a dedicated entity which is allowed by the law to  receive and analyse financial 
intelligence in order to proactively detects frauds and identify trends.  

3.3.2  Issues  of territoriality  and jurisdiction   

EQ12:   How is the issue of territoriality overcome? Is there a need to expand jurisdiction (e.g. extra -
territorial jurisdiction)? 

The  jurisdiction  of  a  MS  over  a  criminal  offence  is  primarily  established  based  on  the 
territoriality  principle.  According  to  the territoriality principle, if a criminal act and intent element 
have been initiated on the territory of a  state and it is completed or caused effects in another one, the 
first state may have reasons to exercise its jurisdiction on extra-territoriality basis. In these situations, 
conflicts of jurisdictions may appear.  

The establishment of jurisdiction according to territoriality principle became progressively a complex 
affair in cybercrime cases (including NCP frauds), where the crime or offender network often include a 
foreign element.172 

Besides the FwD, the 2001 Convention on Cybercrime and EU legal instruments addressing informatics 
criminality  further  highlight  the importance of the territoriality principles also for crimes relating to 
cyberspace,  where  it  is  often  difficult  to  identify  the  concerned  territories.  This  Convention  sets 
territoriality as the main jurisdictional principle for any offence committed in whole or in part on the 
territory of a state.  

While, the FwD allow s MS to adopt alternative principles to establish their jurisdiction over criminal 
offences  in  scope  (see  section  3.2),  it  does  not  specifically  mention  the  conditions  to  settle  the 
jurisdiction  with  respect  to  the  breach  of  law,  type  and  grade  of  offence,  monetary  damage, 
geographical area, location of evidence, perpetrator and victim’ nationality, among others. This may 
raise  difficulties  to  establish  the  jurisdiction  that  will  prosecute  a  case  in  the  positive 
conflicts  of  jurisdiction  (when  two  or  more  Member  States  have jurisdiction to prosecute  on 
a  cross-border  offence)  (Ryngaert,  2014)  (see  Error!  Reference  source  not  found.  for  an 
example). The fact that the FwD leaves the possibility to the MS to choose the rules of jurisdiction to 
apply also leaves room for negative conflicts of jurisdiction, i.e. when no MS has jurisdiction on 

169 As underlined by one respondent from the general public to the Open Public Consultation, sharing of personal 
data on victims should be done only with consent from the person reporting the fraud otherwise it is very 
dangerous for financial institutions. However, the majority of responses provided by the general public (94%= 85 
out of 90) confirmed that financial institutions should be allowed to spontaneously share with the national police or 
the police of another EU country personal information of victims. 
170 Though centralised national databases of accounts may help, the contents require a court order for access unless 
they are part of a Suspicious Activity Report disclosure: an under-utilised source of data for financial investigation. 
171 Interview feedback: one representative from LEAs. 
172 The “foreign elements” are understood as the facts of the case that may suggest that the dispute is governed by 
a foreign law. Usually, such facts correspond to a connecting factor of the relevant conflict of law rule (e.g.  
nationality of the parties; place of habitual residence; place where the damage is suffered; place where the contact 
is performed, etc.) (Institute Suisse de droit comparé, 2011).  

49 

 
 
  
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

a case.173 However, no consulted stakeholders mention any case of negative jurisdiction and they were 
satisfied with the minimum rules of the FwD174. MS can exercise extra-territorial jurisdiction also 
based  on  the  nationality  principle by establishing jurisdiction over the crimes committed outside 
the territory by the MS nationals (active nationality principle) or over the crimes committed against 
that  MS  nationals  (passive  nationality  principle ),  and  on  the  protective  and  security  principle 
(when a state is entitled to exercise the extra-territorial jurisdiction on the activities and persons that 
threaten State security and other vital interests) (Schabas, 2016).  

Box 4 – Example of jurisdictional  challenge  – release of criminals after the pre-trial phase  

A respondent to the survey reported that in his or her MS installing a skimming device on a petrol 
station terminal is considered a non-cash payment fraud only when the investigators can prove that 
the copied cards were used fraudulently. Thus, when the police arrests criminals after they have 
installed and recovered the skimming devices, extracted the card data from it and sent it abroad to 
their  accomplices,  if  during  the  pre -trial  investigation  the  copied  card  data  are  not  used  for 
fraudulent  withdrawals,  the  criminals  have  to  be released from police custody and the case is 
closed. Usually immediately after the release, the accomplices abroad start using the card data 
fraudulently. 

Source: Authors’ elaboration based on field  research 

The Framework Decision175 2009/948/JHA seeks to prevent an infringement of the principle of “ne bis 
in idem” among the jurisdictions of the Member States.  176 The courts and regulators of a Member 
State shall have to balance the interests involved in the cross -border case before establishing the 
jurisdiction. When parallel proceedings are detected, the competent authorities of the involved Member 
States  contact  each  other  and  coordinate  in  order  to  avoid  duplication  of  work  and  risking  the 
breaching of the ne bis in idem principle.177 The competent authorities shall take into consideration all 
the prosecutions in one jurisdiction and the effect that prosecuting some defendants in one jurisdiction 
might have on any prosecution in a second or third jurisdiction. Similar considerations shall be taken 
by the law enforcement authorities when starting investigations ex-ufficio. During this decision-making 
process,  a  number  of  factors  should be taken into account178 and weighted according to national 
legislative frameworks on a case-by-case basis. 

The rule of reason by the designated authorities of the MS in pre -trial proceedings or in proceedings 
before the court is applied for identifying the Member State with the strongest connection, in terms of 
contacts or interests, with the criminal offe nce. The judicial exercising jurisdiction is granted to the 
better placed Member State, unless it fails to do so and harms the global interest (Ryngaert, 2014). In 
cases where several Member States claim jurisdiction on the basis of the effects of a criminal conduct, 
the applicable rule that avoids conflicts of jurisdiction refers to prima facie lawful jurisdictional claims, 

173 1st EGM feedback: Europol provided an example of negative conflict of jurisdiction concerning airline ticket fraud. 
174 1st EGM feedback: Experts pointed out that there are no obstacles due to substantive jurisdiction, i.e. there are 
quite good minimum rules in the FD. 
175 C ouncil Framework Decision 2009/948/JHA on prevention and settlement of conflicts of exercise of jurisdiction in 
criminal proceedings. 
176 Up to March 2017, a total number of 25 MS (BE, C Z, DK, DE, EE, HR, CY, LV, LT, HU, NL, AT, PL, RO, SI, SK, FI, 
SE ES, FR, IE, IT, LU, MT, PT) had notified the measures transposing the obligations of the Framework Decision 
2009/948/JHA. 
177 The situation where the same person is subject to parallel criminal proceedings in different Member States in 
relation to the same offence, which might lead to the final disposal of those proceedings in two or more Member 
States. 
178 Territoriality, location of suspected/accused person, availability and admissibility of evidence, obtaining evidence 
from witnesses, experts and victims, protection of witnesses, interests of victims, stage of proceedings, length of 
proceedings, legal requirements, sentencing powers, proceeds of crime, costs and resources, Member State’s 
priorities (Eurojust, 2016a). 

50 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

by presenting the proof that the specific jurisdiction has a preponderance of evidence on the facts , 
unless it can be reasoned that the case could be better dealt by the courts of another Member State  
(Clermont, 2006)(Clermont, 2006)(Clermont, 2006). 

The dual criminality keeps playing a key role w hen establishing jurisdiction over a cross -border case, 
and it sometimes creates loopholes. Alleged crimes are not investigated or prosecuted when they are 
not  recognised  as  crimes  in  corresponding  MS.  In  this  regard,  differences  in  national  provisions 
criminalising particular conduct may hamper extraterritorial investigations that require dual criminality 
and judicial cooperation between MS. Since the adoption of the EAW , the dual criminality verification 
(not dual criminality per se) in the context of surrender and extradition regimes has been abolished for 
a number of offences, including, among those covered by the FwD, fraud, computer-related crime, 
counterfeiting  of  products,  forgery  of  means  of  payment.  This  partially  contributed  to  reducing 
problems arising from concurrent jurisdictions. 

The Council Framework Decision 2009/948/JHA179 on prevention and settlement of conflicts of exercise 
of jurisdiction in criminal proceedings contributed to preventing potential infringement of the principle 
of ne bis in idem by setting procedures for exchange of information between national authorities  when 
more than one MS claims jurisdiction and replace the “random and often lengthy practice of traditional 
mutual legal assistance in criminal matters” (European Commission, 2014). Specifically, it sets out the 
procedures whereby competent national authorities of the EU Member States shall contact each other 
when  they  have  reasonable  grounds  to  believe that parallel proceedings are being conducted in 
another  EU  Member  State.  The contacted authority must reply without undue delay or within the 
deadline set by the contacting autho rity to confirm the existence of such parallel proceedings. Direct 
contact between competent authorities is the le ading principle of cooperation and Member States have 
the discretion to decide which authorities are competent to act in accordance with this Framework 
Decision. 

However, there are still some issues with regard to the cooperation between Member States when 
establishing the jurisdictional competence for prosecuting a criminal offence. For instance, there are 
differences  with  regard  to  the deadline set up by the contacted authorities to reply to submitted 
requests and to the type of information to be included in the request for information.180 Also the use of 
different  languages  may  create  an  obstacle  to  the  communication  between  MS. 181  To  conclude, 
prosecutors  in  some  MS are not obliged to not initiate or to withdraw proceedings as part of the 
consultations for setting up the jurisdiction. Moreover, direct consultations may be without prejudice to 
the introduction or conduct of pre -trial criminal proceedings in other countries (European Commission, 
2014). 

To  conclude,  despite  the  existence  of  a  common  EU  legislative  framework  to  solve  conflicts  of 
jurisdiction  when  more  than  one  MS  claim  jurisdiction  over  the  same  case, the national different 
practical implementation of these common principle leaves room for double jeopardy and burden when 
it  comes  to  the  exchange of information but also to negative conflict of  jurisdiction182. In order to 
support the identification of MS involved in a case and support the decision making process on the 
jurisdiction to be applied there the hit/non-hit feedback system of the Eurojust National Desks can be 
further strengthened together with the use of a common feedback template (EY, 2015). This will help 
LEAs to early identify in which jurisdiction there is information/evidence relating to the case they have 

179 All MS except BG and UK have notified the transposition of this Directiv e. 
180 Some countries transposed literally the wording others interpreted the requirements (FI, LV) or omitted to 
transpose the element in the urgent cases (AT, DE, LV, NL, PL, PT, RO and SK). Moreover, several MS have not 
specified in their national legislation the minimum information required to be included in the request for information 
(only AT, BE, C Z, FI, HR, HU, LV, NL, RO, SI and SK transposed it). 
181 Not all the countries use an international language (such as English), in addition to their own official language. 
Some countries have not notified the language they use for communication with other MS (CZ, NL, FI). 
182 1st EGM feedback: Europol provided an example of negative conflict of jurisdiction concerning airline ticket fraud. 

51 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

under  investigation,  or  which  jurisdiction  started  penal  procedure  against  a  person  subject  to 
investigation/prosecution in that MS. 

3.3.3  Cooperation  among  law enforcement  and judicial authorities   

EQ13:   Is there a need to improve cooperation among law enforcement authorities/judicial authorities 
and, if so, how could this be achieved? 

NCP frauds are becoming increasingly complex and with a cross -border  component.  

This  requires  an  extensive  coordinated effort between relevant competent authorities within and 
between Member States in terms of assuring the necessary powers and resources and sharing the 
relevant information and good practice to better conduct investigations and prosecutions. The current 
level of cooperation is not fully adequate 183 and there are several areas for improvement. National 
cooperation practices 

The cooperation between law enforcement and judicial authorities becomes increasingly important as 
criminals use sophisticated technical equipment that requires close cooperation with forensic experts. 
Moreover, as also highlighted by Europol, investigative measures become increasingly difficult to apply 
due to the fact that suspects use specific countermeasures, co rrupt police officers and hire influential 
lawyers. Law enforcement and prosecutors should be engaged early after cyber security incidents to 
allow for adequate investigation of the criminal aspects of such attacks (Europol, 2012). This of course 
related also to the existence of the needed competences to address the case and to the level of priority 
given to the specific case.  

Cooperation between law enforcement and judicial authorities varies significantly at national level. 
However there is evidence of some common approaches to enable the relevant authorities to  co-
operate well, including: 

  Specific  national  strategies  for  financial  crimes  and  cybercrime  –  covering  for  instance 
prevention,  detection,  investigation,  prosecution  of  offences  and  recovery  of  the 
proceeds  of  crime.  These  strategies usually foresee the  cooperation of a number of 
national  agencies,  such  as  tax  administrations,  Financial  Intelligence  Units  (FIU), 184 
police and specialised LEAs, judicial authorities and  financial regulators (see Box 5). 

Box 5 – Examples of national  strategies  for financial  crimes and cybercrime 

In 2010, Romania adopted the National Strategy on Prevention and Combating Money Laundering 185 
and Terrorism Financing and its Action Plan. This strategy foresees the cooperation among LEAs and 
judicial authorities in order to achieve the following objectives: 

  operative evaluation and identification of new risks and vulnerabilities based on the decisions 

in courts in the financial crime cases; 

  analysis of the judicial practice/final judges’ decisions; 
 

training of prosecutors and judges for a uniform approach to investigation, prosecution and 
ruling in court of financial crime cases. 

183 Interview feedback: three representatives from LEAs, one judicial representative, one from the private sector 
and two from EU institutions and bodies. 1st EGM feedback: Several representatives from the Public sector reported 
that international cooperation is not timely enough. 
184 FIUs can exchange Suspicious Transactions Reports (STR). 2 nd EGM feedback: Some representatives from the 
private sector said that STR are a great mechanism but it is time -consuming. Some representatives from the 
private sector not all FIU were willing to share information. 
185 The anti-money laundering legislation covers all-crimes approach (including fraud, counterfeiting, organised 
crime, etc.), respectively all predicate offences may conduct to laundering of money.  

52 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

The 2016-2024 UK Cyber Security Strategy also establishes objectives whose achievement depends 
on  law  enforcement  and  judicial  authorities’  close  cooperation,  and  namely  (HM  Government, 
2016): 

 

 

increased  numbers  of  arrests  and  convictions,  and  larger  numbers  of  criminal  networks 
dismantled as a result of law enforcement intervention; 

improvement  of  the  LEAs  capabilities,  including:  capacity  and  skills  for  both  dedicated 
specialists and mainstream officers; and enhanced overseas law enforcement capability. 

Source: Authors’ elaboration based on desk research 

 

.  
Provisions  in  national  legislative  frameworks 186  requiring  cooperation  and  coordination 
between  policy  makers,  supervisors  (such  as  central  banks,  financial  supervisory 
authorities), and law enforcement and judicial authorities.187  

  Multidisciplinary  working  groups,  task  forces,  advisory  authorities  or  inter-ministerial 
committees involving representatives of the relevant competent authorities, with the 
main  objective  of  facilitating  operational  and  strategic  cooperation.188  These 
arrangements are very often set up through protocols or memoranda of understanding. 
The magistrates are usually repre sented by the Ministry of Justice and practitioners in 
the courts are rarely involved.  
Liaison officers strategically placed within certain competent authorities – such as LEAs – 
to facilitate the exchange of information.189 

 

  Ad-hoc agreements between relevant authorities.190 

Current  structures  and  arrangements  for  cooperation  between  competent  authorities  are 
most of the time insufficient or inefficient. According to the Moneyval Horizontal Review on anti-
money laundering systems, results on matters requiring cooperation are still limited, approaches to 
cooperation  inconsistent  and  there  is  no  collective  and  regular  review  of  the  systems  in  place. 
Furthermore, national strategies or policies for financial crimes and investigation are still few and often 
lack  of  a  relevant  Action  Plan  for  implementation,  with  actions  being  limited  to  existing  legal 
provisions that seem to treat financial aspects as secondary elements of an investigation/prosecution 
(Council of the European Union, 2012). 

There  are  also  issues  relating  to  the  procedural  requirements  needed  to  execute  an 
investigative  measure.  A  study  made  in  2012  by  Visa  Europe  assessed  the aspects on criminal 
liability of individuals committing card skimming and/or committing fraud resulting from skimmed card 
data. The study revealed issues with the procedural acts for both the substantive law (e.g. BG, DE, IT) 
and  the  procedural  criminal  law  (e.g.  FR,  IT).  For  instance,  if  an  investigating  judge  is  involved, 
procedures are more formal and likely require more time before action is undertaken and this has an 
impact on arrests and seizure of evide nce/proceeds of crime. There are indications that delays in Italy 
and  Spain  occur  before  investigative  measures  can  be  executed,  to  the  detriment  of  ongoing 
investigations. Moreover, in Italy, Bulgaria and the UK investigative measures are accessible on th e 
basis of a warrant. The prosecution officer has to make a request demonstrating fundato motivo. The 
law does not prescribe if and under which conditions the investigating judge is authorised to issue a 

186 This is the case of, for instance, CY, HR, HU, MT, RO (Council of Europe, 2010). 
187 Art. 49 of the 4th Anti-Money Laundering (AML) Directive 2015/849 also indicates that “Member States shall 
ensure that policy makers, the FIUs, supervisors and other competent authorities involved in AML/CFT have 
effective mechanisms to enable them to co-operate and coordinate domestically concerning the development and 
implementation of policies and activities to combat money laundering and terrorist financing”.  
188 In France, for instance, there is a national unit that brings together data from various surveillance units from 
C yber C ustoms, Tax Office, Social Security Office, Police/Gendarmerie and others, in order to tackle the growing 
threat of Internet fraud (Ministry of Finance and Economy, 2012).  
189 This is the case, for instance, of HR and RO (Council of Europe, 2010).  
190 This is the case of, for instance, CY, HR, MT, RO (Council of Europe, 2010). 

53 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

warrant.  As  a  consequence,  there  is  no  certainty  tha t  investigative  measures  will  be  available. 
Furthermore, the decision of the investigating judge may be challenged in court proceedings, possibly 
leading to the exclusion of evidence  (Visa Europe, 2012).  

Based on an horizontal review of the reports on cybercrime prepared by the EU Council  - GENVAL 
Group,  roles  and  responsibilities  of  national  authorities  in  the  management  of  cyber defence 
are  not  always  clear  to  all  stakeholders,  and  most  of  the  activities to fight cybercrime relies on 
technical and human resources of the police who are responsible for preliminary investigations. This 
leaves limited space to the scrutiny of judges and prosecutors.  

Another  obstacle  to  cooperation  between  law  enforcement and judicial authorities relates to the 
processing  of  electronic  evidence  in  criminal  matters which seems to be only limitedly efficient 
with room for further improvement. 

Cooperation among law enforcement and judicial authorities can be eased by the adoption of good 
practice such as the creation of a relationship from the early stage after the occurrence of a NCP 
fraud. In general, involving judicial authorities from the beginning helps to better target investigations. 
Several MS have already a system where judicial authorities are involved in investigations.  

Cross-border  cooperation  practices 

Cross-border cooperation has been implemented through several treaties, conventions and agre ements 
at both EU and international level (see section 4.4). Moreover, some MS have established additional 
and specific mechanisms and structures of cooperation covering investigations, prosecutions and trial 
phases of financial crime cases (including NCP fraud and cybercrime (see Box 6).  

Box 6 – Examples of cooperation  structures  addressing  financial crimes 

  EU Cybercrime Task Force (EUCTF) is an inter-agency group formed by heads of Cybercrime 
Units with the participation of Europol, the EC, CEPOL and Eurojust, Interpol, and with Norway, 
Switzerland and Iceland as observers. This  group to discuss the strategic and operational 
issues relating to cybercrime investigations and prosecutions at EU level.  

  The Camden Asset Recovery Inter-Agency Network (CARIN), is an interagency network of law 
enforcement and judicial practitioners from 53 jurisdictions and 9 international organisations, 
with its General Secretariat within Europol, specialised in the field of asset tracing, freezing, 
seizure and confiscation of the proceeds of crime (Europol, 2013a). 

  FIU.NET Platform,  supported by Europol and the EU-FIUs Platform within the EC. This platform 
supports the exchange of information between the 28 Financial Intelligence Units of the EU 
Member States in the fight against money laundering and terrorism financing. 

  The  Asset  Recovery  Offices  (AROs) platform, which enables  cooperation between the AROs 
designated by the Member States in the field of recovery proceeds of crime. The platform was 
set up by Council Decision 2007/845/JHA. 

  Anti-Fraud Coordination Structures (AFCOS) was established through Regulation 883/2013 in 
order  to  facilitate  good  cooperation  and  exchange  of  information  (including  operational 
information) between the Member States, and with OLAF in the fight against fraud. 

Source: Authors’ elaboration based on desk research and field  research 

Despite  these  initiatives,  cooperation  between  MS  does  not  seem  to  be  fully  satisfactory.191 
The following factors have been identified as hindering cross border investigations and prosecutions. 

191 Survey feedback: 88% (n=14) chose the option “yes”; 13% (n= 2) replied “no”. Survey question: “Are there 
areas for improvement in terms of cooperation?” of a total 16 responding LEAs. Most of the representatives from 
LEAs (76%, n=16) chose the option “average”. Only 24% (n=5) out of total 21 LEAs responding to the question 
considered it “high”. The survey question asked: “To what extent is the level of cooperation between Member 
States satisfactory?”. 

54 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Criminal  activities  performed  in  non-EU  countries  (“third  countries”).  When  occurring in third 
countries, skimming and counterfeiting of payment cards may create some concerns when it comes to 
cooperation between involved countries. In most cases, LEAs and judicial authorities are limited by 
legal provisions, time frames and financial restrictions. This brings them to prioritise national cases and 
makes it difficult for them to prioritise cases with an international dimension. This hinders cooperation, 
and investigative/judicial measures rarely lead to dismantling the whole criminal structure (Europol, 
2012).  

Differences in national  reporting  systems.  As better explained in section 4.2.3, there are different 
reporting  obligations  at  national  le vel,  different  ways  of  categorisation  of offences , and different 
mechanisms for sharing information. Such differences  make the information exchange between MS 
more time consuming or risk to leave partially uncovered some cross-border offences. This is the case, 
for instance, of the cross-border dimension of many episodes involving identity theft which is generally 
not addressed because of gaps in the current systems of reporting (Robinson, Graux, Parrilli, Klautzer, 
& Valeri, 2011).  

To ease cross-border cooperation, reporting mechanisms should be as standardised and homogeneous 
as possible across Member States and, as also emphasised by Europol, there is a need for a proper 
coordination and communication between the processing and reporting systems of different countries.  

In this respect, it is worth it considering that common EU IT platforms for the exchange of information 
such  as  the  Secure  Information  Exchange  Network  Application  (SIENA)192  proved  to  be  widely 
appreciated193 and can be considered for further adoption. Moreover, the transposition of Directive 
2014/41/EU  on  EIO  by  May  2017  should provide clear guidance to the MS and so should simplify 
cross-border investigations.194 The practical implementation of the Directive will allow the MS and the 
COM to identify the technical areas that show progress in the cross —border cooperation and obtaining 
evidence, as well as aspects that will need further improvement. 

Lack  of  harmonisation  of  national  standards  on  the  admissibility  of  evidence.  This  can  also 
prevent cross-border investigations from continuing and create obstacles when evidence is accepted in 
one MS and rejected in another.  

Differences  in  the  systems  for  the  exchange  of  information  used  by  judicial  authorities  and 
by LEAs. National judicial authorities and law enforcement authorities adopt specific mechanisms for 
the exchange of information that can strongly differ thus hindering cooperation. In some countries a 
type of information belongs to the judiciary, while in others to law enforcement authorities. Moreover, 
there is also an overall limited knowledge of existing mechanisms and cultural reluctance to share 
sensitive information (Disley, Barrie, Hughes, and Patruni, 2012; European Commission, 2013c).  

Though  completed  over  a  decade  ago,  the  study  prepared  by  the  COM  and  IRCP  (Institute  for 
International Research on Criminal Policy Ghent University)195 addresses this problem in relation to the 

192 The Secure Information Exchange Network Application is a platform which enables the exchange of operational 
and strategic crime-related information among: Europol’s liaison officers, analysts and experts, Member States and 
third parties with which Europol has cooperation agreements. This platform is often used when it comes to the 
exchange of information on cross-border cases and it ensures the respect of different privacy laws.  
193 Overall, SIENA has been indicated in the survey and during the interviews by 12 representatives from LEAs, five 
from judicial cooperation representatives, three from EU institutions and bodies, one from PPP and one from legal 
professions. 
194 The EIO Directive supports the competent authorities of the Member States in carrying out investigative 
techniques by the request of another MS based on mutual recognition. By issuing an EIO, a judicial authority of a 
MS may obtain evidence to be used for prosecution and judicial purposes . 
195 The book analyses the possibility to improve the cross-border exchange of law enforcement relevant information 
through the introduction of the principle of mutual recognition of ‘pre -evidence warrants’ as a primary way for 
implementing the availability principle. Such warrant could be issued by the member states law enforcement and 

55 

 
 
                                                 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

pre-evidence  phase  of  criminal  proceedings  and  provides  arguments  that  are  still  valid  today 
(Vermeulen, Vander Bekern, Van Puyenbroeck, and Van Malderen, 2005). Specifically, in the pre-trial 
phase, LEAs can exchange information regarding the crime investigation according to the principle of 
availability. The information is to be used as a basis for obtaining evidence that would be presented in 
front  of  a  judicial  authority.  This  falls  under  the  scope  of  the Council Framework Decision on the 
European Evidence Warrant (EEW) or other mutual legal assistance instruments.  According to the 
report,  there  was  a  need  for  the  competent  judicial  authorities  of  a  Member  State  to  request 
information from the law enforcement authorities of other state in the pre-trial stage without having to 
use the traditional legal assistance procedures. This should however be facilitated by the use of EIO 
which should have been transposed by all MS in May 2017.196 Also, LEAs should no longer be hindered 
by the necessity of obtaining a judicial authorisation if the MS requires so. 

Lack  of  common  working  practices.  Member  States  adopt  specific  working  practices  and  have 
divergent approaches to entering data into the Eurojust Case Management System197 in terms of both 
type and quantity of data. There is also a strong cultural resistance to homogenising working practices  
(EY,  2015).  This  might  eventually  have  a  negative  impact  on  the  capacity  of  Eurojust  to provide 
valuable information to competent national authorities. 

Lengthy  procedures  for  the  exchange  of  information.  The  exchange  of  information  between 
Member States through traditional mechanisms of mutual legal assistance often takes time  (Disley et 
al., 2012; European Commission, 2013c).198 Obtaining evidence located outside the Member State 
leading the investigation can be a lengthy and time-consuming procedure,199 which is not adapted to 
the  digital  age.  This  is  due,  among  others,  to  practical  reasons  such  as  the  time  required  for 
translation and for responding to the mutual legal assistance requests which may reflect different le vel 
priorities and workloads of concerned authorities.  

The  use  of  EIO  since  May  2017  will  bring  more  powers  to  the  requesting  Member  States  and 
obligations to the requested Member States and should at least mitigate the is sues listed above and 
facilitate the provision of MLA. 

Moreover, in order to improve cross-border cooperation for investigations and prosecutions, MS have 
implemented some initiatives mainly aiming at easing the exchange of information (see the Box 7). 

Box 7 - ECRIS initiative to overcome obstacles  in cross-border prosecutions 

Since 2012, 26 Member States have been using the European Criminal Records Information System 
(ECRIS), a computerised system that facilitates exchanges of information between MS on previous 
criminal  convictions  of  EU  nationals.  As  it  removes  the possibility for offenders to escape their 
criminal  past  simply  by  moving  from  one  EU  country  to  another,  the  system  can  facilitate  the 
passing of sentences and serve to prevent crime .200 

judicial  authorities  where  the  need  to have information relates to crime investigations or criminal intelligence 
operations during the pre-evidence phase regarding serious EU core offences. 
196 C ouncil Framework Decision 2008/978/JHA on the European evidence warrant (EEW) was replaced by Directive 
2014/41/EU on the European Investigation Order (EIO). The EIO will apply between 26 Member States and the EEW 
will remain applicable between the only two Member States which do not participate in the EIO. EEW will remain 
valid for a transitional period until the relevant criminal proceedings for which EEW was used have been concluded 
with a definitive decision. 
197 A system established by Eurojust, and containing temporary work files and an ind ex which personal and non-
personal data. 
198 Survey feedback: six representatives from LEAs. Interview feedback: five representatives from LEAs, one from 
NBF and one from the private sector. 
199 Survey feedback: two representatives from LEAs. 
200 Retrieved from the web page: http://ec.europa.eu/justice/criminal/european-e-justice/ecris/index_en.htm. 

56 

 
 
                                                                                                                                                              
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Source: Authors’ elaboration based on desk research 

Also Joint Investigation Teams (JITs)201 are tools to investigate cross-border cases, but they imply 
lengthy processes affecting the overall efficiency of investigations and prosecutions  (Council of the 
European Union, 2015a, 2015b, 2016b).  

Moreover,  the  sharing  of  good  practice s,  knowledge  and  experiences  between  LEAs and judicial 
authorities can allow for a better identification and understanding of key issues  (Disley et al., 2012; 
European  Commission, 2013c). Training or other learning activities at EU level might  also help, by 
bringing together representatives from LEAs and judicial authorities.  

As also highlighted by stakeholders,202 Europol and Eurojust also play a key role in enabling cross -
border cooperation, allowing for the identification of MS working on the same targets through the 
analysis of the information provided by the MS. 

Europol’s  role  is  relevant  especially  in  easing  cross-border  investigations.  The  facilitation  of 
information  flows  between  Member  States  allowed  by  Europol,  its  analytical  capacities  and  the 
technical support it provides are highly appreciated.203 As shown in Box 7, Europol supports a number 
of  networks  (such  as  the  ARO  platform  and  the  CARIN  network).  It  also  supports  the  European 
Multidisciplinary Platform Against Criminal Threats EMPACT project “Cybercrime Card Fraud” where 
national LEAs co-operate with each other (as well as with other key stakeholders of the subject matter) 
and are committed to implement a number of joint operational actions over the years and to attend 
regular  meetings.  European  Money  Mule  Action204  (see  Box 8) is a good example of cross-border 
cooperation supported by Europol through EMPACT.  

Box 8 – European Money Mule Action 

From  22  to  26  February  2016,  LEAs  and  judicial  bodies  from  Belgium,  Denmark,  Greece,  the 
Netherlands, the United Kingdom, Romania, Spain and Portugal with further support from Moldova 
and other countries joined forces in the first coordinated European action against money muling. 
The operation was also supported by Europol, Eurojust and the European Banking Federation. 
During the week, EC3 and the  Joint Cybercrime Action Taskforce  (J CAT), together with Eurojust 
and EBF, provided operational and analytical support to the involved partners. As a result of the 
operation, nearly 700 money mules were identified across Europe and 81 individuals were arrested 
after  198  suspects  were  interview ed  by  LEAs.  With  the  support  of  over  70  banks,  significant 
financial losses were discovered and prevented, and over 900 victims of this crime were identified. 
More  than  90%  of  the  reported  money  mule  transactions  were  linked  to cybercrime  (Europol, 
2016a).  
Source: Authors’ elaboration based on desk research 

Another way Europol contributes to cross border cooperation is through the activities of the Focal Point 
Terminal, which provides operational and analytical support to major operations relating to both card -
present  fraud  (requiring  the  physical  presence of the card for committing the crime) and  Internet 

201 A JIT is an investigative team that is set up for a fixed period and for a specific purpose, based on an agreement 
between or among two or more law enforcement authorities in EU Member States. Competent authorities from 
countries outside the EU may participate in a JIT with the agreement of all other participating parties.  
202 Interview feedback: six representatives from LEAs, four judicial representatives, four from Public-Private 
Partnerships (PPP) and two from the private sector have expressed positive opinions on Europol. T hree 
representatives from LEAs, three from judicial cooperation representatives and two from EU institutions and bodies 
have expressed positive opinions on Eurojust.  
203 Interview feedback: four representatives from LEAs, three from PPP and one from NBF.  
204 The European Money Mule Action (EMMA) is a pilot operational project under the flag of EMPACT (European 
Multidisciplinary Platform against C riminal Threats) –an EU multi-annual policy cycle- designed to combat online 
and payment card fraud. This action builds upon the partnership between the police, the prosecution and the 
banking sector at the national as well as the interna tional level. 

57 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

based card-not-present frauds, as well as sophisticated ATM and retail point-of-sale terminal skimming 
attacks (Europol, 2013b).205 Irrespective of any deterrent impact – which may be difficult in website 
take-down s- actions launched at EU level are important symbolic mechanisms for showing European 
individuals and businesses that something can be done and is being done about these social harms and 
imposing some costs on crime networks who otherwise are encouraged to continue  (Giommoni and 
Décary-Hétu, 2017). 

Eurojust  offers  great  potential  for  coordinating  investigations and prosecutions and it plays a 
fundamental  role  in  solving  conflicts  of  jurisdiction (Art. 82(1)(b) and Art. 85(1)(c) of the TFEU). It 
also ensures the efficiency of prosecution and assets seizure in cross -border cases. The College of 
Eurojust may intervene in the resolution of a conflict of jurisdiction if two or more autho rities of the 
Member States cannot agree on how to settle it. In case of conflict regarding the investigations or 
prosecution, the College issues a written, non-binding opinion provided that the matter cannot be 
resolved through mutual agreement between the competent national authorities concerned (Council of 
the  European  Union,  2002).  In  2015,  Eurojust  received  35 notifica tions under this provision. The 
annual increase in the number of notifications shows that Member States do make use of Eurojust 
services and acknowledge their importance, as also further confirmed by interviewees  (Council of the 
European Union, 2016a).206  

Both  Eurojust  and  Europol  have  national  bureaux  or  desks  (in  each  Member State) that may be 
contacted  by  the  national  LEAs  and  authorities when a case involving several MSs starts. In this 
situation  the  national  authority  contacts  the  national  desk  to ask  for support. Depending on the 
procedural stage (prosecution or trial), Europol or Eurojust may contact the other LEAs and judicial 
authorities of other MS involved and ease the cooperation. Moreover, the national desk of Eurojust is 
often addressed for advice in drafting a request for mutual legal assistance in order to avoid being 
rejected by the receiving Member States, due to the differences existing in the national criminal laws. 

205 In 2013, the EC 3 investigations resulted in the disrupting three organised networks of credit card fraudsters. The 
operations led to the arrest of 90 suspects who had made more than €9 million profit by compromising the payment 
credentials of 81,000 credit card holders. 
206 Interview feedback: three representatives from EU institution and bodies , four from LEAs, one judicial 
representative, one from the private sector and one from academia.  

58 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

4 

EVA LUA TION  RESULTS 

4.1  Relevance 

EQ7: 
into account technological developments?  

Is the scope (definition of "payment ins trument") of the Framework Decision still valid, taking 

Are newer forms of "value transfer", including non-corporeal means of payment, covered by national 
legislation? (e.g. mobile payments, centralised and decentralised virtual currencies, fidelity/ loyalty 
cards, fuel cards, commercial cards, coupons, prepaid debit cards). 

Are newer forms of crime covered by the current provisions in the Member States, as, for instance (but 
not  only):  phishing,  collecting  data,  trafficking  of  (stolen)  credentials  (for  instance  on  carding 
websites), acting as money mule. 

Definition of payment instruments 

The criminal law framework set by the FwD lays the ground and set common rules to support the fight 
against  fraud  in  and  counterfeiting  of  NCP  instruments. Starting from this framework, several MS 
adopted more stringent laws to ensure a continuous relevance of their legislation to the evolving 
criminal phenomenon. While this has in principle created better conditions to enforce the law, obstacles 
to investigations and prosecutions showed that there is still room for improvement.  

Specifically, the definition of payment instrument contained in the FwD does not appear to be fully 
relevant in view of recent technological developments. Most of the stakeholders 207 consulted consider 
this definition to be only partly appropriate. Moreover, all MS went beyond the FwD definition and 
adopted a wider and more inclusive definition which covers more types of NCP instruments than the 
ones listed and covered by the FwD. 

Firstly, the FwD definition appears to be outdated. Some of the examples it provides are no more 
representative  of  the  types  of  payment  instrument  in  use.  In  particular,  the  FwD  mentions 
eurocheques and eurocheque cards which have become obsolete with the development of the credit 
and debit card and the euro. This is also confirmed by stakeholders answering the survey. 208 

Moreover,  the  definition  of  payment  instruments  does  not  cover  new  forms  of  payment 
instruments,  namely  non-corporeal  means  of  payment  (such  as  virtual  payment  cards,  mobile 
money, virtual currencies) that are increasingly targeted by fraudsters. Therefore offences relating to 
payment instruments as listed in Art. 2 are limited to conduct that involve corporeal instrumen ts. The 
same offences involving non-corporeal payment instruments are therefore uncovered at least when 
relating to theft and misappropriation, counterfeiting and falsification, possession and transportation. 
Misuse  of  non-corporeal  payment  instruments  (and  more  specifically  computers  data)  is  partially 
covered  by  the  FwD  (Art.3).  For  example,  sending  an  uncorporeal  wire  transfer  without  the 
authorisation of the bank account owner is covered (without right introduction of identification data) 
but phishing involving a victim sending a wire transfer to the fraudster is not covered (the fraudster 
has neither used any computer data nor interfered with a computer system). 

207 Interview feedback: four representatives from the private sector, one from NBF, one from legal professions, two 
from Asso and DPA, one judicial representative and one representative from EU institutions and bodies. In the 
survey, a high percentage of respondents among the different categories (47%, n=40) ranked as “medium” the 
appropriateness of the definition of payment instrument, and 17% (n=15) ranked as “low” the level of 
appropriateness when responding to the question “Please rate the appropriateness of the definition of “payment 
instrument” in the Framework Decision, considering the technological developments occurred in terms of non -cash 
means of payment”.  
208 Survey feedback: one representative from Asso and DPA, one from NBF and one from the private sector.  

59 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

The Payment Service Directives and the Directive on Attack against information systems impro ved the 
relevance  of  the  current  legal  framework  by  enlarging  the  scope  of  the  definition  of  payment 
instruments  and  including also non-corporeal payment instruments. However, some experts have 
reported  challenges  due  to  the  dual  nature of virtual currencies as computer data and monetary 
value.209 In addition, virtual currencies are the main payment instrument that still falls outside the 
scope of existing legislative measures, and remains uncovered by most of the MS.210 This may pose 
security concerns in so far as this payment instrument will gain importance in the near future. 

Moreover, while the definition of payment instrument excludes non -corporeal instruments, it is worth 
highlighting that Art. 3 (offences relating to computers) and Art. 4 (offences relating to specifically 
adapted devices) of the FwD allow MS to criminalise forms of frauds that recently gained increased 
importance  such  as:  the  use  of  malwares  on  computers  or  on mobile phones, pharming, remote 
manipulation of devices (e.g. ATM, POS) for instance through the use of ATM malwares, man in the 
middle attacks, and the exploitation of data breaches. Also skimming, which is a very common type of 
non-cash  payment  fraud,  falls  into  the  scope of Art. 4 on specifically adapted devices of the FwD 
because it requires an instrument (which is added to an ATM or a POS) to counterfeit a payment card 
(Council of the European Union, 2015d; Europol, 2016b). 

However, the use of unlawfully appropriated computer data covered by Art. 3 is criminalised only when 
offences result intentionally in a transfer of monetary value. This means that preparatory or supportive 
conduct  that  precedes  an  offence  related  to  computer  (Art.  3)  without  resulting  in  a  transfer  of 
monetary value is currently not criminalised by the FwD.  

Furthermore, recent technological developments may increase difficulties in the interpretation of this 
article:  does  “computer”  include  mobile  devices ?  Do  computer  data relate only to data physically 
stored  in  computers  or  those  stored  in  ‘the  cloud’  are  also  covered?  Based  on  the  definition  of 
“computer data” or “computer programme/system”, a payment instrument can be included or excluded 
from the scope of FwD, and this creates a grey area that fraudsters might exploit without significant 
risk of conviction. This may have an impact on the national coverage of theft and misappropriation, 
counterfeiting  and  falsification, possession and transportation con nected to data breaches 211 and 
network attacks for the ultimate purpose of misusing the non -cash means of payment since they are 
not specifically criminalised by the FwD.  

Considering the increasing dematerialisation of payment instruments and the opportunit ies offered by 
the  Internet  for  payment transactions, it is of the utmost importance to clearly set the legislative 
framework  of  reference  and  limit  heterogeneous  interpretations.  In  addition,  if  new  payment 
instruments emerge in relation with the Internet of Things, computer systems and data should be 
clearly defined in order not to create confusion on whether these new objects are covered by the FwD. 

.  This  conduct  may include cases of social engineering when the manipulation aims at divulgating 
confidential information. 

Several  MS  widened  the  scope  of  forms  of  conduct  criminalised  either  by  adopting  a  more 
comprehensive definition of payment instrument than the one used by the FwD, or by avoiding any 
direct  reference  to  payment  instruments  when  describing  the  conduct  criminalised.  The  lack  of 
criminalisation by the FwD of conduct relating to some types of payment instruments that are growing 

209 Input provided during the 1st Expert Group Meeting. 
210 An underlined in the 1st EGM, an exception can be found in Greece where the national legislation includes 
provisions extending the payment fraud rules to anything having monetary value by using the broader term 
"electronic money”. 
211 2nd EGM feedback: the fact that the possession of card credentials is not criminalised in some MS has been 
identified as an issue. 

60 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

fastest, together with the choice for more extensive criminalisation adopted by several MS, challenge 
whether and to what extent the provisions of the FwD are adapted to cope with the emerging trends as 
well as correspond to the needs of the stakeholders, and point at areas to be further considered for its 
future review. 

Criminal offences 

The analysis of the dimension of crime (see section 4.3.1) highlighted that most of the recent criminal 
offences  fall  into  the  types  of  offences  identified  by  the  FwD,  i.e.  theft  and  misappropriation, 
counterfeiting and falsification, possession and transportation, and misuse of payment instruments or 
related data. Therefore, the forms of conduct included in the FwD seem to be overall relevant to the 
evolution of the criminal phenomenon.  

However,  there  are  some  behaviours,  currently  out  of  the  scope  of  the  FwD,  which  are  gaining 
importance  for  non-cash  payment  frauds.  Even  though  these  forms  of  conduct  do  not  directly 
constitute criminal offences to payment instruments, computers or specifically adapted devices, they 
indirectly  affect  non-cash  means  of payments since they are increasingly used to perform related 
offences, and eventually affect the overall consumers’ trust in the digital market.  

Social engineering, is an example of newer crime where attacks may result in the victim voluntarily 
transferring the funds to the fraudsters without the fraudster having misused neither any payment 
instrument nor any computer or specifically adapted device. These types of social eng ineering attacks 
are thus out of the scope of the FwD. At the same time, the increasing use of Internet and of NCP 
instruments facilitated the spread of these attacks and created additional opportunities for fraudsters 
that increasingly perform these attacks in relation to non-cash payment instruments.  

Also in the case of acting as a money mule the criminal conduct does not directly have a ny payment 
instrument  as  an  object.  However,  more  than  90%  of  money  mule  transactions  are  linked  to 
cybercrime, and the illegally obtained money often comes from malware attacks, on -line shopping/e-
commerce  fraud,  payment  card  fraud,  business  e -mail  compromise,  and  other  kinds  of  non-cash 
payment  frauds  (Europol,  2017).  The  spread  of  NCP  instruments  somewhat  contributed  to  the 
perpetration of this criminal offence. 

All  MS  have  criminalised  phishing.  The  majority  of  the  MS  (15)212  do  so  through  other  general 
provisions 213 while the remaining MS (13)214 have introduced specific provisions.215. 

All MS criminalise the participation in a NCP fraud so all national laws cover acting as a money mule 
when it is related to an offence co vered this national law. However, only some MS (12)216 explicitly 
cover money muling. 

Further types of criminal conduct can be preparatory or supportive to NCP frauds and are of increasing 
importance such as: data breaches, identity theft/theft of credentials and trashing.  

Data breaches. The main sources of illegal data in case of card-not-present frauds are data breaches, 
often  facilitated  by  insiders  and  malicious  software.  In  most  of  these  cases,  the  quantity  of 
compromised card details is substantial, reaching hundreds millions, enabling criminals to sell the bulk 

212 AT, DE, DK, EE, EL, ES, FI, FR, HU, IE, IT, LU, NL, SK, UK. 
213 1st EGM feedback: for instance, France has a specific provision criminalising the harvesting of personal data 
which enables to cover phishing. 
214 BE, BG, C Y, CZ, HR, LT, LV, MT, PL, PT, RO, SE, SI. 
215 1st EGM feedback: for instance, Romanian criminal code includes specific provisions on forged website or email. 
216 BE, C Z, EE, EL, HR, IE, LT, MT, PL, PT, RO, SE. 

61 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

data on the Internet on carding sites (European Commission, 2015). Fraudsters stealing, selling or 
buying these data are not targeted by the FwD as the FwD only criminalise forms of conduct involving 
the introduction, alteration or suppression of computer data directly resulting in the transfer of money 
or of monetary value. However, most MS except CY, IE, IT, LU, SI, UK have provisions in their national 
legislation covering this form of fraud.  

Identity theft/theft of credentials (see also section 4.3.1). The lack of a common definition for identity 
theft makes it hard to set out across the EU the types of illegal actions linked to this crime. When 
taking  the  widest  definition  of  identity  theft,  covering  both  the  misappropriation  and  the  use  of 
personal data, then it is covered by the FwD only when it directly results in a transfer of money or 
monetary  value  and it has been performed either through the interference without right with the 
functioning  of a computer programme or system217, or through without right introducing computer 
data, in particular identification data. However, even when identity theft does not meet these criteria, 
it is often preparatory and supportive of card-not-present fraud (European Commission, 2015). Most of 
the MS218 acknowledge the relevance of the criminal phenomenon and cover identity theft b y their 
national  legislation,  in  some  cases  adding  some legal pre -conditions.219 Some national legislation 
identified the illegal origin of credentials as a condition for criminal action and underlined the need to 
cover all types of credentials. However, in the current situation only some national legislation have a 
definition of "credentials" while the majority requires to prove their fraudulent use.220 

Trashing221 is another preparatory conduct which is not covered by the FwD while being covered by 
most national legislation (22).222 This is evidence that the offence is considered by the MS as critical 
enough to require a legislative response to the phenomenon. 

Today, there are still a few MS national laws that do not cover newer forms of crime. Many MS went 
beyond the types of criminal offences listed in the FwD and developed provisions to cover additional 
trends  in  terms  of  NCP  frauds.  Furthermore,  the  Directive  on  Attack against information systems 
extended the scope of the offences relating to computers and to s pecifically adapted devices envisaged 
by the FwD, and covers recently emerged offences. 

4.2 

Effectiveness 

4.2.1  Baseline situation   

This section provides an overview of the legal context in MS before the transposition of the FwD. These 
preliminary  observations  should  support  the  assessment  of  the  impacts  of  the  FwD  against  the 
“baseline” scenario where no binding EU legislation applied. 

Before the adoption of the FwD, national criminal legislation varied 223 in relation to: the definition of 
payment instrument ruled by the law; the definition of offences of counterfeiting and fraud used 

217 Indeed, “without right interfering with the functioning of a computer programme or system” is the only of the 
offences provided for in the FwD which can correspond to identity theft.  
218 AT, BG, C Y, C Z, DE, DK, EE, EL, ES, FI, FR, HR, IT, LT, LV, MT, NL, PL, PT, SE, SK, UK. 
219 For instance, some MS (at least CZ, EE, FR, IT, LV, PT, SE) consider identity theft a crime only when it resulted 
in a damage (financial or other kind of social or psychological consequences) for the victim. As underlined in the 1st 
EGM, in EE identity theft is punishable independently from fraud-related provisions provided the condition of the 
damage is met. In MT, it is necessary to prove that the offender has fabricated non existing events and lies, PL 
considers identity theft a crime only upon the harmed party's motion while EL prosecutes identity theft ex officio. 
220 Inputs provided during the 1st EGM. 
221 Trashing is the process by which the performance of a system is considerably slowed down because data have to 
be transferred back and forth from the hard drive to the physical memory and thus the verification processes will 
not run properly.  
222 All MS except IE, IT, LU, NL, SK, UK. 
223 This is the result of the Evaluation team’s analysis of the two Implementation reports.  

62 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

by MS; the sanctions according to the national law. These sources of diversity provided the ground 
for  the  EU  intervention.  The  FwD  pursued  the  approximation  of  criminal  laws  to  ensure  an 
equivalent  and  increased  protection  against  the  fraud  and counterfeiting of non-cash means of 
payment.224  

To comply with the FwD provisions, most MS adopted amendments to the national Criminal Codes and 
took the necessary measures to ensure an effective, proportionate and dissuasive protection against 
the NCP frauds (as required under Art. 14 of the FwD). Already in 2003, n ine MS (FI, FR, DE, IE, IT, 
NL,  ES,  SE,  UK)  communicated  to  the  COM  the  provisions  transposing  in  the  national  law  the 
obligations of the FwD (European Commission, 2004b). 225 

Most  MS  used  broad  notions  or  definitions  (i.e.  theft,  robbery,  or  misappropriation)  to  cover the 
offences  referred  to  in  Article  2  (a)  and  “counterfeiting,  falsifying  and  altering”  of  the  payment 
instrument were used to comply with Article 2 (b).226 More general terms were used by most MS to 
transpose Article 2(c). Generally, MS covered the incrimination of fraud to the payment instruments 
listed in Article 1. 

In some cases, the FwD provisions led to changes in the national legislation.227 In others, the FwD 
provisions  did  not  determine  any  significant  advancements  since  the  national  legislation  already 
covered those provisions.228 Some specific examples are illustrated below: 

 

  BE  –  Definition  of  payment  instrument  Belgium  did  not  adopt  any  specific 
provisions transposing the FwD as general provisions already existed and national 
legislation already complied.229 In 2000, Belgium introduced amendments to the Criminal 
Code to cover the offences related to computers (Art. 3 of the FwD). 
IT  –  Offences  Following  the  entry  into  force  of  the  FwD,  Italy  did  not  adopt  new 
legislation  for  the  specific  purpose  of  ensuring  compliance  with  the  new 
provisions but sent information on the existing legislation.230 Already in 2004, Italy was 
the only MS covering incrimination of fraud against payment orders (not included in the 
list).  In  2010,  the  Italian  Government  adopted the legislative decree containing the 
necessary rules for the implementation of the FwD (Law n.96 June 4 th 2010).  

  LU-Offences  In  Luxembourg,  the  legislative  process  for  fully  transposing  the 
imposed  by  the  FwD  into  domestic  law  was  rather  slow.231 
obligations 
Luxembourg  national  legislation  used  general  concepts  and definitions to cover the 
offences referred to in Art. 2(a) while specific legislation was introduced to transpose 
Article  2(b),  (c)  and  (d).232  In  2006,  LU  introduced  specific  provisions  on  the 
counterfeiting and falsification of non-cash means of payment (Law of 10 th November 

224 However, in complying with the new ruling, MS had some discretion in determining the nature and severity of 
the penalties and the criteria determining the seriousness of an offence. 
225 DE, IE, IT, SE and the UK specified that there was no need for new national legislation to comply with the FwD; 
DK and PT did not send any communication to the COM; BE declared that the legislation was already c ompliant with 
the FwD; AT and LU initiated specific legal preparatory work to comply with the new provisions.  
226 FR, DE, IT, SE, UK made a specific distinction between counterfeiting, on the one hand, and altering, on the 
other. 
227 For instance, ES criminal legislation did not criminalise fraudulent altering of payment instruments, but just 
counterfeiting; NL did not make the distinction between ‘obtaining’ and ‘possession; SE penal code did not cover 
fraudulent use covered by Article 2(d) of the FwD (European Commission, 2004b). 
228 As for the offences related to computers, for instance, these were already punishable in MS respective criminal 
legislation (European C ommission, 2004b). 
229 As underlined in the first Implementation Report to the COM, BE claimed that transposition was not needed 
(European Commission, 2004b). 
230 As underlined in the first Implementation Report, IT sent to the C OM a short implementation table on Articles 2, 
3, 4 with extracts from the criminal code in 2003 (European Commission, 2004b). 
231 As stated in the second Implementation Report of the COM, the national legislation was still ongoing through 
Parliament in 2006 (European Commission, 2006). 
232 There were no provisions covering the offences referred to in Art. 4 (European Commission, 2006). 

63 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

2006). These provisions amended parts of the penal code in order to transpose some 
provisions of the FwD.  

  FR  –  Definition  of  payment  instrument  France specifically introduced between in 
2001 and 2013 new national legislation  to comply with the FwD (Artt. 2 to 12) and 
amendments to the criminal Code to cover the various types of offences  which, in some 
cases, were covered through generic offences. In addition, the French legislation applied 
a broad definition of means of payment.233 

Overall, the impact of the FwD cleary depends on the degree of proximity of the national legislation 
which  determines  the  number  of  amendments  and  new  legislation  needed  to  comply  with  new 
obligations.  

4.2.2  Effectiveness  of the Framework Decision 

EQ6:  To  which  extent  the  objectives  of  the  Framework  Decision  have  been  met?  Has  crime 
become  less  frequent?  Have  investigations,  prosecutions  and  convictions  increased?  Have 
organised  crime groups  been disrupted?  Or obliged to "migrate"? 

This section assesses to what extent the FwD has achieved its three main operational obje ctives (as 
indicated in the intervention logic at section 2.1.2), and eventually contributed to creating conditions 
for effective investigations and prosecutions of NCP frauds (the strategic objective of the FwD). The 
following pragraphs illustrate the main results achieved to meet each objective. 

Harmonisation of the scope of criminal offences 

Overall,  national  legislation  combating  fraud  in  and  counterfeiting  of  NCP  instruments  is not fully 
harmonised  and  it  is  difficult  to  isolate  the  contribution  of  the  FwD  towards  the  current  level  of 
harmonisation. As a FwD, it does not provide any operational guidance and only sets high level rules 
and principles that have been operationalised differently by MS. The partial approximation of national 
legislation on some provisions makes it difficult to exchange info rmation between MS, raising issues of 
legal uncertainty.  

The  definition of payment instrument of the FwD has been transposed in all MS. National laws 
adopt similar definitions that have often a broader scope than the FwD definition and include also non-
corporeal means of payments (e.g. mobile payments, money remittance, e -money). The current level 
of harmonisation is not the result of the FwD only, as most of the MS have adopted the definition of 
payment instrument included in the Payment Service Directive s that followed temporarily the FwD. 

Criminal  conduct  included  in the FwD is punishable in most of the MS. However, there are still 
some differences in the way they are covered (e.g. generic provision on theft or specific provision on 
the theft of payment instrument), and some forms of conduct (especially fraudulent use of unlawfully 
appropriated  payment  instruments )  are  not  fully  defined  in  all  MS.  This  affects  cross-border 
investigations and prosecutions  and raises the need for further approximation.  

Most  MS  punish  offences  envisaged  by  the  FwD  through  specific  penalties.  Most  of  the  MS 
include, at least in serious cases, penalties involving deprivation of liberty (such as imprisonment). 
Counterfeiting and falsification of payment instruments is the most heavily punished offence, while 
offences relating to specifically adapted devices are punished with the lowest levels of penalties. Levels 
of penalties for similar offences vary significantly across MS, especially with regard to counterfeiting 
and falsification of payment instruments. While this can be an indicator of a limited proportionality234 of 

233 “Any instrument which enables any person to transfer funds shall be deemed to be a means of payment, 
regardless of the medium or the technical process used” (Code monétaire et financier, Article L. 311-3). 
234 i.e. of consistency of the level of penalty with the severity of the crime. 

64 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

the penalty at EU level, it is also the result of the fact that the legislator intentionally left room to MS 
to decide the most appropriate measures to punish criminal offences. Variety in the level of penalties 
has been identified as an issue by the consulted stakeholders, leaving room for opportunistic criminal 
behaviour that facilitate fraudulent activities and thus reduce the protection of the natural and legal 
persons.235  

There  are  also  common  principles  adopted  at  national  level  with  regard  to  jurisdiction,  even 
though few  MS went beyond the minimum requirements established by the FwD. This can be partially 
explained  by  the  fact  that,  in  a  context  of  increased  international dimension of NCP fraud, other 
international and European legislation provided for more cases of application of the MS jurisdiction.  

With regard to the liability of legal persons, almost all MS have fully transposed the provisions 
of  the  FwD  and  all  MS  have  transposed  the  corresponding  sanctions.  Several  MS  have  added 
triggers  of  liability  to  the  one s  mentioned  in  the  FwD  therefore  creating  a  more  stringent  legal 
framework.  

Sanctioning of offences by Member States  

It is difficult to isolate the contribution of the FwD in ensuring that MS take action to sanction offences 
(see section 4.5). Data available do not allow to establish any direct correlation between the entry into 
force of the FwD and the dimension of crime. However, there is evidence that NCP fraud has globally 
increased in both absolute and relative terms in the last years, a nd investigations, prosecutions and 
convictions  are  in  constant  growth  since  1990.  This,  together  with  the  existing  obstacles  in 
investigations  and  prosecutions,  highlights  the  need  for  additional  measures  when  it  comes  to 
procedural criminal law.  

Investigations and prosecutions on  NCP fraud and other related cyber-criminal acts are frequently 
impacted  by  the  challenges  that  police  and  prosecutors  have  to  overcome  in  terms  of  legal 
powers, competence, human and technical resources, and mechanisms of cooperation at national and 
cross-border  level  for  obtaining  evidence,  especially  in  cross -border  cases.  Key  obstacles  to 
investigations and prosecutions include: the lack of skills among LEAs and judicial authorities to tackle 
NCP frauds, the low priority given to NCP fraud cases by some MS, the limitations to the exchange of 
information and cooperation between public and private actors.  

Limitations in the enforcement of the criminal law framework are also reflected in the mixed perception 
of stakeholders on the effectiveness of the existing penalties. While overall penalties for NCP offences 
are considered rather adequate,236 their enforcement and implementation are pointed at as areas for 
further improvement.237 This is in line with evidence-based deterrence theories. 

The implementation of the FwD is sometimes hindered also by a limited cooperation between law 
enforcement  and  judicial  authorities.  Despite  the  existence  of  some  common  approaches  (e.g. 
specific national strategies for financial crimes and cybercrime; legal provisions requiring cooperation; 
multidisciplinary working groups, task forces), the current structures and arrangements for cooperation 
are most of the time insufficient or inefficient. The main obstacles relate to: limited relevance of the 
strategies  in  place,  the  burden  relating  to  procedural  requirements  to  execute  an  investigative 

235 Validation Focus Group feedback: one participant. 2nd EGM feedback: some representatives of the Private sector. 
236 51% (n=43) of survey respondents from all the categories answered “medium” to the question “To what extent 
do you consider the level of penalties to be adequate to tackle fraud and counterfeiting of non-cash means of 
payments?”. 
237 Interview feedback: five representatives from LEAs, three judicial representatives and one from legal 
professions.  

65 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

measure, and lack of clarity on roles and responsibilities of national authorities in the management of 
cyber defence. 

Cross-border  cooperation  and exchange of information 

The  FwD  had  poor  results  in  terms  of  cross-border  cooperation  and  exchange  of 
information.  Similarly  to investigations and prosecution aspects mentioned before, the FwD laid down 
key principles for cooperation without providing specific guidance on how to proceed.  

Following these overall principles, all MS adopted measures of mutual legal assistance in respect of 
proceedings  relating  to  the offences  covered by the FwD either as parts of specific treaties or by 
implementing specific cooperation mechanisms such as networks, and expert groups . However, the 
current level of cross-border cooperation does not seem to be fully satisfactory, and there is evidence 
of obstacles that hinder cross-border investigations and prosecutions. Even though the Budapest 
Convention on Cybercrime defined specific mechanisms for cooperation and procedures of international 
exchange  of  information  relating  to  cybercrime,  stakeholders  consulted  throughout  the  study 
highlighted the limitations of the existing cooperation mechanisms and pointed at this as an area for 
further improvement. Furthermore, stakeholders reported that sometimes cross-border investigations 
and prosecutions are not launched or do not result in punishing the fraudsters.238 This supports the 
need for further action, non necessarily legislative considering the nature of the instrument chosen. 

. 

The cross-border cooperation and the exchange of information are mainly hampered by operational 
issues. Cross-border cooperation, where present, is often limited to EU MS as cooperation with third 
countries, which are often the source of NCP related frauds, is often more complex.239 Given limitations 
of  resources  and  procedural  difficulties  encountered  when  gathering  evidence  from  another  MS, 
national LEAs tend to prioritise national cases. This reduces the effectiveness of investigative/judicial 
measures that rarely lead to dismantling the whole criminal structure. Additional difficulties arise from 
the different national reporting practices, and more in general from different working practices that 
bring to inadequate responses to criminal offences such as identity theft. The exchange of information 
is further complicated by the existence of different systems for data collection and exchange in use by 
judicial authorities and LEAs, which makes it difficult to identify the owner of some information and 
allow for the exchange. This, together with the fact that cross -border exchanges of information often 
take time and are performed through lengthy procedures highlight, is an area for further improvement. 

Within this framework, Europol and Eurojust support in cross -border investigations and prosecutions 
respectively is widely acknowledged. The analytical capacities and the platform for exchange offered by 
the two EU Agencies allowed MS to improve their understanding of the criminal phenomenon and to 
ease the establishment of jurisdiction in complex cases. However, existing networks for cooperation 
are still poorly known at national level, thus limiting their potential benefits. In other words, there are 
cultural and professional obstacles that are not purely formal. 

Conditions for investigations and prosecutions  

Overall,  the  FwD  has  only  partially  met  its  strategic  objective  of  creating  conditions  for  effective 
investigations and prosecutions. It contributed towards the approximation of the national legislation 
and provided high level guidelines to investigations, prosecutions, and cross-border cooperation.  

238 Survey feedback: two representatives from Asso and DPA, and two from the private sector.  
239 2nd EGM feedback: some representatives of the private sector. 

66 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Despite all these initiatives, there is  room today to further improve the conditions that may allow 
investigations and prosecutions to be better implemented. The previous sections already addressed 
some of the key issues responsible for shortcomings in the FwD implementation and enforcement  (e.g. 
the limited transposition of the FwD by some MS and the operational weaknesses in the activities of 
LEAs and judicial representatives). It is clear that the FwD objective is to set the appropriate legislative 
framework that allows MS to conduct NCP related investigations and prosecutions, therefore leaving 
the operationalisation of such framework to the decision of MS. However, the analysis of the FwD 
implementation  highlighted  the  existence  of  some  issues  that may affect the achievement of the 
overall objective if not adequately managed. These issues can be partially linked to the evolution of the 
framework conditions since the FwD was initially launched in 2001. It is n oteworthy that at the time of 
the issuance of the FwD, investigating and prosecuting NCP frauds required different competences and 
processes from what is required today. In particular, many frauds now relate to cybercrime, and thus 
require specific IT skills, and most of them have an international dimension thus requiring a smooth 
cross-border cooperation to tackle them. 

The  current  conditions for investigations and prosecutions are also the result of  positive parallel 
initiatives  at EU and national  level, which tackle topics that are not explicitly covered by the FwD.  

The creation of public-private partnerships, together with the activities of associations and defence 
lawyers, and national public initiatives aimed at centralising the reporting of fraud s, allowed LEAs to 
get  more  comprehensive  information  and  better  target  fraudsters.  Examples  of  public-private 
partnerships, such as DCPCU in the UK, proved to have improved reporting and investigations, and 
might  be  considered  for  further  consideration  and  sharing  among MS.240 However, despite these 
initiatives, under-reporting of NCP frauds still remains one of the key limitations to investigations and 
prosecutions.  

The Directive establishing minimum standards on the rights, support and protection of victims  of crime 
also  contributed  to  improving conditions for prosecutions by establishing rules to assist victims in 
criminal proceedings. However, it has been only partially implemented and the level of protection of 
the victims differs from one MS to another. In addition, the rules are unclear for identity theft, which is 
a growing concern.  

Conclusions  presented  above  need  to  be  considered  in  light  of  the   difficulty  of  isolating  the 
contribution  of  the  FwD  to  the  current  legislative  and  procedural  criminal  law  framework. 
Many  of  the  provisions  of  the  FwD241  are  now  complemented  by  provisions  of  other  EU  and 
international legislation that, in many cases, brought MS to modify their legislation and contributed to 
achieving  the  FwD  objectives.  These  EU  and  international  laws  have  adapted  the  scope  of  the 
legislative  framework  to  the evolution of NCP fraud s and provided for few operational guidelines. 
However, the current legislative framework and the FwD do not seem to create all conditions needed 
to support investigations and prosecutions. 

4.2.3  Reporting  to Law Enforcement  Authorities 

This section aims at assessing whether current conditions for reporting are proper to support the FwD 
objectives, and whether something in the set conditions should be impro ved. The section includes the 

240 Though the private funding of policing functions may not be acceptable to some MS, the process led to greater 
buy-in from the private sector to the social objectives. 
241 Art. 1 let.a; Art. 3; Art. 4; Art. 5; Art. 6; Art. 8 para. 1; Art. 9 para. 1 let. A; Art. 9 para. 1 let. B; Art. 10 para. 1 
let. A; Art. 11 para. 2. 

67 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

analysis of the reporting obligations to law enforcement across MS (section 0), and an assessment of 
the adequacy of the current level of reporting (section 0).  

Reporting  obligations of offences criminalised by the FwD 

Is reporting to law enforcement of the crimes defined by the Framework Decision compulsory 

EQ8: 
under Member States' national laws? 

The FwD does not provide legal obligations for the reporting criminal offences relating to non -cash 
means of payment to LEAs, while subsequent EU legislatio n does it to some extent. However, the EU 
legislation cover only some private sector representatives (see Box 9), though it may not lead to crime 
investigations for all the predicate offences.  

Box 9 - Reporting  obligations  at EU level 

Article  96  of  the  PSD2  obliges  payment  service  providers  to  notify,  without  undue  delay,  the 
competent authority in the home Member State of the payment service provider, in case of a major 
operational or security incident. Also, Art. No. 5 states the obligation of the payment institution, in 
order  to  be  authorised,  to  submit  to  the  competent  authorities  of  the  home  Member  State  a 
description  of  the  procedure  in  place  to  monitor,  handle  and  follow  up  a security incident and 
security  related  customer  complaints,  including  an  incidents  reporting  mechanism  which  takes 
account of the notification obligations of the payment institution laid down in Article 96. 
Article  33  of  the  4th  Anti-Money  Laundering  Directive  states  that  all  suspicious  transactions, 
including attempted transactions, shall be reported by obliged entities and that credit and financial 
institutions are among the obliged entities. Article 61, moreover, states that MS are required to 
ensure that competent authorities establish effective and reliable mechanisms to encourage the 
reporting  to  competent  authorities  of  potential  or  actual  breaches  of  the  national  provisions 
transposing this Directive. This directive is currently under revision and its amendended version 
should cover virtual currencies, through including exchange platforms and custodian wallet providers 
in the definition of obliged entities, and anonymous prepaid instruments . This would submit these 
instruments to anti-money laundering rules, putting an end to the anonymity of the users.242 
Relevant steps forward on the reporting have been done with the publication of the Guidelines on 
the security of Internet payments by the European Banking Authority (EBA) in December 2014.243 
With these guidelines, the EBA established a requirement for reporting on payment service providers 
by outlining specific instructions and stating that all payment service providers should have in place 
procedures  and  systems  to  notify  the  management  and,  in  case  of  major  payment  security 
incidents, also the competent authorities. 

Source: Authors’ elaboration based on desk research 

Looking  at  national  laws,  a  slight  majority  of  Member  States  decided  to  adopt  measures  (i.e. 
provisions in their national legislation or ad-hoc mechanisms) to favour reporting practices. In the 
majority of cases, the reporting to low enforcement is compulsory.  

Adequacy  of the level of reporting   

EQ9:  Do law enforcement authorities consider the level of reporting satisfactory?  

242 They would have to comply with requirements such as “know your customer” procedures, suspicious 
transactions reporting to financial intelligence units and registration at national level with national competent 
authorities. 
243 The Guidelines were to be implemented by all 28 Member States by August 2015. 

68 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Overall, there is not a strong consensus among stakeholders answering the survey on the adequacy of 
the current reporting to law enforcement authorities. While for most of the survey respondents of 
some categories of stakeholders (LEAs and NBF) the level of reporting is adequate, for other categories 
(private sector and Asso and DPA) most of the representatives consider reporting to be only partially 
adequate.244 Also when looking at the quality245 and timing246 of reporting, stakeholders’ perception 
remains mixed.  

This  perception  may  be  relating  to  first,  as  described  above,  the  lack  of  an  overall  common 
framework for reporting  at EU level that brought to heterogeneous national reporting practices 247, 
thus limiting LEAs’ cross-border investigations.  

Moreover,  underreporting  is  quite  common  in  NCP  related  frauds.248  This  phenomenon  can  be 
explained by several factors.  

  The general poor information available to victims  on both the reporting systems in place 
and the role of actors involved in their protection that are often different from one MS to 
another. For instance, while in some countries there are dedicated institutions  aiming at 
addressing different aspects connected to identity-related crime and support to victims, 
in other MS these tasks are undertaken by consumer organisations (Disley et al., 2012).  
  Reputational concerns of businesses  that consider that LEAs’ investigative requirements 

may negatively affect companies’ processes and business continuity.  

  The  compensation  to  companies  and  individuals  received  by  banks   that  make  victims 
abandon the proceedings as soon as the reimbursement has  been received (Council of 
the European Union, 2016b). 

  A  psychological  factor  hindering  the  reporting  of  crimes .  For  instance,  victims  of  fraud 
may  blame themselves and/or fear that others will blame them for stupidity o r even 
culpability.249 Citing the experience of associations that support victims, apparently some 
of  the  victims  worry  about  what  will  happen  if  they  report.  They might think (often 
correctly) that the police will not investigate their complaint, or they might be worried 
that if they talk to police the things will get worse.  
Limitations imposed by national privacy laws  to the reporting of information from banks 
to judicial and law enforcement authorities. There are obligations at EU level for banks to 
report suspicious transactions to the Financial Intelligence Units, however details of the 
reports submitted and the speed of the response might vary considering that banks 
difficultly  share  information  spontaneously.  This  situation  may  ultimately  hinder 
investigations. 

 

244 Survey feedback: 57% (n=12) of representatives from LEAs, and 70% (n=7) of representatives from NBF 
answered “good”. Survey question: “Please rate the reporting to LEAs of the crimes relating to fraud and 
counterfeiting of non-cash payments”. 59% (n=10) of representatives from Associations and DPA, and 51% (n=18) 
of representatives from the private sector rated the overall reporting to LEAs as p artially satisfactory (“average” 
value). 
245 Survey feedback: the quality is perceived to be on “average” by responding Asso and DPA and the private sector 
(62%, n=32) and “good” by NBF (60%, n=6). Opinions among LEAs representatives are mixed since 43% (n=9) of 
them ranked the quality as “average” and 43% (n=9) as “good”. Survey question: “Please rate the reporting to 
LEAs of the crimes relating to fraud and counterfeiting of non-cash payments in terms of quality”. 
246 Survey feedback: the timing of reporting to LEAs is considered to be on “average” by the majority of the 
representatives from Asso and DPA (71%, n=12), and LEAs (67%, n=14). As for NBF, 40% (n=4) of 
representatives from this category considered the timing to be on “average” and 50% (n=5) “good”. As for the 
private sector, 34% (n=12) chose the option “bad”, 40% (n=14) “average” and 26% (n=9) good. Survey question: 
“Please rate the reporting to LEAs of the crimes relating to fraud and counterfeiting of non-cash payments in terms 
of timing”. 
247 2nd EGM feedback: Some representative from the private sector reported that there was a lack of harmonisation 
of reporting rules at EU level.  
248 Also confirmed during the 1st EGM. 
249 Survey feedback: one representative from Asso and DPA. 

69 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

beyond the issue of underreporting, the main limitations in the current reporting systems  include the 
following factors (European Commission, 2012). 

  Almost  half  of  the  MS  in  2011  did  not  make  available  any  reporting  mechanisms 
dedicated  to Internet crimes other than turning directly to the police and submitting the 
compliant  at  the  Police  station.  LEAs  can  difficultly  count  on  Internet  crime  cases 
spontaneously brought up by victims and, as a result, they cannot take proper action, 
leading  to  them  being  seen  as  unresponsive  or  inactive.  Eventually,  the  Critical 
Infrastructure operators’ perception of LEAs’ limited extent of intervention discourage 
them from reporting. 

  When online reporting systems are in place, they often  do not provide feedback to the 
victims  once  they  submit  their  cases,  on  the  treatment  of  their  reports  or  the 
development of the justice process.  

  Existing systems often lack reporting categories that allow for different reporting when 
relating  to  different  types  of  crime.  This  means  that  most  of  the  national reporting 
systems do not provide the possibility of referring to specific sections when reporting 
cases and have a unique channel for reporting all types of crime. However, the creation 
of  dedicated  mechanisms for targeted classes (e.g. identity theft and identity fraud) 
could improve the user experience and increase the amount of cases reported.  

In order to improve the overall efficiency of the current reporting systems, it is recommended that 
both  online  and  offline  reporting  systems  are made available to the victims, with similar levels of 
accessibility, and that there needs to be better communication of the benefits of such approaches to 
users. Not only online reporting structures need to be deployed, but they also need to be designed in a 
way that provides engagement and interaction with the victim.  

Following up reported frauds by providing fe edback to victims, and sharing good practice with the civil 
society may determine an increase in the reporting and incentivise the victims or a third person who 
knows about the crime to report. 

Beyond the victims’ involvement, the improvement of the curre nt reporting system could leverage on 
the  direct  interest  of  key  stakeholders  likes  affected  by  NCP  fraudulent  transactions.250 Payment 
service providers and businesses may be the first stakeholders to offer their support in constructing 
and implementing efficient and well-structured reporting systems being they among the most affected 
players in case of NCP frauds. Both card issuers and credit card schemes often offer insurances on 
payment frauds (e.g. “Zero Liability Policy”) and this should make them interested in improving the 
prevention of fraudulent transactions and support their detection. Stakeholders answering the survey 
mentioned some examples of national initiatives aiming at improving the current reporting systems 
that already connect payment service providers with LEAs and among each others (see Box 10).  

Box 10 –The Italian case “OF2CEN”  

The Online Fraud Cyber Centre and Expert Network (OF2CEN) created a platform for the exchange of 
information such as IP address and fraudulent banking data e.g. International Bank Account Number 
IBAN and provides “early warning” notifications about possible criminal activities between Italian banks 
and  LEAs.  This  platform  born  from  the  need  of  combating  cases  of  phishing  among  banks,  and 
combined the interests of banks (to gather information) and LEAs (to tackle criminal activities). The 
partners of the project are Abi Lab, Unicredit, Booz & Company, Global cyber security center, General 
inspector of Romanian police and National crime agency The principal aim of the platform is to collect 
the  alerts  of  suspicious  transactions  reported  by  banks,  made  them  fully  available  to  LEAs,  and 
partially accessible to the other banks who participate in the platform in the respect of data protection 

250 Interview feedback: one representative from the private sector, one from NBF, and one from LEAs.  

70 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

rules. Moreover, OF2CEN facilitates the exchange of fraudulent data information (e.g. IBAN and IP 
address, names) through a secure channel. The main benefits of OF2CEN are: i) facilitation of the 
exchange of information between LEAs and banks and between the banks; ii) possibility for the banks 
to access information that can be useful for designing better preventing measures; iv) identification of 
fraudsters and support to related investigations.  

Source: Evaluation team elaboration  based on desk and field  research 251 

Businesses are also interested in improving the level of reporting for two main reasons. Firstly, these 
specific actors are affected by the so-called “staff fraud” that is the involvement of staff members in 
the breach of customers’ data. This is a largely underestimated, under-reported and under-detected 
crime threat that needs to be taken in consideration given tha t staff corruption is a widely adopted 
option by criminal groups (Fraud Prevention Expert Group, 2007). Secondly, it frequently happens that 
different companies, also belonging to different industries, install and uses the same types of software 
and hardware. Under reporting of incidents and vulnerabilities relating to these software and hardware 
put at risk all companies deploying the same technology. Evidence gathered through  the desk research 
highlighted  that  “it  should  be  taken  into  account  that  the  lack  of  mandatory  reporting  in  case  of 
massive  attacks  against  vital  infrastructures  run  by  private  companies means the private sector has 
the power to decide whether or not to fight criminals and bring them to justice according to their own 
interests and not the public's” (Council of the European Union, 2015b, p. 32).  

4.2.4  Public-private  cooperation   

EQ10:   Is  public-private  cooperation  structured  to  effectively  and  efficiently  meet  the  Council 
Decision’s objectives? 

There is evidence of a number of initiatives at both EU and national levels aiming at fostering public-
private cooperation, and eventually combatting frauds in NCP instruments. Even though the FwD does 
not  include  a  specific  provision  on  public-private  cooperation,  Member  States,  EU  agencies  and 
institutions  often  implemented  spontaneously  cooperation  initiatives  with  different  levels  of 
formalisation.  Enhancing  public-private  cooperation  is  widely  considered  an  enabler  to  fight  NCP 
frauds.252 In this regard, Europol points out that leveraging public-private partnerships is a way to 
raise  the  general  level  of cybersecurity and contribute to stop hig h volume crimes and increasing 
awareness  and  prevention  (Europol,  2016b).  However,  as  Levi  et  al.  (2017)  note,  the  human 
dimensions of cybersecurity mean that even when the public and businesses are aware of risks, they 
may not act to prevent frauds because of the cognitive gap. 

At EU level the strategy for cybersecurity (EU Cybersecurity Strategy) focuses among others, on the 
collaboration with the private sector in order to address loopholes and ensure more specialised training 
(European  Commission,  2013a). In line with this, the Commission also proposed in its Agenda on 
Security  the  creation  of a Security Consultative Forum aggregating Member States, the European 
Parliament  and  EU  agencies  with  representative  from  the  private  sector  in  order  to  enhance 
transparency  and  join  efforts  in  the  fight  against  organised  crime,  terrorism  and  cybercrime.  An 
example  of  public-private  cooperation  at  EU  level  mentioned  by  several  stakeholders  consulted 
throughout the study253 is the European Cybercrime Centre (see Box 11).  

251 Interview feedback: one representative from NBF, one from the private sector and two from LEAs.  
252 Interview feedback: three representatives from Victims’ Association, two from the private sector, two from PPP, 
and two from LEAs.  
253 Interview feedback: one representative from Academia and one from EU Institutions. Survey feedback: one 
representative from LEAs and two from NBF. 

71 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Box 11 – The European Cybercrime Centre 

EC3 was established by Europol as the central hub for criminal information and intelligence, to support 
operations  and  investigations  by  Member  States.  It  offers operational analysis, coordination and 
expertise, and provides a variety of strategic-analysis products that enable informed decision-making, 
and support training and capacity-building, in particular for the relevant authorities in Member States. 
Europol EC3 structured a networking model including EU and non -EU law enforcement and judicial 
partners, as well as partners in industry, the financial sector, the Computer Emergency Response 
Team (CERT) community and academia. The model proved its value by rising the number of high -level 
operations from 72 in 2014 to 131 in 2015 (Europol, 2016b). Payment fraud is one of EC3 areas of 
activity  and  a  significant  number  of  partnerships  with  financial  services  organisations have been 
developed.  The EC3 has a high level of formalisation being part of Europol, and it is composed of 
different actors with assigned tasks and responsibilities. It has a Programme Board th at provides the 
Centre with direction as to how to achieve its goals, and fulfill its officially assigned tasks, building on 
partnerships, shared responsibility and cooperation with all Board members. There are also dedicated 
advisory  groups  for  key  domains  like  Internet  Security,  Financial  Services  and  Communication 
Providers,  bringing knowledge and expertise. They update and share all relevant information and 
expertise on developments, and assist the Programme Board in defining priorities for the work of the 
EC3 in this area.  

Source: Authors’ elaboration based on desk research 

The  analysis  of  the  cooperation between public and private entities  at national level identified a 
number of initiatives in a limited number of Member States (see Box 12). 

Box 12 – National public-private  cooperation  initiatives  covered by the  study254 

France: FIA-NET, Phishing initiative, Groupement des Cartes Bancaires (CB), and French LEA.  

- 
-  Germany: the German Cybercrime Competence Centre (G4C);  
- 
- 
-  Slovakia: Slovakian Banking Association Commission for security of payment cards;  
- 

Italy: the platform OF2CEN, CertFin;  
The Netherlands: ECTF (Electronic Crime Task Force);  

The  UK:  the  Dedicated  Card and Payment Crime Unit (DCPCU),  Cyber information Security 
Partnership  (CiSP),  Action  Fraud,  Financial  Fraud  Action,  National  Cyber  Security  Center 
(NCSC).  

Representatives from LEAs, NBF and the private sector consulted reported also the existence of 
informal public-private cooperation/partnerships such as: meetings and informal talks with LEAs 
and  the  private sector, and personal relationships that allow for sharing information and good 
practices. There are various initiatives taken informa lly among stakeholder of public and private 
sectors  for  sharing  good practice and exchanging information. In Greece, for instance, there is 
sectorial cooperation based on the informal and constant exchange of information with banks and 
airlines, to counter fraudulent purchase of plane tickets.255 

Source: Authors’ elaboration based on desk and field  research 

The above mentioned initiatives have been assessed according to a set of criteria and namely: timing 
and  geographical  scope,  areas  of  activity,  membership,  objectives,  level of formalisation.  Table 9 

254 The initiatives analysed throughout this section have been identified based on desk research and feedback 
gathered by stakeholders. It might be not exhaustive. There might be other public-private cooperation initiatives, 
as well as inter-private sector meetings involving card schemes, card issuers and merchant acquirers, both 
nationally and cross-border. 
255 1st EGM. 

72 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

shows an overview of the key findings, followed by a detailed analysis as provided in Annex 5. All 
evidence collected was then used to identify both success factors and limitations and obstacles to such 
cooperation initiatives. 

Table 9 –Key findings of public-private  cooperation  initiatives  

Criteria  

Key findings 

Timing 
and 
geographical scope 

All the public-private partnerships covered in the study have been developed  
in  recent  years.  Most  of  them  are  initiatives  that  involve  only  national 
stakeholders.  The  UK  seems to be the country with the most developed 
public-private cooperation and the highest amount of partnership initiatives. 

Areas of activity 

Most  of  the  existing  initiatives  focus generally on cybercrime. Few cases 
have  been  found  of  public-private  cooperation  focusing  exclusively  on 
specific aspects relating to NCP instruments. 

Membership 

Overall, most of the initiatives involve banks, financial institutions, and Law 
Enforcement  officials.  Private  companies  and  representatives  from  the 
Ministries  of  Interior  are  sometimes  involved,  though  to  a  more  limited 
extend.  Sectorial private companies (other than financial institutions and 
banks) are involved when partnerships’ objectives relate to specific sectors.  

Objectives 

Public-private partnerships aim at two main objectives: 

  The  prevention  of  non-cash  payment  frauds through the sharing of 

information, knowledge, data and analysis; 

  The  repression  of  non-cash  payment  frauds,  through  operational 

actions and investigations. 

When cooperating for preventive purposes, public and private entities often 
organise campaigns aimed at increasing awareness about cybercrime and 
deploy ad-hoc training. 

Level of 
formalisation 

The public-private partnerships analysed are usually highly formalised, being 
characterised  by  defined structures, and having continuous and ongoing 
activities. Only few examples show a low level of formalisation. 

Source: Authors’ elaboration based on desk research 

Cooperation  between  public and private actors is often driven by the need of public actors to 
get  information.  Law  enforcement’s  perspective  and visibility on the non -cash payment frauds is 
often limited, and it covers only a part of the entire phenomenon. Moreover, as indicated by Europol, 
existing frameworks, programmes and tools for the exchange of information between public sector 
representatives are often too slow and bureaucratic to allow for a timely response (Europol, 2016b).256 

Overall,  public-private  cooperation  initiatives  contributed  to  creating  conditions  for  better 
investigations and prosecutions of non-cash payment frauds (i.e. the strategic objective of the FwD). 
This seems to be supported by both the increased number of detections and the proliferation of such 

256 2nd EGM feedback: Some representatives of the Public sector confirmed that they often receive the required 
information from the Private sector too late. 

73 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

initiatives. Specifically, existing public-private partnerships created better conditions for investigations 
and prosecutions by: 

 

  enhancing  and  enabling  relationships  between  LEAs,  key  players  from the private 
sector (e.g. banks, other financial institutions, payment service providers) and from the 
public sector; 
facilitating the exchange of information between LEAs and the banks, and between 
the  banks.  Existing  cooperation  initiatives  allowed  actors  involved  to  improve  the 
understanding of the criminal phenomenon, and therefore design preventive measures 
that  address  emerging  needs  raised  from  the  operators  on  the  field,  and  better 
contextualise repressive measures; 
contributing to more efficient identification of Organised Crime Groups; 
raising the priority of cybercrime as an issue to be addressed at both national and 
international level and more generally the stakeholders’ awareness; 

 
 

  broadening  the network of institutional stakeholders and of national and international 

experts that can provide input to the deign of measures countering NCP frauds. 

Cooperation  between  the  public  and  private  sector  progressively  evolved  over the years. As 
illustrated by Europol “there have been significant changes in the engagement with the private sector 
to share information and collaborate with private industry organisations. Law enforcement have also 
gained a better understanding of private sector industries. They know what questions to ask, what 
data to request and who to approach to best support ongoing investigations. They ha ve a better 
understanding of technical capabilities available within the private sector, and how those capabilities 
can be leveraged to fight crime. Public-private partnerships have also proliferated in the past decade” 
(Europol, 2016b, p. 69).  

While there are already a number of initiatives aiming at establishing tighter relationships between the 
private  and  the  public  actors,  there  is  room  for  a  wider  adoption  of  these  cooperation 
mechanisms  to improve preventive measures and to increase the detection of NCP related frauds. 

Enabling factors  

The cooperation between private and public stakeholders seems to be enabled by the following factors.  

  The  diversification  of  private  actors  involved.  The  more  diversified  the  private 
actors  involved  in  the  partnership  are,  the  better  is  the  fin al  understanding  of  the 
criminal phenomenon. The involvement of representatives of all actors affected by NCP 
frauds (e.g. issuers, processors, card schemes, etc.) can provide a full picture of the 
phenomenon  by  gathering  all  data  and  information  that  are  usually  spread  among 
several  stakeholders,  and  better  support  the  design  of  preventive  and  repressive 
measures.257  Besides  traditional  players,  civil  society organisations (e.g. victims and 
consumers’  associations)  can  also  contribute  to  NCP fraud prevention  (e.g. through 
information and awareness raising campaign) by leveraging their connections with the 
civil society. 

Formalised  and  structured  forms  of  collaboration  (e.g.  units,  commissions, networks, 
and information-sharing platforms) seem to be particularly valuable when it comes to 
the sharing of fraud-related intelligence among financial institutions, especially in view of 
the required level of confidentiality for the exchange of NCP fraud related information. 
The high number of this kind of initiatives in the UK (an opportunity principle country) 
seems  to  confirm  this  overall  statement.  Historically,  the  UK  has  always  promoted 
cooperation with the private sector because LEAs understood that they have limited 

257 A specific case on this matter is the French Economic Interest Group which involves a private company providing 
a specific software which allows from the incomplete payment card numbers for getting the amount, the date and 
the name of the e-commerce in which the transaction happened, so that the credit card that has been used can be 
identified in a few hours (Interview feedback: one representative from LEA). 

74 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

capacity to prosecute cybercrime, and that in  this field traditional criminal justice can 
only play a subsidiary role.258  

  Multilateral  flows  of  exchange  of  information,  not  only  between  public  and 
private  actors,  but  also  between  private  actors.  The  exchange  between  private 
actors allow them to get valuable information to better prevent NCP frauds, and to adapt 
their  tools  and  techniques  to  emerging  trends  taking  into  account  and  anticipating 
threats  faced  by  similar  actors.  This  is  the  case  of  the  ECTF 259  and  the  OF2CEN 
initiatives,  both  mentioned  by  sta keholders  as  successful  examples  of  multilateral 
cooperation. The success of the two initiatives is linked, among others, to the existence 
of a platform that is managed in a way to ensure the respect of data protection rules and 
to customise the flows of information according to different stakeholders needs.260  
  The  adoption  of  the  opportunity  principle  versus  the  legality  principle.  The 
creation  of  public-private  cooperation  practices  might  be  easier  in  MS  following  the 
opportunity principle – where LEAs have discretion over whether or not to prosecute a 
criminal offence - rather than in MS following the legality principles – where LEAs are 
denied  any  discretion  and  every  case  in  which  there  is enough evidence has to be 
brought to court.  

  A  targeted  communication  with  private  sector  focusing  on  the  benefits  they 
might  perceive  from  cooperation.  As  shown  by  the  UK  case,  the  success  of 
cooperation initiatives can be linked, among others, to a change in the communication 
approach towards private sector representatives (Council of the European Union, 2015c). 
While  in  the  past  the  National  Crime  Agency and the Government used to highlight 
themes  like  investigation  a nd prosecution in order to push the industry to report to 
authorities,  recently  they  changed the approach considering the risk of reputational 
damage private players could bear in case of investigations. Therefore, they focused 
their  communication  on  the  potential  contribution  of  notifications  to  the  design  of 
prevention  measures  against  future  attacks,  without  necessarily  linking  it  to  the 
possibility of investigations.  

Limitations and obstacles  

Most of the survey respondents considered the level of public-private cooperation/partnership to be not 
fully effective in combating non-cash payment fraud and counterfeiting. While LEAs seem to be quite 
satisfied,261 with nearly half of respondents considering the level of public-private cooperation to be 
highly effective (48%, n=10), the private sector appeared to be the most dissatisfied category with 
38% (n=13) of respondents considering level of cooperation with a low effectiveness and 53% (n=18) 
to be only partially effective. 

The main obstacles relate to data and information sharing between private and public institutions, both 
domestically and cross-border.  

Difficulties  related  to  the legislation on the protection of personal data. Current fragmentation 
in the implementation or limited scope of EU data protection rules affect the exchange of financial 

258 Feedback from one member of the Advisory Board and input from two participants to the Validation Focus 
Group. 
259 For instance, within the ECTF in the Netherlands “The exchange of information had to be between not only banks 
and the Police, but also among the Banks and financial institutions themselves, through a platform were to share 
information and build mutual trust”. Source: interview feedback: one representative from EU institution and bodies. 
260 For instance in the EC TF in the Netherlands “The entire process stays within the walls of the ECTF. The 
information a bank shares with the ECTF is not shared immediately with the Police, and information that EC TF 
shares with the bank is shared only with a dedicated person within the bank, to ensure a its proper use. Once the 
whole picture is clear to the ECTF, elaborated information is provided to the investigation teams in the LEAs and to 
all other banks. ECTF manages the information and shares the knowledge, bringing together the pieces of 
information and building the whole picture” (Source: interview feedback: one representative from EU institution and 
bodies ). 
261 The survey question asked: “To what extent is the level of public-private cooperation/partnership effective in 
combating non-cash payment fraud and counterfeiting?”.  

75 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

intelligence between the private sector and LEAs across MS. This means that in MS with more stringent 
rules  (e.g.  FR),  the  exchange  of  financial  intelligence  is  more  limited  and  private  companies,  for 
instance,  can  share  data  with  LEAs only in the framework of a specific request linked to a formal 
ongoing investigation.262 The more restrictive the national regulations are on fraud-related intelligence 
sharing, the more these rules act as an obstacle to the structuring of good public-private partnerships. 
This  aspect  is  particularly  relevant  in  view  of  the  fact that NCP frauds usually affect a number of 
stakeholders (i.e. the merchant, the credit card scheme, the bank, etc.) and that each of them hold 
different information which would be relevant to gather for the sake of investigations.  

Moreover, foreign private operators have often no legal obligation to answer requests for evidence, 
and  their  reactivity  is  irregular  and  often  too  slow.  This  is  the  ca se  of  major  operators  such  as 
Facebook,  Yahoo,  Amazon  or  Google  which  have  limited  resources  to  answer  LEAs  requests  for 
information and often apply specific data protection rules(Council of the European Union, 2015d).  

The  lack  of  clarity in the rules private sector needs to follow to collect information is also an 
obstacle that in turns affects the decisions relating to the admission in judicial procee dings of the 
digital  evidence  obtained  through  the  cooperation  with private entities (Europol, 2016b). Further 
guidance to The private sector should be provided with further guidance on how to collect information 
in a way that it can be used as evidence in court 263 ) and meetings among prosecutors and police  
should take place regularly for this purpose (Council of the European Union, 2016a). In addition, it is 
important to establish a relation of trust between law enforcement authorities and private partners in 
order to provide added value for private partners, which is difficult to achieve through legislation.264 

Similarly  to what discussed with regard to obstacles to investigations and prosecutions (see section 
3.3.1),  the  lack  of  specific  and  harmonised  data on NCP frauds within and between MS  might 
be  an  obstacle  also  for  the  exchange  of  information between public and private actors  (Europol, 
2016b). 265 Disparities also appear in the different policies applied by differen t institutions, the legal 
regimes  applicable to different sectors and in the legal conditions to exchange information. As for 
cross-border direct cooperation, experts confirmed that cross-border cooperation with private entities 
does not produce any feedback and that formal cooperation procedures (MLAs) need to be used in 
order to procure information.266Geographical obstacles may also limit the exchange of information. 
A  representative  from  LEAs  made  the  example  that:  “ the  Netherlands  have  protectorates  in  the 
Antilles,  which  are  not part of the Schengen zone and so with which it is not possible to make cross -
border  observations, even though it is part of the Netherland (a bit like Andorra  or Monaco)”.267 

An additional limitation is represented by the limited implementation by Payment Service Providers of 
systems  to  “monitor,  handle  and  follow  up  on  security  incidents  and  security-related  customer 
compliance” and to notify the competent authorities (e.g. LEAs) on this matter. The fact that the EBA 
in 2014 provided some instructions for Payment Service Providers (PSPs) assumes that such systems 
were  unevenly  implemented  (EBA,  2014).  The  lack  of  deployment  of  proper  and  structured 
mechanisms by all PSPs hinders the  cooperation with the relevant LEAs in cases of major payment 
security  incidents,  including  data  breaches.  Moreover,  the  current  contracts  between  PSPs  and 
merchants  operating  through e -commerce channels do not often allow PSPs to take actions or to 
transmit relevant information to LEAs (since it is the e -merchant who stores and processes sensitive 
payment data) when e-merchants do not collaborate following a security incidents. 

262 Interview feedback: one representative from LEAs. 
263 Interview feedback: one representative from LEAs. 
264 1st EGM feedback: Input provided by some representatives from the public sector. 
265 Difficulties in obtaining cross-matching information on fraudulent transactions from different sources were also 
reported during the 1st EGM. In this sense, bigger countries are expected to have easier access to information due 
to the fact that several entities are based within the same jurisdiction. 
266 Input provided during the 1st EGM. 
267 Interview feedback: one representative from LEA. 

76 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

To  conclude,  cooperation  between  private  entities  has  also  been  reported  as  important  to 
prevent and detect fraud and solve multi-juridictional cases,268 however it is often hindered by data 
protection rules.269 

4.2.5  Victims’  rights  protection 

This section aims at assessing whether rights of victims of NCP frauds are exhaustively covered, also in 
the light of needs/rights that might have emerged because of newer forms of fraud and counterfeiting. 
The section starts with the description of the main effects of NCP frauds on individuals, it describes the 
level of protection ensured to victims by the current  EU and national legislation and ends with the 
assessment of the relevance of the current legislative framework to victims’ needs highlighting areas 
for future improvement. 

Main effects of NCP related  frauds on individuals   

EQ14: To which extent the individuals are affected by the use of their fraudulently acquired payment 
(card)  data?  What  are  the actual and potential consequences for the individuals? (e.g. causing a 
financial loss and exposing the individual to negative credit ratings or other negat ive consequences of 
identity theft)? 

Individuals  are  often  the  target  of  NCP  related  frauds.  They  are  affected,  for  instance,  when 
using payment cards, in secured Internet banking or mobile services, in e -commerce platforms or in 
other communication systems that involve a transfer of funds. Criminals steal individuals’ data (e.g. 
name  of  the  victim,  PIN  numbers,  date  of  birth,  validity  of  the identity, bank details and security 
details for operating online services such as login name and password) to exploit bank accounts and 
credit cards, create new accounts, obtain loans and credit, or order goods and services with the stolen 
financial resources. In some cases, victims are obliged to make payments to criminals as a result of 
extortion or fraud. Sometimes, these persons may even not be aware that they are involved in criminal 
activity and believe they are performing a legitimate service (Europol, 2016b).  

The use of fraudulently acquired payment data have a number of consequences for individuals that 
span  from  concrete  effects  -such  as  financial  losses  and  fraudulent  use  of  credentials-  to  more 
intangible  effects  -such  as  privacy  and  data  protection  violation,  lack  of  willingness  to  make 
transactions  online  and  lack  of  access  to  online  services.  There  is  overall  consensus  among  the 
representatives 
from  private  a ssociations/NGOs  and  (DPAs)  answering  the  survey  that 
fraud/counterfeiting of NCP instruments prejudice the individuals.270  

Privacy and data protection violation, financial losses and theft of credentials are considered to be the 
main forms of damage, while the impact of NCP frauds on the willingness to make transactions on -line 
and the lack of access to online services seems to be modest. 

As  for  privacy  violation  and  data  protection  -the  highest  prejudice  perceived  by  stakeholders 
answering the survey271- the damage needs to be assessed in the context of the recent trend of 
increasing  importance  of  the  right  to  privacy  and  data  protection  at  the  expense  of  the right to 
protection (2015 Internet Organised Threat Assessment (IOCTA)). When looking at current policies on 

268 A good practice in this field is Perseuss. 
269 1st EGM feedback: some representatives from the public sector. 2 nd EGM feedback: some representatives from 
the private sector. 
270 86% of representatives from Asso and DPA representatives answering the survey rated the different damages 
brought by NC P fraud as being medium or high. For further detail see Annex 8. 
271 94% (n=16) of survey respondents considered this consequence as particularly relevant for the individuals . The 
survey question asked: “Can you indicate the damages caused to individuals by fraud in counterfeiting of non-cash 
means of payment?”. Interview feedback: two representative from Victims associations. 

77 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

data  retention  of  Internet  communications  and  encryption,  there  is  evidence  of  a  progressive 
maximisation  of  individual’s  protection.  This  brought  to  increasing  difficulties  for  LEAs  to  protect 
citizens against the intrusion of their privacy against hacking, theft of personal data and other types of 
cybercrime,  because  any  trace  or  evidence  of  criminal  activities  are  probably  not  retained  and  if 
retained, are difficult to access due to sophisticated encryption (Europol, 2015b). 

Even  though  figures  about the actual financial losses of individuals’ victims of NCP frauds are not 
available, the dimension of crime described in sectio ns 3.1 and 4.3.1 confirm the economic importance 
of this criminal phenomenon, and shows an overall increasing trend of the value of NCP frauds.  

In most cases it is difficult to identify the fraudster and to perform asset recovery. In such cases, the 
allocation of losses might be challenging. Economically, the losses are calculated and laid in the price 
of  goods  or  services  by  the merchants, the payment provider and the card network corporations 
(University of Oslo, 2015). 

In  any  case,  stakeholders  answering  the  survey  point  to   financial  losses  as  the  second  most 
relevant  damage  to  individuals  according to  stakeholders.272 For many fraud victims, getting their 
money back (or at least some of it) is of key importance, as is ready access to their accounts. Some 
interviewed  stakeholders 273  further  confirmed  the  relevance  of  financial  losses  for  individuals  by 
pointing at the fact that even though service providers can compensate, at least partially, the financial 
losses, the amount is limited and it leaves most of the burden on consumers. The liabilities in case of 
NCP frauds may vary a lot and can be either borne by the payee or the payer depending on how far 
they are able to prove that the needed measures to ensure the security of the transaction have been 
put in place (see also section 4.3.1) 

Theft  of  credentials  is  also  perceived  as  an  important  loss  for  individuals  who  suffered  of  NCP 
frauds.274 Obtaining and exploiting credentials of individuals is a larg e scale technique used for identity 
theft  through  that  fraudsters  can  authenticate  themselves,  in  order  to  impersonate  the  victims. 
Examples of such credentials may include identification documents, badges, passwords, user names, 
and  even  security  clearances.  Combating  the  theft  of  credentials  is  considered  to  be  of  major 
importance because if the identity thief is able to obtain false credentials in order to pass various 
authentication tests in everyday life, concealment may continue indefinitely without being detected. 
Victims might only learn of such incidents by chance and charges may be placed under the victim's 
name, letting the criminal off the hook. 

Box  13  -  Examples  of  national  initiatives  aiming  at  protecting  rights  of  victims  of  identity 
theft 

  Databases of identity theft victims. In the UK, CIFAS275 provides a protective registration service 
to people who have had their identity documents stolen or are otherwise concerned that they may 
have been the victim of identity theft. This is a system whereby individuals may request, for a 
small fee, to be included in the database (by flagging their own address) to protect them against 
possible impersonation attempts. There are processes in place to ensure the person reporting the 

272 94%(n=15) of respondents considered individuals to be partially affected by this type of consequence in case of 
fraud (combined ranking values from “average” to “high”). The survey question asked: “To what extent is the level 
of protection of the victims’ rights relating to identity theft effective?”. Interview feedback: two representatives 
from Victims associations. 
273 Interview feedback: one representative from LEAs. 
274 Survey feedback: 88% (n=15) of respondents considered individuals to be significantly affected by this form of 
identity theft (combined ranking values from “average” to “high”). The survey question asked: “To what extent is 
the level of protection of the victims’ rights relating to identity theft effective?”.  
275 C IFAS is a not-for-profit company, with more than 25 years of experience in working to protect businesses, 
charities,  public  bodies  and  individuals  from  financial  crime.  The  C ifas  team  works  closely  with  the  UK  law 
enforcement partners, including the City of London Police (National Fraud Intelligence Bureau), the National C rime 
Agency and the Metropolitan Police Service. 

78 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

theft is the true owner. Similar databases for identity theft/fraud victims' voluntary registration 
are also created in ES (www.asnef.com) and SE (www.sepfra.es). 

  Awareness and educational measures . In FR they facilitating access to SMEs for interns coming 
from the best French IT colleges in order to exchange knowledge, and established long -term 
partnerships with the Chamber of commerce and industry of the Ile de France in order to raise 
awareness about identity theft among SMEs (Council of the European Union, 2015d).  

  Creation of reporting points. In FR a direct line called “Info Escroqueries” is operational since 
2009,  allowing  victims  of  identity  theft  to  contact  the  police  or  the  gendarmerie  to  have 
information about risks and procedures to follow  (European Commission, 2012). The NL have 
established  a  specific  reporting  point,  CMI  –  Identity  Theft  Reporting  Office  which  aims  at 
protecting citizens against fraud and other financial crimes committed in or outside the country. 
The CMI focusses on raising awareness among individuals and businesses in order to guide fraud 
victims  to  agencies  that  can help them. The center co -operates with governmental partners, 
through  a  notification  point  establis hed  within  the  police,  and  therefore  organises  public 
campaigns  on  identity  theft  awareness,  which  helped  decrease  the  number  of  victims  in 
comparison with last year. 

Source: Authors’ elaboration on EY survey answers  

The  impact  of  NCP  frauds  is  also  relevant  -though  to  a  more  limited  extent-  when  it  comes  to 
consumers’  willingness  to  provide  personal  information  to  web  sites  and  to  engage  in  e-
commerce  transactions.276  According to the 2014 Eurobarometer on cybersecurity, 12% of users are 
less likely to bank online and 13% say they are less likely to buy goods online. In general, consumers 
feel that there is a certain amount of risk of misusing their private data on the Internet and act with 
caution when going online. Online marketers need to understand the influencing factors and address 
them appropriately, so that consumers’ online privacy concerns are reduced, and consumers are willing 
to disclose personal information on the Internet, and participate in e -commerce. If not adequately 
managed, consumers’ concerns might turn in significant economic losses.  

NCP  fraud  affects  only  to  a  limited  extent  the  access  and use of online services.277 This further 
supports the ongoing transformation process that some national public authorities are implementing in 
order to move from paper based processes, which might be easy to misuse, to online protected portals 
for consumers.  

The protection  ensured to victims by EU and national legislation   

EQ15: How is the victim protected by existing rules? 

EU legal framework 

Improving the rights, support, protection, and participation of victims in criminal proceedings has long 
been a European Union priority. In this regard, there are two main EU legislative measures relating to 
the protection of the victims of crime: Directive 2012/29/EU and the PSD2. 

The most important is Directive 2012/29/EU, establishing minimum standards on the rights, support 
and protection of victims of crime,278 and ensuring they receive appropriate information, support and 
protection and are able to participate in criminal proceedings that take place in the EU. This Directive 

276 Survey feedback: 88% (n=15) of survey respondents expressed some concerns about this consequence for 
individuals. The survey question asked: “To what extent is the level of protection of the victims’ rights  relating to 
identity theft effective?”. 
277 Survey feedback: 65% (n=11) of respondents considered individuals as being poorly affected by frauds in their 
access to online service (combined ranking values from “average” to “high”). See survey question in footnote 198. 
278 Other two directives were adopted in order to approximate procedural safeguards in criminal proceedings: 
Directive 2010/64/EU on the right to interpretation and translation in criminal proceedings and Directive 
2012/13/EU on the right to information in criminal proceedings. 

79 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

establishes very general rules that should be applied in all types of criminal proceedings, focusing, 
among others, on the provision of assistance to victims, on the communication with them, o n victims’ 
right to obtain information from the Authority, and on their right when making a complaint (see Box 
14). Directive 2012/29/EU eatablishes also a provision regarding individual assessment of victims to 
identify specific protection needs,279 as it makes clear that there is a need to adopt a case -by-case 
approach towards victims (European Commission, 2013b). Good practices demonstrate that factors 
such as gender, age, maturity, ethnicity, language skills, relationship/dependency between the victim 
and  the  offender,  previous  experience  of  crime  etc.  should  be  taken  into  account to identify the 
victim’s communication needs, support needs, protection needs and any need for any other kind of 
assistance. However, for the  purposes of the Directive, “victims” are only “natural persons” ,280 thus 
excluding legal entities, which instead can be among the victims of NCP frauds. 

Box 14 – Victims’s rights  covered by Directive 2012/29/EU 

Right  to  understand  and  to  be  understood 
(Art. 3) 

Right  to  receive  information  from  the  first 
contact with a competent authority (Art. 4) 

Right  of  victims  when making a complaint (Art. 
5) 

Right  to  receive  information  about  their  case 
(Art. 6) 

Right to interpretation and translatio n (Art. 7) 

Right to access victim support services (Art. 8) 

Support from victim support services (Art. 9) 

Right to be heard (Art. 10) 

Rights in the event of a decision not to prosecute 
(Art. 11) 

Right to safeguards in the context of restorative 
justice services (Art. 12) 

Right  to  reimbursement  of  expenses  (Art. 
14) 

Right to the return of property (Art. 15) 

Right  to  decision  on  compensation  from  the 
offender  in  the  course  of  criminal  proceedings 
(Art. 16) 

Rights  of  victims  resident  in  another  Member 
State (Art. 17) 

Right to protection (Art. 18) 

Right  to  avoid  contact  between  victim  and 
offender (Art. 19) 

Right  to  protection  of  victims  during  criminal 
investigations (Art. 20) 

Right to protection of privacy (Art. 21) 

Individual  assessment  of  victims  to  identify 
specific protection needs (Art. 22) 

Right  to  protection  of  victims  with  specific 
protection  needs  during  criminal  proceedings 
(Art. 23) 

Right to legal aid (Art. 13) 

Source: Authors’ elaboration based on desk research 

279 Art. 22 (1) Member States shall ensure that victims receive a timely and individual assessment, in accordance 
with national procedures, to identify specific protection needs and to determine whether and to what extent they 
would benefit from special measures in the course of criminal pro ceedings, as provided for under Articles 23 and 
24, due to their particular vulnerability to secondary and repeat victimisation, to intimidation and to retaliation. 
(2) The individual assessment shall, in particular, take into account: (a)the personal char acteristics of the victim; 
(b)the type or nature of the crime; and (c)the circumstances of the crime.  
280 Art. 2(1) For the purposes of this Directive the following definitions shall apply: ‘victim’ means: a natural person 
who has suffered harm, including physical, mental or emotional harm or economic loss which was directly caused 
by a criminal offence (…)”. 

80 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

The PSD2 improved the protection of consumers in case of NCP frauds by harmonising the rules on 
liability on both payers (natural and legal person) and payment institutions (legal person). As regards 
losses that consumers may face, the new rules streamline  and further harmonise the liability in case of 
unauthorised transactions, ensuring enhanced protection of the legitimate interests of payment users. 
According  to  the  Directive,  in  case  of  an  unauthorised payment transaction, the payment service 
provider should immediately refund the amount of the transaction to the payer, unless suspicions 
based on objective grounds are raised regarding a fraudulent behaviour by the payment service user. 
There should be no liability where the payer is not in a position to become aware of the loss, theft or 
misappropriation of the payment instrument. The Directive also enhances consumers’ rights providing 
unconditional refund right (as for SEPA direct debit). In such cases, payers can request a refund even 
in the case of a disputed payment transaction. Consumers will also be better protected when the 
transaction amount is not known in advance such as in the case of hotel bookings and when sending 
transfers and money remittances outside the EU or paying in non -EU currencies. This Directive also 
requires MS to designate competent authorities to handle complaints of payment service users and 
other interested parties.  

National legal frameworks 

National legislation can affect the level of protection of victims of NCP frauds in two  ways: 

  direct  approach,  by  adopting  specific  provisions  regarding  victims’  rights  that  are 
complementary  to  the  standards  provided  by  Directive  2012/29/EU,  expanding  for 
instance the scope of measures to legal persons; 
indirect  approach,  by differentiating the level of penalties and sanctions to punish NCP 
frauds.  This  approach  may  have  a  deterrent  effect  on  fraudsters  while  improving 
consumers’ perception of protection and safeguard.  

 

Direct approach 

Overall the rights indicated by Directive  2012/29/EU are covered by most national legislation, with 
some MS ensuring, at least in principle, a wider protection than others. Victims’ rights , including the 
right to be heard, the right to legal aid, the right to protection of victims during criminal investigations 
and the individual assessment of victims to identify specific protection needs, are heterogeneously 
ensured to victims across the EU (please refer to Annex 6 for a detailed analysis). 

Besides victims’ rights identified in Directive 2012/29/EU, several Member States adopted legislative 
rules to ensure a higher level of protection. This is the case, for instance of the following Member 
States. 

 

  The Netherlands with regard to the right of speech (Art. 51 of the Criminal Procedure 
Code). Moreover similarly to the natural person, the legal person can considered victims 
as well. 
Portugal  with  regard  to  the  right of rectification of the payer from from the payment 
service  provider  in  case  the  payment  order  has  not  been  authorised  or  has  been 
incorrectly processed (Law 317/2009 on Payment Services and Electronic Currency). 
France where victims of violations of personal data can exercise the right of access to 
the filed regarding its personal data subject to processing and transfer to a third party 
and can request a correction or deletion of such data (Art. 38 and 40 of the Law 78 -17).  

 

Even though identity theft is criminalised by most of the Member States, the Evaluation team could not 
find  national  provisions  directly  referring  to  the victims’ rights  for such an offence. The increasing 
importance of this criminal phenomenon makes this aspect as an area for further improvement also 
considering the multiple negative effects that victims of identity theft may face (Button, Tapley, and 
Lewis, 2013; Harrell and Langton, 2012; Modic and Anderson, 2015; Whitty and Buchanan, 2015). 
Such effects include 

 

a  wrongful  criminal  record  linked  to  the  activities  of  the  fraudster,  resulting  in  an 
impairment that they will have to bear for the rest of their lives; 

81 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

a  consideration  as  a  bad  customers  for financial institutions and, as such, potential 
obstacles in obtaining loans or other bank services; 

  difficulties  to  obtain  employment,  due  to  the  fact  that  they  might  be  perceived  as 

fraudsters; 
emotional harm, including sense of vulnerability and a distrust in others.  

 
Indirect approach 

The level of protection of victims differs between MS due to differences in both national provisions 
stating  their  rights  and  the  level  of  penalties  relating  to  NCP  frauds.  The  FwD  does not provide 
minimum  or maximum levels of penalties. Very few MS set minimum sanctions, a larger number of MS 
specified minimum levels for maximum penalties and in both cases, levels of penalties are different 
(see also section 3.2 for an in depth analysis of national penalties relating to the FwD offences). This 
may  create  create  room  for  opportunistic  behaviours  of  criminals  and  eventually  to  an  uneven 
protection of victims between MS. 

Feedback  received  from  interviewe d  stakeholders  further  confirm  this  statement.  Moreover,  as 
suggested by one representative from Asso and DPA, the heterogeneous level of protection can also be 
relating to the different relevance given to NCP fraud at political level by MS. This reflects, for instance, 
in limited actions aiming at raising awareness on the risks of identity theft and cybercrime (in order 
not to scare citizens and hinder their use of the Internet), and a limited effort in fighting these crimes 
in MS where NCP frauds are not the priority. 

Moreover, the protection of victims’ rights might be hindered in practice by issues of territoriality and 
jurisdiction.  Some  stakeholders  involved  in  the  study281  mentioned  some  examples  of  offences 
remained unpunished because of legal loopholes, such as the residency abroad of criminals that make 
investigations difficult for the home country (i.e. Eastern European countries) and subscription traps.  

As for the deterrent effect of penalties for payment fraud, it should not be overestimated, give n that 
the ultimate effect of penalties on the criminal phenomenon depends also on the enforcement of such 
penalties when fraudsters are caught and convicted that, according to stakeholders, seems to be not 
fully satisfactory.282 Overall, there is the perception that penalties applied at national level in this field 
are generally too low to be dissuasive (European Commission, 2008).  

Relevance of the current legislative framework and related initiatives to victims’ needs  

EQ16: What are the specific needs of victims of fraud and/or identity theft? 

The coverage of victims’ rights ensured by the legislative framework described above appears to be 
not fully adequate to the needs of victims of fraud and/or identity theft. Interviewees representing the 
Victims  Associations  and  Academia 283  consider  that  existing  victims’  protection  measures  are  not 
sufficient. New ways of carrying out fraud and identity theft are on the rise, and there is the need for 
laws and guidelines to keep up with recent development and trends.  

There  are  no  comprehensive  statistics  showing  to  which  extent  victims  have  accessed  their 
rights.  Directive 2012/29/EU requires Member States to provide to the Commission, by 16 November 
2017, and every three years thereafter, data showing how victims have acces sed the rights set out in 

281 Interview feedback: four representatives from Asso and DPA, three from the private sector and one from EU 
Institutions and bodies.  
282 Interview feedback: two representatives from Asso and DPA and five from the private sector.  
283 Interview feedback: two representatives from Victims Associations and Academia. 

82 

 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

the Directive.284 However, data are difficult to collect due to the general under-reporting of NCP related 
crimes, and there is the need  for a systematic registration and handling of complaints received by 
police,  judicial,  health,  social  and  other  relevant  authorities  and  NGOs  that  work  in  contact with 
victims.  

The limited stakeholders’ satisfaction on the appropriateness of the current level of victims’ rights 
protection is also linked to the poor enforcement of the existing rules. It may occur that complaints 
reported to the police remain un-investigated and unsanctioned since the offences are not recognised 
as a crime in some MS, or because there are difficulties in gathering evidence to prove the crime. 285 
(see Box 15 for an example). Moreover, the time needed to conduct an investigation and the related 
prosecution is not always aligned with stakeholders’ needs. 

Box 15 – Example of difficulties  in gathering  evidence supporting  investigations   

Victim  – bank’s client tried to log into bank account from office computer on 22 May 2014. Despite 
several attempts she failed to enter the account due to alleged  problems with Internet connection. 
After  typing  both login and password bank’s webpage crashed and in a while bank’s webpage 
required from victim  to provide password from the list of one -time passwords. Victim admitted that 
she has entered required password several times but all operations failed due to lack of access to 
the account. 
However, on 22 and 23 of May two payments were made form victim’s account in total amount of 
5000 euro. The money hit the account in the same bank and then were withdrawn in one of the 
bank’s branches. Victim finally mange to log into bank account and afte r realising that part of her 
savings is gone immediately filed a complaint in the bank, which blocked access to the account and 
notified the police. The Bank did not consider the client's complaint and refused to acknowledge her 
claim and the police droppe d the case due to the failure to detect the suspect. Afterwards victim 
decided to take this case to the court and won the case. Court argued that on the basis of the law 
on  payment  services  banks  are  obliged  to  partly  compensate  victim’s  loss  in  case  of  In ternet 
schemes which include banks’ webpages (Court sentence II C 383/15 of September 28, 2015) 

Source: Authors’ elaboration based on desk research 

In  order  to  improve  victims’  protection  and  better  meet  their  needs, some initiatives, other than 
legislative, have been launched at both EU and national level. 

Prevention is widely considered as a good practice  to limit the vulnerabilities of consumers and 
ultimately improve their protection 286 and there is consensus among stakeholders that it should be 
further developed at both national and cross -border level. Prevention measures may include public 
campaigns for raising awareness on the use of emails and on the use of social networks, trainings on 
the  existing  legal  framework,  publication  of  good  practice  manuals  and  guides,  the  creation  of 
dedicated  online  website  for  victims  redress.  The  OECD  further  highlighted  the  importance  of 
preventive initiatives. In recent years, a patchwork of public and private sector bodies, and the media, 
have alerted the public about threats relating to identity theft, at both domestic and international level. 
These types of measures, when followed by consumers’ behavioural changes, might be key to prevent 
identity theft related offences while maintaining the online confidence needed to ensure the growth of 

284 The Directive also specifies what type of statistical data should be provided, including at least the number and 
type of crimes reported and, if known and available, the number of victims, and their age and ge nder, judicial, 
police and administrative data (collected by health and social services, victim support organisations and restorative 
justice services and other entities working with victims). 
285 Survey feedback: one representative from EU Institutions and Bodies. 
286 Survey feedback: four representatives from the private sector, three from NBF, three from Asso and DPA. 
Interview feedback: one representative from EU Institutions and bodies.  

83 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

the Internet economy (OECD, 2008). Finally, the sharing of relevant information among institutions 
could also support crime prevention.287 

Some  Member  States  also  implemented  specific  support  actions. In Portugal, for instance, the 
activity of victims associations 288 started to grow due to the increased number of victims in need of 
psychological and practical support, and of complaints regarding to various type of cybercrime and 
financial  fraud  (e.g.  phishing).  Also  in  the  United  Kingdom,  there  is a range of support initiatives 
offered  to  victims  from  a  number  of  organisations.289  Some  organisations  take  care  of  a  limited 
number of victims in order to be able to offer extensive personal support while others cover large 
numbers of victims and set up dedicated support services.  

Associations at national level often inform consumers of the possibilities they have to be protected, by 
organising conferences in the schools and offering legal support to citizens. They also help victims with 
respect  to  their  complaints  by  maintaining  communication  with  the  entities  involved.  Besides 
associations, there are also self-help groups, such as Think Jessica (UK)290 and e-victims.org (UK)291 
that aim at improving victims’ protection, but there might be scope to support the creation of more of 
such groups, and to expand ways for helping victims (e.g. including through the creation of online 
platforms for victims to share their experiences). Support to victims of fraud is also provided by the 
European Consumers Centers established in all MS and offering support and consultancy to consumers 
with all types of scams which originate in another country.  

Setting up whistleblowing channels is another type of measure implemented at national level to fight 
against fraud while ensuring victims’ protection. Most of the survey respondents from Asso and DPA 292 
highlighted the existence of whistleblowing channels at national level.293 The most common measure 
taken in this respect are: (i) Setting up a financial institution contact point for reporting the fraud, (ii) 
Setting up Hotlines for complaints and complaint procedures, (iii) Creation of Whistleblower Officers in 
Government entities.  

The creation of national whistleblowing channels depends on the existence of whistleblower protection 
laws as well as on political, and social factors (Transparency International, 2013). Even though several 
MS294 have taken steps to strengthen whistleblower rights in recent years  there are still differences 
between  MS  that  need  to  be  addressed.  In  this  view  the  Council  of  Europe  set  out  principles 
encouraging MS to take action including legislative change, to protect whistleblowers and provides 

287 As pointed out by experts during the 1stEGM, there are some good practices of voluntary cooperation at national 
level: in FR LEAs share information about statistics and new threats with the National Central Bank; in EL the police 
C ybercrime Unit shares information on new threats and advice on how to prevent/react with gen eral public and 
financial institutions through a dedicated website; EE has a dedicated information sharing initiative among financial 
institutions. In this sense, Europol supports prevention mainly through a crime prevention network of LE experts.  
288 The Portuguese Association for Victim Support (APAV) is a private charitable organisation, recognised by law 
with statutory objective to inform, protect and support citizens who have been victims of crime. The Portuguese 
Association for Consumer Protection (DECO) is an independent non-profit association with charity status. It is the 
largest consumer association in Portugal and possesses a 'Public Utility' status. 
289 Examples of victims associations are: Age Scotland, Victims Support and Age UKPrudential and Experian. These 
organisations offer also online guidance to the consumers to help them reduce the  risk of fraud and identity theft. 
290  Think  Jessica  is  a  registered  charity  supported  by  countless  agencies,  organisations  and  police  forces 
nationwide and is committed to making people aware of the danger and financial implications caused by postal and 
telephone scams, educating professionals and protecting the most vulnerable members of the UK society from 
illegal practices. 
291 The E-Victims Organisation is an independent non-for-profit company (Community Interest Company, C IC), set 
up to benefit the UK Internet community, through working with industry, consumers, support charities, policing, 
and government agencies to provide advice to e -victims. 
292 Survey feedback: nine representatives from Asso and DPA. 
293 For instance: Financial Market Authority Whistleblower-System in Austria, the Address Electronic Crime in 
Greece, the Public C oncern at Work in the UK. 
294 For instance: AT, BE, DK, FR, HU, IT, LU, MT, RO, SL. 

84 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

guidance (Recommendation CM/Rec(2014)7 on the minimum standards to be implemented in order to 
increase the use of this channel for victims’ protection). 

Access  to  justice  for  victims  does  not  refer  only  to courts proceedings but also to other types of 
settlements, such as mediation, conciliation and a rbitration. In this view it worth mentioning also the 
use  of  Alternative  Dispute  Resolution  techniques  and  proceedings  aimed  to  widen  the 
options available for the protection of victims. Alternative dispute resolution represents a simple, 
fast and low -cost out-of-court solution to disputes between consumers and traders which will likely 
increase in the future in view of the implementation of recent EU measures adopted in this regard. 295 

Despite  the  above mentioned initiatives to ensure victims’ protection, there are still some victims’ 
needs that call for further consideration, and namely:  

  need  to  understand  and  to  be  understood  during  criminal  proceedings,  and  that 
authorities pro-actively assist victims to do so and to receive information from the first 
contact with a competent authority through appropriate tools that make different types 
of information accessible to victims;296 

  need to receive information about their case (when not confidential);297  
  need  to access support services that provide information and  advice, emotional and 
psychological support and practical assistance, including establishing  contact points for 
victims;298 

  need for victims to recover losses/reimbursement of expenses; 

4.3  Efficiency  

4.3.1  The cost of frauds  

EQ1:  How  much  do  fraud  and  counterfeiting  of  non-cash  means  of  payment  cost?  To  which 
entities?  How are costs  expected to increase? 

The dimension of crime 

This section provides evidence on frauds or risks of frauds for each NCP instrument. As mentioned, 
statistics  are  available  only  on  payment  cards.  For  other  instruments,  even  though  available 
information  does  not  allow  for  a  comprehensive  overview  of  the  EU  dimension  of  the  criminal 
phenomena, evidence gathered points to the existence of problems and security issues that need to be  
addressed and that are presented in the following paragraphs. 

Overall,  the  cost  of  NCP  frauds  is  over  €1.44  billion  for  the  EU  and  is  likely  to  increase 
considering  that frauds are expected  to increase for most  NCP instruments.   

Payment cards frauds 

Worldwide, card fraud losses amounted to nearly $22 billion in 2015 and are projected to reach more 
than  $30  billion in 2020 (HSN Consultants, 2016). At the EU level, frauds on cards issued within 
the  Single  Euro  Payment  Area  (SEPA) 299  are  also  a  growing  phenomenon  in  both  absolute 

295 The C onsumer Aletrnative Dispute Resolution Directive 2013/11/EU and the Online Dispute Resolution 
Regulation No 524/2013. 
296 Survey feedback: one representative from Asso and DPA. Interview feedback: one representative from victims 
associations.  
297 Survey feedback: one representative from Asso and DPA. 
298 Survey feedback: two representatives from Asso and DPA. Interview feedback: one representative from PPP and 
one from victims associations. 
299 SEPA consists of 34 countries: all MS plus Iceland, Liechtenstein, Norway, Monaco, San Marino, and Switzerland. 
All parts of a country are normally part of SEPA, with some countries having special territories which are not part of 
SEPA. 

85 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

and relative terms (i.e. as the share of the value of fraudulent transactions on the total value of all 
transactions), with the latter increasing at a slower rate.  

The most recent statistics provided by the ECB on cards issued within SEPA show that the total value 
of  frauds  committed  on  transactions  in  2013  amounted  to  €1.44  billion  (European  Central 
Bank, 2015a).300 France, the UK, and Luxembourg are the top three Member States as per share of 
frauds on the total value of card transactions and there is evidence that cross-border transactions 
are more affected by frauds than domestic  transactions  (European Central Bank, 2015).  

transactions  represent 

the  biggest  portion  of 

Card-not-present  (CNP) 
fraudulent 
transactions  (66% of the total value of frauds on cards issued within SEPA) despite representing only 
the 11.6% of the total number of card transactions. Yet, the diffusion of secure technologies might 
limit  CNP  fraud, even though up to now their potential has not been fully exploited. For example, 
despite 3D secure technology301 CNP fraud remains the main issue when tackling NCP fraud in Europe, 
with only five Member States able to reduce the level of CNP frauds from 2008 to 2013 (European 
Central Bank, 2015a) and still several websites show vulnerabilities to be exploited by fraudsters.302 As 
an  alternative,  strong  customer  authentication  methods  such  as  Targeted  Authentication 303 
demonstrated a high effectiveness in reducing fraud.304 

Card-present  frauds  (i.e.  POS  and  ATM)  showed  instead  a  remarkable  decrease  in  the  past 
years  (-36%  altogether  in  the  period from 2008 to 2013)  (European Central Bank, 2015), mainly 
thanks to the diffusion of the Europay, MasterCard and Visa (EMV) standards and their adoption by 
payment infrastructures (for instance through skimming devices), making it harder for fraudsters to 
skim cards data.305 Still, two emerging risks for which no detailed statistics are available are gaining 
importance: frauds relating to mobile wallets and fuel cards.  

When looking at frauds relating to cards acquired within SEPA,306 it is possible to conclude that overall 
European  cardholders  benefit  from  higher  security  standards  than  cardholders  from 
countries  outside  SEPA. First, the share of card present fraudulent transactions rises when analysing 
transactions with cards issued worldwide and acquired within SEPA. Second, when looking at cross-
border transactions, frauds on cards issued within SEPA and acquired outside SEPA accounted for a 
lower value than frauds on cards issued outside  SEPA and acquired inside the area. 

Please refer to Annex 4 for a detailed analysis of frauds relating to payment cards.  

Credit transfers/wire transfers frauds  

300 Figure also confirmed by BEUC, the European Consumer Organisation <http://www.beuc.eu/publications/beuc-x-
2017-012_mgo_security_of_payments_under_the_revised_payment_services_directive.pdf>  
301 Protocol designed to be an additional security layer for online credit and debit card transactions .  
302 Three quarters of the websites that Symantec scanned in 2015 had vulnerabilities and this number remained 
rather stable over the years (Symantec, 2016). 
303 Targeted Authentication techniques dynamically assess the risk of each attempted online transaction by an  
analytical engine that monitors in real-time a combination of customer credentials, including behavioral factors and 
transaction characteristics. This allows for challenging online payment attempts according to their associated risk 
and, on that basis, the execution of each transaction is either allowed or denied. 
304 “Targeted Authentication techniques implemented by several UK card issuers resulted in a 70% reduction in 
abandonment compared to the previous application of 3D Secure solutions that required c ustomer intervention for 
every transaction” mainly thanks to the reduction in the checkout time and a better customer experience. 
(C leverAdvice, 2016). 
305 Most of the card-present frauds take place in the USA and increasingly in Asian countries that do not adopt the 
European EMV standards. 
306 An acquiring bank (also known simply as an acquirer) is a bank or financial institution that processes credit or 
debit card payments on behalf of a merchant. Therefore, a transaction “acquired” identifies a transaction that has 
been processed by the acquiring bank on behalf of the merchant. 

86 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Wire/credit  transfers  are  also  increasingly  subject  to  fraud.  As  phishing  attacks  are  more 
sophisticated and targeted, some companies have lost significant amounts because employees were 
fooled into believing wire transfer requests were genuine (Symantec, 2016). 

Money  muling  contributes  to  wire  transfer  frauds:  money  mules  are  recruited  (sometimes 
unwittingly) to transfer illegally obtained money from one account to another, often located in different 
countries. 

Some  specific  fraud  techniques  are  used  in  relation  to  money  remittance.  Western  Union  and 
MoneyGram  identified  some  key  methods  used  to  defraud  senders  of  money  transfers  (e.g.  the 
mystery shopper, the vehicle purchase scam, false lotteries, the relative in need scam, charity scams, 
and so on). As previously mentioned, the market is still dominated by cash transfers: as these services 
and  new  players  are  offering  online  money  transferring  model,  transactions  will  be  made  in  an 
increasingly safe environment, thus enhancing their security. 

Direct debits frauds 

Direct debit frauds are typically relating to frauds which involve the people’s failure to keep secret 
details on their own account. Once  such details are obtained, fraudsters set up direct debits that allow 
money to flow out. Companies are increasingly encouraging the use of these means of payments to 
pay bills, but naivety of customers and craftiness of fraudsters can become a problem. Mostly, frauds 
are realised through the theft of small amounts of money, in such a way that people fail to realise that 
there have been frauds (Craik, 2007). Frauds are likely to increase with the spread in the use of 
SEPA Direct Debit systems.  

Cheques frauds 

Cheques frauds are strictly relating to the paper/physical form of the payment instrument object of the 
frauds. These means of payment are typically counterfeited, forged, or fraudulently altered. Given the 
decreasing adoption of cheques (see section 2.3), frauds are subsequently decreasing. Statistics 
from the UK showed a steady drop of cheque fraud losses from 2012 to 201 6, plunging at a historical 
low value of £13.7 million in 2016 (Financial Fraud Action UK, 2016). Among the three fraud methods 
mentioned earlier, only counterfeiting grew in the UK from 2014 to 2015 by 41% for a corresponding 
value of £8.5 million.  

Bills of exchange frauds 

Similarly  to cheques, also for bills of exchange frauds are strictly relating to the corporeal nature of the 
payment instrument. There are no available figures on fraud relating to bills of exchange . However, 
the Evaluation team estimates that trends (both relating to the adoption and to frauds relating to such 
instruments) are likely to be similar to the ones relating to cheques and, therefore, decreasing. 

Meal vouchers/ticket restaurant frauds  

Similarly  to cheques and bills of exchange, also meal vouchers  can be subject to counterfeiting given 
their paper nature. There are no comprehensive statistics on counterfeiting of meal vouchers, rather 
anecdotal evidence of cases occurred in some MS. For example in France some years ago more 
than 10,000 counterfeite d meal vouchers were found by the customs officers at the Franco -Swiss 
airport in Basel-Mulhouse (Sudouest, 2013). Cases mainly refer to paper tickets counterfeiting and do 
not mention electronic ticket restaurant frauds. 

Coupons frauds 

Risks  of  counterfeiting  and  fraudulent  redemption  seem  to be higher for coupons  with both a 
corporeal and a digital dimension. High value coupons, insufficiently strong terms and conditions, and 
coupons that can be easily reproduced seem to be the key fact ors for fraudulent redemptions. In 
addition to this, the sharing of online voucher codes increases the risk of abuse of such instruments. 
The reasons behind this phenomenon seems to be linked to the limited development of digital coupons 

87 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

management and the potential multiple redemption of them. Without strong capacities to manage 
online  coupons,  it  is  difficult  for  brands  to  control  the  distribution  and  validity  of  their  vouchers 
(Handley,  2014).  The  control  of  the  digital  distribution  of  such  coupon  is  key  to  lowering  the 
opportunities for frauds. Fraudsters are becoming increasingly sophisticated in their ability to replicate 
gift vouchers and therefore the industry needs to upgrade and update the security measures available, 
introducing new levels of security, subject to cost-effectiveness considerations. Other than the mass 
printing of counterfeited coupons, there are some additional methods used to carry ou t coupon frauds. 
Some of them include the modification of the coupon expiration date and the use of coupons for goods 
different but highly similar to the ones they were actually issued for (Sampler, 2016).  

Fidelity/Loyalty cards frauds 

Frauds related to fidelity and loyalty cards, when also used as payment instruments are counted in the 
statistics relating to card payment frauds in Section  4.3.1. But there are also fraud risks related to 
points/rewards stored in those cards for which statistics are not available but some anecdotal evidence 
could  been  gathered.  The  fraudulent  use  of these cards concerns primarily the load of cloned 
data  from  credit  cards  on  the  magnetic  stripes, and the theft of points or miles (e.g. those of 
airline  companies)  from  other  fidelity  cards  (Ardito, 2007; Benvenuti, 2013; Markowitz, 2014; The 
Telegraph,  2011)  through  some  techniques  specifically  applicable  to  these  payment  instruments 
(Cambridge Intelligence, 2014). For example, frauds happen when a member of store staff charges his 
own account with customer credit or manipulates IT systems to collect credit, or when customers share 
loyalty credits against the terms of their scheme or simply break the rules to gain more points than 
they  are  entitled  to  –  for  example,  claiming  air  miles  twice for a shared-revenue ticket. Forms of 
phishing  or  other  social  engineering  techniques  can  also  be  used  by  frau dsters  to  collect  the 
information required to empty loyalty accounts. 

E-money frauds 

As  regards  e-money,  it  is  worth  mentioning  that  while  the  ECB  analyses  this  type  of  payment 
instrument  separately  when presenting statistics on the value and volume of tra nsactions across 
different MS, it does not provide specific figures on related frauds (European Central Bank, 2015). It is 
reasonable thinking that most of the e-money related frauds are included in the overall figures 
relating  to  card  payment  frauds  since  one  of  the  main  usages  of  e -money  is  through  pre-paid 
cards. However, when providing figures on card frauds, the ECB makes a distinction between debit and 
credit cards only, without referring to e -money transactions. Therefore, there are no plausible figures 
on e-money frauds. 

Virtual currencies frauds 

Virtual  currencies  are  potentially  vulnerable  to  fraud,  participating  in  money  laundering  and 
terrorist  financing  abuse,  as  well  as  simple theft by those running exchanges and third parties. 
First, they allow for greater anonymity than traditional non-cash payment methods. Virtual currencies 
can be traded on the Internet through non-face-to-face customer relationships, and thus allow for 
anonymous  funding  (FATF, 2014). Since the explosion of Bitcoin in 2009, the number of hucksters 
focusing on this target has been increasing. However, given their recent d evelopment, forms of scams 
relating to virtual currencies still remain poorly understood. Since 2009 there have been frauds for $11 
million worth of bitcoin,  and only $4 million has been returned to the victims (Vasek and Moore, 2014). 
It also seems that scams draw the vast majority of their revenues from a few victims, presenting an 
opportunity for law enforcement to track down and prosecute the scammers when: i) it is technically 
possible to trace the identity of the fraudster ii) the fraud is reported in a reasonable timing, and iii) 
LEAs  are  responsive.  Even  though  the  system,  as  further  explained  below,  may  ensure  greater 
anonymity  than  other  NCP  transactions,  it  also  allows  for greater control through  the use of the 

88 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

blockchain307  which  could  make  it easier to assess the true risk posed by scams, and make it harder 
for scammers to hide. 

Overall,  decentralised  systems are particularly vulnerable to anonymity risks. For example, Bitcoin 
accounts  are not linked to any customer identification information, and the system has no central 
server, no service provider, and no anti money laundering software is currently available to monitor 
and identify suspicious transaction patterns. Virtual currency systems can be used to make cross -
border payments and commonly rely on complex infrastructures that involve several entities, often 
spread  across  several  countries.  This  segmentation  of services means that responsibility may be 
unclear. This problem is exacerbated by the rapidly evolving nature of decentralised virtual currency 
technology and business models, including the changing number and types of p articipants providing 
services in virtual currency payments systems (FATF, 2014). Also some stakeholders consulted raised 
concerns in relation to the use of virtual currencies and in particular to their anonymity.308  

Mobile money frauds 

Mobile  money  (e.g.  carrier  billing)  seems  to  be  an  unattractive  target  for  fraudsters  as  they 
need  to  get  physical  access  to  the  consumer’s  device  (hence  unlocking  the  SIM card and locked 
screens). This creates additional layers of security to be overcome by fraudsters and may limit the 
exposure of this payment instrument to the risk of fraud. Moreover, mobile money is typically used to 
purchase digital goods, which are non-transferrable to anyone other than the buyer, and can easily be 
“called back” by the merchant. However, given that digital goods are p rojected to rise in the future, it 
is likely that mobile money frauds and more general mobile payment frauds will also increase. Frauds 
on this payment instrument typically occur when there are phishing attempts from fraudsters to make 
another user pay on their behalf (gaining his or her PIN through fake messages, similar to CNP), or 
when mobile phones and SIM cards are stolen.  

Stakeholders bearing the costs 

In general terms stakeholders that can be affected by frauds can be classified in three categories: 
payers, payees, and enablers (including payment service providers).  

The  liabilities  of  actors  involved  in  unauthorised  transactions  are  set  in  the  PSD2, 309  which 
subsequently defines who bears the financial cost of the fraud.  

Overall,  payment  services  providers  bear  most  of  the  costs  relating  to  fraudulent 
transactions.  According  to article 70 of the PSD2, the payment service provider must ensure that 
appropriate means are available at all times, enabling the payment service user to notify the loss, theft 
or  misappropriation  of  payment  instruments.  The  payment  service  provider  bears  the  financial 
consequences  that  occur  after  notification  about  lost,  stolen  or  misappropriated  payment 
instrument.310 Among payment service providers, card issuers are amongst the players who suffer 
most  in  case  of  fraud.  For  example,  when  a  fraud  happens  on  less  protected  terminals  in  third 
countries, most of the losses generated is on the card issuer due to a lack of specific settlements and 
regulation  on  the  refund  of  losses  caused  by  less safe terminals. In addition to payment service 

307 A digital ledger in which transactions made in Bitcoin or another cryptocurrency are recorded chronologically and 
publicly. 
308 Interview feedback: two representatives from EU institutions and bodies, two from LEAs. Survey feedback:two 
respondents of Asso and DPA, five respondents of LEAs and two respondents of the private sector.  
309 According to art. 64 of the PSD2, “a payment transaction is considered to be authorised only if the payer has 
given consent to execute the payment transaction. A payment transaction may be authorised by the payer prior to 
or, if agreed between the payer and the payment service provider, after the  execution of the payment transaction.” 
In the absence of such consent transaction shall be held unauthorised. 
310 Using the words of a representative from NBF “mainly the financial institutions pay the cost of fraudulent 
transactions, and to some extent customers/merchants”. 

89 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

providers,  credit  card  schemes  like  Visa  and  MasterCard  may  also  be  affected  by  fraudulent 
transactions since they have to handle and manage the chargeback processes 311 started following a 
fraudulent transaction, when the payment card is used to make a purchase without the consent and 
the authorisation of the real owner of the card. Credit card schemes have to intervene in case the 
acquirer bank and the issuer bank cannot solve the dispute.  

As long as the payer complies with his obligations and does not act with negligence or fraudulently (or 
more  accurately,  cannot be shown to have done so) he/she is refunded the total sum  (European 
Parliament and Council of the European Unio n, 2015a, p. 69).312 Negligence can be associated to the 
fact that the payer fails to keep the personalised security features safe from misappropriation of a 
payment instrument occurring before he has fulfilled his obligation to notify the provider.  

The payee (i.e. the merchant) is typically held liable when he does not comply with EMV standards in 
card-present  transactions,  and  does  not  require  strong customer authentication 313 in all types of 
transactions (with protocols like 3Dsecure) (European Parliament and Council of the European Union, 
2015a  Art.  73  and  74).314  As  long  as the merchant meets such criteria, the liability for fraudulent 
transactions shifts to the payment service provider. 

Besides liabilities defined in PSD2, it is worth highlighting that there is a general tendency among 
stakeholders answering the survey to consider all the actors involved in the process somewhat liable 
for the fraudulent transactions.315 Even if this is correct from a theoretical point of view, it is also true 
that  it  is  easier  for  cardholders  and  merchants to be compliant with the minimum obligations (as 
described  in  the  PSD2)  and  thus  shifting  the  liability  to  payment  service  providers.  Despite  this 
situation, few stakeholders mentioned exclusively the cardholders and the merchants as the actors 
bearing the costs of frauds.316  

Besides  the  financial  cost,  frauds determine an increased lack of trust.  There is an increasing 
concern  of  EU  citizens  regarding  bank  card  or  online  banking  fraud,  with  no  Member  State 
showing a decreasing level of concern between 2013 and 2014. According to the 2014 Eurobarometer 
on  cybersecurity  which  reports Internet users’ perspectives observed in different Member States, 
Latvia,  France  and  Spain  express  most  concerns  with  respectively  79%,  76%  and  74%  of  the 
respondents declaring to be very or fairly concerned (TNS Opinion and Social, 2015). On average 63% 
of  respondents  across  the  EU  said that they were concerned about online banking or bank card fraud 
(+14% with respect to 2013). Member States with the highest percentages of Internet users who 
claimed  not  to  be  concerned  about  these  issues  were  Germany  (52%)  and Sweden (51%) that, 
together with Estonia seem to perceive the risks on this matter as less severe.  

311 C hargeback is the return of funds to a consumer, initiated by the issuing bank of the instrument used by a 
consumer to settle a debt. Specifically, it is the reversal of a prior outbound transfer of funds from a consumer's 
bank account, line of credit, or credit card. Chargebacks can be used to dispute a credit card transaction and secure 
a refund for the purchase. Customers dispute charges to their credit card usually when goods or services are not 
delivered within the specified time frame, goods received are damaged, or the purchase was not authorised by the 
credit card holder. 
312 A stakeholder from the private sector further highlighted the concept, stating that “in case of gross negligence 
the cardholder pays, otherwise financial institutions are likely to bear the costs”. 
313 An authentication based on the use of two or more elements categorised as knowledge (something only the user 
knows), possession (something only the user possesses) and inherence (something the user is) that are 
independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a 
way as to protect the confidentiality of the authentication data – PSD2, Art. 4, definition (30). 
314 The PSD2 determines the requirements: strong customer authentication is based on the use of two or more 
elements categorised as knowledge (something only the user knows, e.g. a password or PIN), possession 
(something only the user possesses, e.g. the card or authentication code generating devic e) and inherence 
(something the user is, e.g. fingerprint or voice recognition) to validate the user or the transaction.  
315 See Annex 8 for further details. 
316 Survey feedback: two representatives from the private sector.  

90 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Member States are also concerned about cyber extortion, though to a lesser extent in comparison to 
online banking and card fraud: 60% and 68% of respondents in Latvia and Spain respectively stated 
they were very or fairly concerned about cyber extortion.317  

Finally,  some  industries  are  particularly  affected  by  payment  card  fraud.  The  airline  sector 
seems to be among the most affected. The airline industry faced estimated losses for USD 1 billion 
per  year  as  a  result of airline tickets purchases using compromised card data, which are typically 
obtained as a consequence of data breaches (Europol, 2014a). Such trend has seen a general increase 
in the EU and, besides the airline companies, car rentals and accommodation are the other two sectors 
that are strongly affected by fraudulent online purchases (Europol, 2016b). 

Focus on identity theft  

Even though, most cases of identity theft generate economic losses, not all of them do. Identity theft 
causes  also  indirect  and  non-financial  costs  to  the  victims,  which  are  even  harder  to 
quantify.  Examples of such costs are: reputational damage, psychological and social distress, impacts 
on fundamental rights (e.g. data protection and privacy) and costs to rectify the consequences of the 
theft  (e.g.  replacing  identity  documents).  In  this  category  the  preventative  measures  that 
governments and the private sector need to take to manage the risks of this type of fraud (Fraud 
Prevention Expert Group, 2007) may also be included.  

Available data do not allow for the isolation of cases of identity theft generating economic losses or 
cases relating to non-cash payment frauds. Therefore, data provided below relate to identity theft in 
general terms, where not otherwise specified.  

In identity theft cases, there is typically a primary victim  (i.e. the person whose identity is abused) and 
a  secondary  victim (i.e. the third party who is defrauded or otherwise harmed by the perpetrator 
impersonating the primary victim) (European Commission, 2012). 

When  focusing  on  individuals  as  primary  victims,  in  2012  identity  theft318  affected  around  8.2 
million  people  across  Europe,  equal  to 2% of the EU population  (European Commission, 2012). A 
recent Special Eurobarometer on Cybercrime further highlighted the relevance of the problem. Most EU 
Internet  users  (68%)  are  concerned  about  being  victims of identity theft, with the highest levels 
recorded in France and Spain (80% and 79% respectively). In general, the level of concern relating to 
cybercrime increased from 2013 to 2014 and identity theft represented the type of cybercrime with the 
highest growth rate (+16%). On average, 7% of European Internet users claimed to have been victims 
of identity theft: the percentage rises in Hungary and Romania (11%), with  the latter showing the 
highest increase from 2013 (+6%), together with France (+5%) (TNS Opinion and Social, 2015).  

Even though it is not possible to assess the overall scale of the crime in terms of economic losses, 
some estimations can be done.  

According to the Study for an Impact Assessment on a Proposal for a New Le gal Framework on Identity 
Theft the estimated value of losses due to identity theft was €2,500 per person as primary victims, 
corresponding to approximately €20 billion at EU level (European Commission, 2012). However, this is 
a  conservative  estimation  since  there  is  likely  to  be  a  portion  of  identity  theft  crimes  that  goes 

317 In addition to these countries, high levels of apprehension were recorded also in Ireland (61%) and the Czech 
Republic (60%). On the other hand, Sweden, the Netherlands and Finland are the least concerned on this matter, 
with an average of 70% of the respondents stating to be not at all worried to be asked for a payment in exchange 
of getting back the control of a device. 
318 According to the C enter for Strategy & Evaluation Services it should include the cases “ when any person 
acquires, transfers, possesses or uses personal information of a  natural or legal person with the intent to make a 
false representation as to his identity to make a gain, acquire a benefit for himself or another, cause direct or 
indirect loss to another, expose another to a risk of loss, damage the reputation of another, expose another to a 
risk of damage to the reputation or mislead investigation relating to any crime“ (European C ommission, 2012). 

91 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

undetected or not revealed for statistical purposes. In this case the average of financial losses for 
primary victims may be around €5,000. Other sources registered smaller values ranging from €2,229 
to €2,800 (European Commission, 2012).  

Box 16 – Anecdotal  evidence on the  economic  dimension  of identity  thefts  in some Member 
States 

Identity theft costs to the UK economy nearly €2 billion per year, with more than 100,000 people 
affected each year. Payment cards fraud through the use of stolen iden tities is the crime responsible 
for the biggest share of the total value of identity related crimes in the UK (more than £500 million 
in  2006) (Fraud Prevention Expert Group, 2007). Additionally, an increase from 2008 to 2009 in 
identity fraud cases in the UK (+32%, with around 102,000 people affected in 2009) and in the 
number  of  victims  of  impersonation  (85,000  in  2009, +35% from the previous year)  (Robinson, 
Graux, Parrilli, Klautzer, and Valeri, 2011) has been noted.  
In France, instead, it is estimated that in 2009 the annual for victims was around €474 million (i.e. 
€2,229 per victim) (European Commission, 2012).  
Finally,  one  stakeholder  from  the  private  sector319  in  Finland  stated  that  “identity  theft  was 
criminalised in 2015. Annually there are around 20,000 payment fraud complaints and 4,000 identity 
theft complaints, out of a population of 5,5 million. Overall fraud is the fastest growing crime type 
out there, with double digit growth for the past 5 years”.  

Source: Authors’ elaboration based on desk and field  research 

Not all victims of identity theft suffer financial losses. However, anecdotal evidence highlights that 
economic  fraud  might  be  the  ultimate  purpose  of  the  crime  (e.g.  in  the  Netherlands  estimations 
suggest  that  65%  of  the  victims  of  identity  theft  are  likely  to  bear  economic  losses)  (European 
Commission, 2012). 

The same study makes also an estimation of the countries of origin of the perpetrators involved in 
identity  theft  schemes.  The  Russian  Federation, Nigeria, Romania, the UK, the USA, China, Spain, 
Ukraine, and Brazil are among the most frequent o ffender locations provided by the participants to the 
public consultation. 

According  to  a  previous  study,  costs  borne  from  identity  theft  are  higher  for  businesses  than 
for  individuals.  As  for  businesses,  in  2012  the  amount  of  losses  as  primary  victims  (when  their 
corporate  identity  is  misappropriated  and  misused)  and  secondary  victims  of  identity  theft  was 
estimated to be around €500 billion (equal to 0.4% of EU GDP) at its highest (European Commission, 
2012).  

While the economic damage caused to businesses as primary victims is more difficult to evaluate, the 
ones caused to businesses as secondary victims is likely to coincide (or at least to be similar) with the 
estimation of the total amount of crime affecting individuals. “Eventually businesses pay either directly 
as a result of settling claims for reimbursement, or because of the need to invest in systems to help 
minimise  the risk of identity theft”. Financial losses for busine sses relating to identity theft across 
Member States are mixed, with some Member States valuing the costs of identity theft for businesses 
below €50,000 and some others above this threshold. The reason of such differences is linked to the 
fact that organisations frequently lack the necessary equipment and reporting systems to recognise 
identity theft. In this regard, the UK provides some figures on non -cash payment frauds originated 
from identity theft cases. In 2009, the banking industry lost €19.5 million  as a result of stolen cheques 
used by fraudsters with a forged signature. In addition to cheques, the industry lost €624.4 million in 
the same year due to plastic card fraud, online and telephone banking fraud.  

319 Survey feedback: one representative from the private sector (FI). 

92 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

In  addition  to  private  companies,  governments  and  public  companies  may  also  be  affected 
by identity theft. Costs for governments seem to be more of an indirect nature and correlating to 
prevention measures and law enforcement systems, even though there are cases in which identity 
theft cases aim at causing direct financial losses against public bodies.  

Box 17 – Example  of how identity  theft  may affect the public  sector 

In the UK in 2007 the public sector occupational pension scheme claimed losses for €44 million due to 
people who kept receiving pension payments of close relatives even after their death, using their 
identities.  The  Criminal  Justice  System  reportedly  lost  around  €61  million  for  investigations, 
prosecutions  and  disposal  costs  relating  to  identity  fraud  cases.  Fina lly,  the  Drivers  and  Vehicle 
Licensing Agency borne losses for €6 million to detect false driving license applications made with fake 
identities (European Commission, 2012). 

Source: Authors’ elaboration based on desk research 

In  synthesis,  losses  negatively  affect  EU  Member  States,  causing  losses  for billions of euros 
every  year  and  making  consumers  lose  a  certain  amount  of  trust  in  online  and  offline 
payment  systems,  putting  at  risk  the  use  of  non-cash  means  of  payment,  at  least  for  some 
(Europol,  2013c, 2015a). 

4.3.2  Earnings  for Organised crime groups 

EQ2: Can earnings for organised crime groups be quantified? 

Even  though  there  is  evidence  that  brings  back  crimes  relating  to  NCP  instruments  to 
groups,  it  is  difficult  to  assess  to  what  extent  they  can  be  fully  ascribable  to  OCGs  or 
whether there is an “individual”  component  as well,  even more considering that when individuals 
are caught as fraudsters, it is often hard to understand whether they are part of bigger groups or 
not.320  

What is true is that if on the one hand technology advancements have broadened the opportunities for 
individuals to carry out fraudulent activities, on the other hand the increasingly sophisticated security 
measures have raised the barriers to access non-cash payment instruments frauds for individuals 
pushing towards the direct involvement (or the support to individ uals) of Organised Crime Groups 
(OCGs) or networks. Also the Crime -as-a-Service (CaaS) model (as explained below) pushes in this 
direction.  

Some  studies  have  shown  that  NCP  fraud  (and  specifically  payment  card  fraud)  is  a  highly 
profitable  activity for OCGs representing a significant source of proceeds (Levi, Innes, Reuter, and 
Rajeev V., 2013). Frauds, along with drug trafficking, represent more than a half of the total OCGs 
activities  and are the types of crime mostly carried out by the 3,600+ international active criminal 
groups based in Europe (more than 30% of which are “poly-crime groups”, meaning they are active on 
more than a single crime area)(Europol, 2013c). Moreover, Europol reported in 2012 that revenues 
brought to OCGs originating from the EU and relating to payment card fraud were around €1.5 billion 
per year, which compared to the total value of card frauds relating to cards issued within SEPA (€1.44 
billion) indicates the relevance of OCGs in payment card frauds.  

Although the fraudulent purchase of tickets is the most common way to defraud airline companies, 
there have been observed instances of OCGs running fake travel agencies that sell last -minute tickets 

320 “C ybercriminals will typically only interact online and behind a wall of anonymisation, therefore targeting one 
individual will not always lead to identifying their associates. Associates that might be identified are likely to be 
distributed globally, which complicates those investigations further” (Europol, 2014b, p. 19).  

93 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

at a very high discounts to unwitting victims in order to provide travel services for members of the 
OCG itself (European Commission, 2016b).  

Besides  profitability,  there  are  additional  reasons  explaining  the  interest  of  OCGs  in  card 
payment frauds. First, card payment fraud seems to have a lower risk compared to other criminal 
activities typically carried out by OCGs (e.g. trafficking in human beings or crimes relating to drugs) 
(Europol,  2012).  As  also  stated  by  one  of  the  stakeholders321  “technology and cyber skills provide 
greater benefits at zero risk of harm and much less risk of identification ”. Second, as reported by one 
MS, there might be cases in which prosecution and penalties for card payment fraud are less severe 
compared to other crimes. For instance, in Bulgaria, “authorities have reported increased participation 
in  payment  card  fraud  by  individuals  and  groups  better  known  for  their  activities  in  thefts,  vehicle 
crime, drug trafficking, and the distribution of counterfeit currency, attracted largely by lower penalties 
and perceptions of lower levels of risk generally”  (Europol, 2011, p. 11). Lastly, the advancements in 
ICT and fraud tools increasingly ease card payment fraud (Europol, 2013c).  

Technological  advancements  allowed  for  the  development  of  new  business  models  that  enable 
individuals to carry out part of crimes that were previously limited to OCGs. Crime -as-a-service (CaaS) 
is a spreading business model that allows for the provision of cybercrime capabilities to no specialised 
OCGs  involved  in  traditional  forms  of  crimes  (Europol,  2016b).  The Internet is a key facilitator as 
proved by the number of hidden marketplaces and underground forums (typically developed in the 
darknet) where cybercriminals advertise and sell their products and services. Specialists providing such 
services (e.g. selling payment cards data acquired through large scale data breaches) may interact 
with OCGs without joining the criminal group (Europol, 2015a). Given the exchange of information that 
occurs  in these environments, criminal techniques progressively refined themselves and therefore 
cyber-attacks  become  more  sophisticated.  This  is  also  the  foundation  of  the  future  tendency  of 
criminals  to  shift  “from  one  criminal  working  across  the  entire  fraud  lifecycle,  to  fraudsters  instead 
specialising  on  one  part  of  the  value  chain,  and  selling  that  value  on  to  the next level. For example, 
one  part  of  the  chain  could  specialise  on  getting  hold  of  card  data,  and  another  could  specialise  on 
actually using it” (Forster, 2015, p. 20). 

Box 18: Focus on carding  websites 

Carding websites and the actors operating behind them generally work through defined schemes. 
Once  the  cards  data  have  been  stolen  (through  the  mentioned  techniques  such  as  POS/ATM 
skimming and ecommerce/payment processors websites hacking) they a re sold to brokers/resellers 
who  typically  purchase  them  in  bulk.  These  subjects,  in  turn,  sell  cards  data  to  the  so -called 
“carders” using marketplaces in the dark web.322 Carders can purchase them323 usually paying by 
bitcoins.324 Cards can be chosen according to their original zip codes so that criminals can reduce 
the  risk  of  raising  suspects  of  the  issuing  bank  when  cashing  them  out.  Many  websites  offer 
guarantees of the validity of the card and provide valid replacements in case the card is blocked 
before the carder manages to cash it out. Cards data are then either loaded in pre -paid cards in 
order to purchase store specific gift cards (e.g. Amazon gift cards) or they are used to manufacture 
counterfeit credit cards. In the first instance, the goods purchased (typically electronic devices such 

321 Interview feedback: one representative from LEAs. 
322<http://insights.wired.com/profiles/blogs/stolen-credit-cards-and-the-black-market-how-the-deep-
web#axzz4iTfDxx4N> One of the most popular carding websites is the Tor Carding Forum (TCF), founded in 2012 
and counting around 13,000 members, despite not all of them are active: there are reportedly 500 to 600 daily log -
ins to the website <http://espresso.repubblica.it/visioni/2014/06/17/news/carding-viaggio-tra-i-trafficanti-di-carte-
di-credito-del-web-nascosto-1.169689> 
323 Prices range from as little as $9 (for software generated cards) up to $100 per card, depending on the available 
information on the card (type of card, “base” , limits, etc.). Multiple cards can also be purchased in packages. 
324 <https://www.deepdotweb.com/2014/12/11/a-carders-first-experience/> 

94 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

as smartphone or computers or high value goods) are shipped to unsuspecting individuals recruited 
as  mules/re-shippers  (often  through  legitimate  job  listing  websites);  the  mules  then  ship  the 
package to the final buyers who purchased the goods through hidden underground deep web sites 
or auction sites (more rarely normal websites like eBay are used). In the case of manufacturing of 
counterfeit cards, fraudsters cash them out in electronic stores or duty-free shops in the airports.325 

According to the estimations, the average value of a fraud relating to carding is far below $500 per 
card: however, the administrator of the most popular carding website (Tor Carding Forum) stated 
that such estimation is far too high and that, the actual amount of a fraud is well below $500 per 
card.326  

The CaaS model allows OCGs to innovate and find solutions to overcome the latest security measures 
implemented  by  the  payment  card  industry.  OCGs  adjust  their  profiles  and  criminal  techniques 
relatively quickly and smoothly (Europol, 2012). As regards to Card Present (CP) fraud, there has been 
emerging evidence of OCGs starting to manipulate or compromise card payments that use the NFC 
technology. Furthermore, there has been an evolution as concerns Automatic Teller Machine (ATM) 
attacks, which shifted from the deployment of skimming devices to more advanced techniques (e.g. 
ATM malwares allowing for interactions with any of these machines, especially with outdated ones, 
regardless of their model and type) that have been made possible thanks to the standardisation of 
ATMs’  hardware  and  software  (Europol,  2016b).  The  use  of  this  malware  can  be  replicated  on 
standardised ATMs and therefore they can be exchanged among fraudsters in the criminal underground 
markets mentioned earlier. 

While  frauds  of  and  counterfeiting  in non-cash means of payment see a role  –though limited- for 
individual criminals, OCGs are still the main responsible for identify theft, especially online (European 
Commission,  2016b).  Although  both  individuals  and  groups  can  steal  identities,  identity-related 
information  is  often sold to OCGs specialised in “cashing -out” and money laundering. The level of 
sophistication required to exploit identity information for committing crimes typically goes beyond the 
ability and the means available to individual  criminals. In addition to the skills and the technology 
necessary  to  exploit  such  information,  the  costs  of  accessing  it  are  rising,  reducing  de  facto 
accessibility to individual offenders. OCGs not only buy and sell identity information to each other but 
they  also  use  such  information  for  themselves  to  avoid  detection  by law enforcement (i.e. when 
travelling or when protecting their assets from confiscation).  

It is estimated that OCGs activity in relation to identity theft will be increasingly online main ly because 
of three main aspects (European Commission, 2016b). First, the increasing adoption of Crime -as-a-
Service model enables the employment of larger numbers of relatively unskilled criminals who merely 
purchase  software  tools structured for identity theft and work on beha lf of criminals. Second, the 
involvement  of  new  criminal  profiles  residing in developing countries will increase considering the 
increasing numbers of Internet users in those regions. Finally, the higher automation capacity of the 
new tools allows offenders to easily reach very large numbers of potential victims. For this reason, 
even criminal strategies that used to be unprofitable (due to high failure rates), can be carried out, 
given  that  the  automation  of  processes  (i.e.  for  phishing  and  advanced  fee  fraud) 327  allow 

325 Europol arrested last year 105 suspects (29 in Malaysia and 76 all over Europe), included the OCG’s leaders who 
used to manufacture high quality counterfeit credit cards in different locations which were subsequently used by 
individuals to purchase high value goods, mainly at electronic stores and duty-free shops at airports, causing losses 
estimated at €5 million. <https://www.europol.europa.eu/newsroom/news/international-credit-card-fraud-
syndicate-active-in-europe-and-asia-disrupted> 
326<http://espresso.repubblica.it/visioni/2014/06/17/news/carding-viaggio-tra-i-trafficanti-di-carte-di-credito-del-
web-nascosto-1.169689> 
327 Advance fee fraud is when fraudsters target victims to make advance or upfront payments for goods, services 
and/or financial gains that do not materialise. 

95 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

cybercriminals to get enough victims in million tries. Moreover, gaining small amounts of money from a 
large base of victims further lowers the risk of detection. 

The involvement of OCGs in card payment frauds increasingly shifts from local fraud towards global 
fraud (Forster, 2015). OCGs are involved in the globalisation process and try to leverage it in order to 
expand their networks, broaden their areas of activities and acquire new knowledge (see also the 
section 4.3.2for further details of the types of structures of OCGs). In this regard, an attitude of this 
groups to collaborate with (and sometimes directly include in their membership) criminals of different 
nationalities (Europol, 2013c) has been observed.  

Box 19 – Focus on the types of structures  of OCGs 

There are two main structures for OCGs. A vertical structure with a classic hierarchical configuration 
operating  with  different  levels  of “officers”, and an horizontal structure that relies on a cellular 
configuration, which benefits from a higher elasticity and less rigid hierarchies. The two structures 
are not mutually exclusive and despite which one OCGs choose to adopt they all have in common an 
increasing  reliance  on  more  developed  networks  in  order  to  be  aligned  with  challenges  and 
opportunities of modern environments, characterised by dynamic change, mobility and connectivity. 
Such phenomenon adds up to the increasing closeness between organised crime groups and LBS 
(legitimate business structure) and this situation creates a combination of variables that makes it 
harder for law enforcement to detect OCGs origins given that they cannot be easily linked to precise 
regions or locations (Europol, 2013c).  

Source: Authors’ elaboration based on desk research 

4.4  Coherence  

EQ5: Are there any overlapping/contradictions/complementarities between the Framework Decision 
and  any  other  relevant  EU/international  legislation?  In  particular:  the  Revised  Payment  Services 
Directive,  the  Directive  on  Network  and  Information  Security,  the  Directive  on  attacks  a gainst 
information  systems,  the  Directive  establishing  minimum  standards  on  the  rights,  support  and 
protection of victims of crime,  the Directive on the protection of the euro and other currencies against 
counterfeiting by criminal law, the Interchange Fee  Regulation. 

Overall, the FwD is coherent with the main EU and international legislation dealing with NCP frauds and 
counterfeiting. In most of the cases EU and international legislation partially overlaps and integrates 
the FwD provisions by making the overall criminal law framework more relevant to recent technological 
developments. More detail is provided below  per provision of the FwD.  

Definition of payment instruments 

The  definition  of  payment  instrument  included  in  the  FwD  is  coherent  with  other  relevant  EU 
legislation.  

Following the evolutions in the field of payments instruments, EU directives issued after the FwD have 
proposed revised definitions to ensure the relevance of the NCP instruments to the evolving needs. 
More specifically, the scope of the FwD definition overlaps and is complemented328 by the scope of the 
definition  of  the  PSD1,  adopted  afterwards  by  the  PSD2  and  Directive 2015/2366. In addition to 
corporeal  payment  instruments,  this  revised  definition  also  covers  non-corporeal  payment 

328 In this whole section on the coherence, overlappings designate parts of different pieces of legislation which cover 
the same scope, complementatiries designate parts of difference pieces of legislation which are consistent one with 
each other, each of them adding a elements to the scope of the others, contradictions designate parts of different 
pieces of legisaltion which have scopes which are not consistent with each other. 

96 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

instruments  (see  Box  20)  under  the conditions that they are personalised and used to initiate a 
payment order.  

Box  20  -  How  does  the  PSD1  definition  of  payment  instrument  complement  the  FwD 
definition? 

The definition of payment instrument contained in the PSD1 is the following: “Payment Instrument 
shall  mean  any  personalised  device(s)  and/or set of procedures agreed between the payment 
service user and the payment service provider and used by the payment service user in order to 
initiate  a  payment  order.”  The  formulation  “set  of  procedures”  covers  non -corporeal  payment 
instruments and in particular e -money. This definition includes most of the main non-cash means of 
payment, aside from: 

- 
- 

those that are not personalised (e.g. some kinds of coupons); 
those that do not initiate a payment order (e.g. fidelity/loyalty cards or virtual currencies). 

Thus, the PSD1 definition covers all the payment instruments covered by the FwD definition and, in 
addition,  it  covers  e-money,  mobile  money,  virtual  cards,  electronic  ticket  restaurants,  virtual 
coupons and electronic wire transfers and direct debits. 

Source: Author elaboration  based on desk research 

Among non-corporeal payment intruments, the use of e-money - and related frauds - is increasing 
(see section 4.3.1) and this contrasts with the fact that e -money is not taken into account in the FwD. 
In this light,the FwD has been complemented by the definition of “e-money” firstly provided by the E-
money Directive 2000/46/EC 329 and then updated by the E-money Directive 2009/110/EC 330 with the 
objective to be technologically neutral.  

Criminal offences 

Criminal  offences  listed  in  the  FwD  are  coherent  with  the  content  of  other  EU  and  international 
legislation, which complements the FwD and integrates it with additional criminalised conduct. When 
comparing  the  FwD  with  two  relevant  pieces  of  legislation  (i.e.  Directive  2013/40/EU  on  Attacks 
against Information System and the Budapest Convention on Cybercrime), the analysis showed that 
they partially overlap and complement the FwD by criminalising also: 

  preparatory forms of conduct to NCP fraud; 
 
 

illegal interception of computer data; 
attacks against information systems. 

The FwD does not cover preparatory forms of conduct  to non-cash payment fraud, such as theft of 
personal data, in cases where they did not result in financial losses for the victim, whereas this is 
covered  by  the  Directive  2013/40/EU  and  the  Cybercrime Convention  (Art.3, Art.4, Art.5) and the 
Budapest Convention on Cybercrime (Art. 2-7). While the FwD (Art. 3) applies only to forms of conduct 
resulting in a transfer of funds or of monetary value, these two pieces cover, whichever the result of 
the conduct might be, the illegal access to information systems or computer system, illegal system 
interference, illegal data interference and production, sale, procurement for use, import, distribution or 
otherwise making available of computer programme or password.  

329 “Electronic money shall mean monetary value as represented by a claim on the issuer which is: (i) stored on an 
electronic device; (ii) issued on receipt of funds of an amount not less in value than the monetary value issued; (iii) 
accepted as means of payment by undertakings other than the issuer”.  
330 “‘Electronic money’ means electronically, including magnetically, stored monetary value as represented by a 
claim on the issuer which is issued on receipt of funds for the purpose of making payment transactions as defined in 
point 5 of Article 4 of Directive 2007/64/EC, and which is accepted by a natural or legal person other than the 
electronic money issuer”.  

97 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Moreover, the Directive on attacks against information systems (Art. 6) and the Budapest Convention 
on  Cybercrime  (Art.3)  cover  respectively  the  illegal  interception  of  non-public  transmissions  of 
computer data, including electromagnetic emissions, and the illegal interception of computer data. The 
two pieces of legislation thus complement the FwD that has a narrower scope, not applying in case for 
instance of eavesdropping attacks.  

Furthermore,  in  comparison  with  the  FwD,  the  Directive  on  attacks  against  information  systems 
creates new rules for incriminating the use of botnets and malicious software, as well as illegally -
obtained  passwords.  Art.  7  of  the  Directive  states  that  the  preparatory  actions  of  intentional 
production,  sale,  procurement  for  use,  import,  distribution  or  otherwise  making  available  of 
a “computer programme” or “a computer password, access code, or similar data by which the whole or 
any  part  of  an  information  system”  shall  be  also  incriminated.  In  orderto  punish  these  forms  of 
conduct, the act should be committed intentionally and without right. 

The two main pieces of legislation on the matter complement the scope of the FwD also by providing 
definition of computer system and data and widening their interpretation.  While the FwD refers to 
computer  systems  and  data  without  defining  them,  Art.  1  (a)(b)  of  the  Budapest Convention on 
Cybercrime 331 includes such definitions.332 The Directive 2013/40/EU on attacks against information 
systems  builds  on  them  and  replaced  the  notion  of  computer  system with the broader notion of 
information  system.333.  This  definition  of  information  system  has  then  been  used  also  in  the 
Directive 2016/1148 (NIS Directive), defining “network and information systems”.334 The use of the 
term  information  system  instead  of  computer  system  allows  for  the  coverage  of  more  payment 
channels (e.g. POS), and it avoids analysis to establish whether a payment channel is based on a 
computer system or on an information system. As the currently emerging forms of value transfer are 
mainly  based  on  information  systems,  this  definition  will  also  cover  p ayment  channels  that  may 
emerge in the future. 

Table 10 and Table 11 provide for an overview of the differences and similarities between the offences 
for which preparatory and supportive conduct are incriminated in the FwD, in the Directive on attacks 
against information systems and in the Cybercrime Convention, when committed intentionally and 
without right. 

In Table 10 and Table 11, the terms that are underlined correspond to the terms that differ with one or 
both of the other pieces of legislation. The bold terms correspond to the terms that are similar in the 
three pieces of legislation. 

331 Implemented in all MS. 
332 "C omputer system" means any device or a group of interconnected or related devices, one or more of which, 
pursuant to a program, performs automatic processing of data. “Computer data” means any representation of facts, 
information or concepts in a form suitable for processing in a computer system, including a program suitable to 
cause a computer system to perform a function. 
333 Device or group of inter-connected or related devices, one or more of which, pursuant to a programme, 
automatically processes computer data, as well as computer data stored, processed, retrieved or transmitted by 
that device or group of devices for the purposes of its or their operation, use, protection and maintenance. 
334 That means (a) an electronic communications network within the meaning of point (a) of Article 2 of Directive 
2002/21/EC ; (b) any device or group of interconnected or related devices, one or more of which, pursuant to a 
program, perform automatic processing of digital data; or (c) digital data stored, processed, retrieved or 
transmitted by elements covered under points (a) and (b) for the purposes of their operation, use, protection and 
maintenance. 

98 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Table  10  –  Comparison of the offences related to a computer (Art. 3) as defined by the FwD 
and  as  defines  by  the  Directive  on  attacks  against  information  systems  and  the  Cybercrime 
Convention 

Legislation 

FwD 

Directive on 
attacks against 
information 
systems 

Article 

Incriminated  Conduct 

Tool 

Art.3 

Art. 4 

Art. 5 

Art. 6 

introducing,  altering,  deleting 
or  suppressing;  interfering  with 
the functioning 

inputting  computer  data,  by 
transmitting, damaging, deleting, 
deteriorating, 
or 
suppressing 

altering 

computer  data 

computer programme or system 

computer  data 

damaging, 
or 

deleting, 
deteriorating, 
suppressing 
intercepting, by technical means, 
non-public transmissions 

altering 

computer 
data 
information system 

on 

an 

computer  data,  from  or  within 
an information system, including 
electromagnetic  emissions  from 
an information system  

2001 Budapest 
Cybercrime 
Convention 

Art.3 

interception  without  right,  made 
by technical means, of non-public 
transmissions 

computer  data 
within  a 
including 
emissions 

to, 

from  or 
computer  system, 
electromagnetic 

Art. 4 

Art. 5 

alteration 

deletion, 
or 

damaging, 
deterioration, 
suppression   
hindering  w ithout  right  of  the 
functioning; 
inputting, 
transmitting, damaging, deleting, 
deteriorating, 
or 
suppressing   

altering 

computer  data  

computer  data  

computer  system 

Art. 7 

Art. 8 

input,  alteration,  deletion,  or 
suppression   
any  input,  alteration,  deletion 
or suppression   

computer  data  

computer  data  

computer  system 

Source: Authors’ elaboration based on desk research 

Table  11  -  Comparison  of  the  offences  related  to  specifically  adapted  device  (Art.  4)  as 
defined  by  the  FwD  and  as  defines  by  the  Directive  on  attacks  against  information  systems 
and the Cybercrime Convention 

Legislation 

FwD 

Article 

Incriminated  Conduct 

Tool 

Art. 4  making, 

receiving, 
obtaining,  sale  or  transfer 
to 
or 
possession 

another 

person 

instruments,  articles,  computer 
programmes and any other means 
adapted 

99 

 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Directive on 
attacks against 
information 
systems 

2001 Budapest 
Cybercrime 
Convention 

Art. 7 

production, 
procurement 
import, distribution 

for 

sale, 
use, 

Art. 6 

sale, 
production, 
use, 
procurement 
import, 
or 
otherwise making  available 

distribution 

for 

computer  programme;  computer 
password,  access  code,  or  similar 
data by which the whole or any part 
of an information system 

a  device,  including  a  computer 
program,  designed or adapted  

a computer password, access code, 
or similar data  

Source: Authors’ elaboration based on desk research 

Legal person liability 

The FwD is coherent with other relevant EU legislation in the field and it is essentially the only EU piece 
of legislation establishing conditions for legal persons’ liability and related sanctions.  

Only the Directive on attacks against information systems (Art.11) complements the sanctions for legal 
persons listed in the FwD,by including the temporary or permanent closure of establishments that have 
been used by the legal person for committing the offence. The Directive provides additional sanctions 
applicable for the legal persons that could be taken into consideration also in cases of NCP frauds 
involving an information system (such as temporary or permanent closure of establishments that have 
been used for committing the offence).  

Penalties 

The FwD is coherent with other pieces of EU legislation in terms of penalties for NCP offences. It is 
complemented  by  the  Directive  2013/40/EU  on  attacks  against  information  systems  that  sets 
maximum penalties and identifies aggravating circumstances. Specifically, this Directive complements 
Art. 3 and 4 of FwD by incriminating the forms of conduct of illegal access to information systems (Art. 
3  of  Directive),  illegal  system  interference  (Art.  4),  illegal  data  interference  (Art.  5)  and  illegal 
interception  (Art.  6).  The  incitement,  aiding  and  abetting  and attempt are punished as a criminal 
offence  (as  also  included in Art. 5 of FwD). The existing link with Directive 2013/40/EU on attacks 
against information systems may be specified in a possible revised legislation to replace the FwD. 

Similarly to the FwD, it states that these offences shall be punished by effective, proportionate and 
dissuasive penalties. It also goes beyond the FwD by: 

 

 

imposing for the offences relating to computers  and to specifically adapted devices a 
maximum term of imprisonment of at least two years, at least for serious cases; 
identifying aggravating circumstances for offences relating to computers:  

- 

- 

- 

imposing  a  maximum  term  of  imprisonment  of  at  least  three  years  when 
committed intentionally and at least for serious cases (where a significant number 
of information systems have been affected, without quantifying the number, fact 
that could generate significant variations in sanctions);  
imposing a maximum term of imprisonment of at least five years where they are 
committed within the framework of a criminal organisation, or they cause serious 
damage;  or  they  are  committed  against  a  critical  infrastructure  information 
system; 
encouraging to take the necessary measures when these offences are committed 
by misusing the personal data of another person, with the aim of gaining the trust 
of a third party, thereby causing prejudice to the rightful identity owner. 

The  FwD  is also complemented by the Directive 2015/849/EU on  the prevention of the use of the 
financial  system  for  the  purposes  of  money  laundering  or  terrorist  financing  (4 th  Anti-Money 
Laundering  Directive).  Specifically,  the  Directive  defines  a  range  of  administrative  sanctions  and 

100 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

measures  to  be  adopted  by  MS  for  offences covered by the FwD when they are serious and are 
conducting to money laundering.  

The revision of the 4th Anti-Money Laundering Directive aims to set up a uniform definition of criminal 
activities that constitute predicate offences for money la undering for all the MS. It shall refer, among 
others, to “fraud, including any of the offences set out in Council Framework Decision 2001/413/JHA” 
and “cybercrime, including any of the offences set out in Directive 2013/40/EU”  on attacks against 
information systems. The draft directive sets up a minimum level of maximum penalties of four years 
of imprisonment, for serious offences 335, but the MS shall be able to set up the minimum types and 
levels  of  penalties  when  defined  criminal  offences  are  committed.  It  also  lists  aggravating 
circumstances, such as the relationship with a criminal organisation336 or by a person who abused 
his/her professional position. 

Moreover, the levels of penalties established by the Directive on attacks against information systems 
and  those  set  by  the  Directive  on  euro  counterfeiting  for  similar  offences  but  relating  to  cash 
payments, set the framework for future initiatives at EU level relating to establishment of minimum 
maximum levels of penalties for the FwD offences. 

Jurisdiction 

Criteria set by the FwD to establish national jurisdiction with regard to NCP offences are coherent with 
the existing international and EU legislation on the matter.  

Overall  jurisdiction  principles  to  be  applied  according  to  the  FwD  are  based  on  the  acquis 
communautaire and international treaties and conventions to which the MS are parties (see also Box 
21). 

Box 21 – Focus on the sources of jurisdiction  principles 

Traditionally, the concept of jurisdiction has, in international public law, a strong link with the notion 
of sovereignty and the applicable law in a specific state is relating to persons or activities in which 
that  state has a legal interest. The laws regarding establishment of the jurisdiction delimit the 
competences between States and serve as general rules on international legal ground. 

Moreover, the treaties may contain rules applicable for the relationship between a Member State 
and a non-EU third country which is not Party and in this case the international law is not applicable 
to the third country, with the exception that this state conclude an agreement with the concerned 
Member State to respect the principles stated under that treaty (Ryngaert, 2014). 

Source: Authors’ elaboration based on desk research 

Among the most relevant treaties on the subject matter, the Budapest Convention on Cybercrime 
(Section 3.Article 22 on Jurisdiction) overlaps with the FwD on jurisdiction in so far as it states that 
signatory countries should establish their jurisdiction w hen the offence is committed in their territory 
or by one of their nationals if the offence is punishable under criminal law where it was committed.  

A number of EU laws have progressively integrated the FwD with definitions, and a refinement of the 
territoriality and personality criteria. 

335 Art. 83 para. 1 of TFEU lists as serious crimes with cross-border dimension the following offences: terrorism, 
trafficking in human beings and sexual exploitation of women and children, illicit drug trafficking, illicit arms 
trafficking, money laundering, corruption, counterfeiting of means of payment, computer crime and organised 
crime. 
336 According to C ouncil Framework Decision 2008/841/JHA on the fight against organized crime. 

101 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

As  for  the  definition,  the  European  Convention  on  Extradition  (Art.  6  (1))  and  specifically  the 
declarations made by MS to ratify it, complemented the FwD in so far as they include the definition of 
the term “national”. 

As for the territoriality and personality criteria, the Budapest Convention on Cybercrime  widened the 
scope of application of these criteria to offences committed on board of a ship or an aircraft registered 
in  the MS and –perhaps more importantly in this context- to the offences committed by one of its 
nationals outside the territorial jurisdiction of any State. The Convention states that when more than 
one  Party  claims  jurisdiction  over  an  offence  established  in  accordance  with  a  convention,  the 
convention requires that involved countries to consult each other with a view to determining the most 
appropriate jurisdiction for prosecution. 

In the EU legislation, Art. 12 of Directive 2013/40/EU on attacks against information systems states 
that the Member States shall also establish their jurisdiction where the offence has been committed by 
one of their nationals,  at least in cases where the act is an offence where it was committed. 

Moreover, the draft revised 4th Anti-Money Laundering Directive states that MS have to ensure that 
their  jurisdiction  includes  cases  where  an  offence  is  committed  by  means  of  information  and 
communication technology from their territory, whether or not based in their territory. In case a MS 
decides to establish further jurisdiction over the offences of money laundering committed outside its 
territory, the applicability of the jurisdiction shall take into consideration that  (a) the offender is a 
habitual  resident  in  its  territory  or  (b)  the  offence  is  committed  for  the  benefit of a lega l person 
established in its territory. 

Extradition and prosecution 

As concerns extradition, the applicability of the FwD is impacted by the various conditions imposed by 
the Member States and by the European and international laws in force. 

The  FwD  provision  on  extradition  and  prosecution  is  complemented  by  the  European 
Convention on Extradition,337 which is explicitly mentioned in so far as it provides (i) the definitions 
of “national” to be adopted when applying the extradition provisions,338 and (ii) the procedures for the 
exchange of information, files and exhibits in case a MS decides not to extradite one of its nationals on 
the ground of nationality and carry out prosecutions internally. 

Over  the  years,  the  FwD  has  been  complemented  and  partially  contradicted  by  the 
introduction  of the EAW (see Box 22) that sets conditions for compulsory extradition for all offences 
covered by the FwD339 and provides details on the procedures to be followed. As illustrated in Table 8, 
this limited the validity of the FwD provision and made Art. 10-1 (b) to some extent not applicable (for 
some offences and when these offences are punished with a specific le vel of penalties).  

337 Entered into force on 18 April 1960. The Convention was ratified by all 28 Member States. The European Union 
has not signed the Extradition Convention. It envisages the obligation for the State Parties (both EU Member States 
and third parties) to extradite the persons against whom the competent authorities of a requesting Party are 
proceeding for an offence or who are wanted by the said authorities for the carrying out of a sentence or detention 
order. However, art. 6 of the C onvention leaves the discretionary right of states parties to refuse extradition of the 
nationals. 
338 The definition of “national” should be taken from the declaration made by the MS under the European 
C onvention on Extradition is still valid. 21 out of the 28 MS have attached such declarations to the Convention (i.e. 
AT, BG, C Y, DE, DK, EE, EL, ES, FI, FR, HR, HU, IE, LT, LU, LV, NL, PL, PT, RO, SE). 
339 For the purposes of this analysis, the Evluation team assumed that the EAW offence cover all conduct listed in 
the FwD, regardless how they are defined in the MS legislation. 

102 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Box 22 - European Arrest Warrant 

The  EAW 340  replaced  lengthy  extradition  procedures  within  the  EU's  territorial  jurisdiction.  In 
particular it implies faster and simpler surrender procedures . EU countries can no longer refuse to 
surrender to another EU country their own citizens who have committed or are suspected of having 
committed specific offences 341 in another EU country, on the grounds that they are nationals. 
The EAW shall apply in case of commission of some forms of conduct punishable by a custodial 
sentence or a detention order for a maximum period of at least three years . Furthermore, it may 
apply in case of commission of forms of conduct punishable by imprisonment or a detention order 
for a maximum  period of at least 1 year or where a final custodial sentence has been passed or a 
detention order has been made, for sentences of at least 4 months. 

Source: Authors’ elaboration based on desk research 

According  to  the  EAW,  when  a  national  has  committed  or  is  alleged  to  have  committed  specific 
offences  covered  by  the  FwD  in  a  MS  where  these  are  punishable  by  a  custodial  sentence or a 
detention order for a maximum period of at least three years (see Table 12), the MS has no more the 
right to refuse extradition to other MS on the sole ground of the nationality of the perpetrator and thus 
Art 10-1(b) of the FwD does not apply anymore. 

Table  12  –  Identification  of  the Member States in which the FwD offences are punishable by 
a custodial  sentence  or a detention  order for a maximum  period  of at least three years 

Conducts  under  FwD 
413 
MS in which the offence is 
punishable by a custodial 
sentence or a detention 
order for a maximum 
period of at least three 
years 

MS in which the 
maximum period is of less 
than 3 years 

Not covered 

Art. 2 
let.a 
BG, DE, 
EL, FR, 
IE, LT, 
LV, NL, 
PL, SI, 
UK 

BE, CY, 
EE, ES, 
HR, IT, 
LU, PT, 
RO, SK  

AT, CZ, 
DK, FI, 
HU, MT, 
SE 

Art. 2 
let.b 
CZ, DE, EL, 
ES, FR, IE, 
LT, LU, LV, 
NL, PL, PT, 
RO, UK 

Art. 2 
let.c 
DE, EE, 
ES, FR, IE, 
LT, NL, SI, 
UK 

Art. 2 
let.d 
CZ, DE, 
EE, FR, IE, 
LT, LV, 
NL, PT, 
SI, UK 

Art. 3 

Art. 4 

CY, DE, 
FR, IE, LT, 
NL, SI 

CY, DE, 
FR, LT, 
LV, MT, 
NL, UK  

AT, BE, 
BG, CY, 
EE, HR, IT, 
MT, SI, SK 

BE, BG, 
CY, CZ, 
EL, HR, IT, 
LV, MT, 
PL, PT, 
RO, SK 

BE, BG, 
CY, EL, 
ES, HR, 
HU, IT, 
LU, MT, 
RO, SK 

DK, FI, HU, 
SE 

AT, DK, 
FI, HU, 
LU, SE 

AT, DK, 
FI, PL, SE 

AT, BE, 
BG, HR, 
EE, ES, IT, 
LU, LV, 
MT, PL, 
PT, RO, 
SK 
CZ, DK, 
EL, FI, HU, 
SE, UK 

AT, BE, 
EE, ES, 
HR, LU, 
PL, PT, 
RO 

BG, CZ, 
DK, EL, 
FI, IE, 
IT, HU, 
SE, SI, 
SK 

Source: Authors’ elaboration based on desk research 

Except for these cases, the right of a MS to refuse extradition for offences covered by the FwD on the 
sole ground of the nationality (and the subsequent cooperation mechanism to be established with the 

340 According to EJN website, all MS have notified to the C OM the national authorities competent to issue and 
execute an EAW.  
341 “Participation in a criminal organisation”, “fraud, including that affecting the financial interests of the European 
C ommunities”, “computer-related crime”, “forgery of means of payment”. 

103 

 
 
                                                 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

MS  requesting  the  extradition)  coexist  with  the  optio n  left  to  MS  to  issue  an  EAW  when  some 
conditions are fulfilled.342  

Cross-border  cooperation  and exchange of information 

The  FwD  (Art.  11-1) is coherent and partly overlaps with a number of conventions, multilateral or 
bilateral agreements or arrangements in so far as it requires MS to co -operate with each other and to 
provide mutual legal assistance.  

There are a number of European conventions and decisions that are relevant for criminal offences 
covered by the FwD and that are signed by MS (see Box 23). 

Box 23 – Relevant EU and international  conventions  and decisions  covering offences in 
scope of the FwD 

The 1959 European Convention on Mutual Assistance in Criminal Matters (entered into force on 
12 June 1962), set up the rules and conditions for rogatory letters addressed to a State Party with the 
aim to obtain evidence in criminal proceedings undertaken by the judicial authorities of a requesting 
State Party. The Convention was ratified by all 28 Member States. It states that the countries should 
afford  each  other  the  widest  measure  of mutual assistance in proceedings and should exchange 
information in respect of offences the punishment of which, at the time of the request for assistance, 
falls within the jurisdiction of the judicial authorities of the requesting Party.343 
The  1990  Convention  implementing the Schengen Agreement at Art.39 and Art. 48 states that 
the national police authorities shall assist each other in the prevention and detection of offences and it 
includes provisions on mutual assistance in criminal matters. In addition, Art. 40 states the conditions 
for police officers to perform surveillance in another MS during the investigation proceedings in respect 
to the commission of offences, including forgery of money, aggravated burglary, robery and receiving 
stolen goods. Art. 41 makes possible cross -border hot pursuits with no time limits until the purpose of 
the investigation is achieved. 
The  Council  Act  2000/C197/01  establishing  in  accordance  with  Article  34  of  the  Treaty  on 
European Union the Convention on Mutual Assistance in Criminal Matters between the Member States 
of the European Union. The Convention aims to supplement the provisions of the mentioned treaties 
and conventions and to facilitate their application between all Member States. The Convention entered 
into  force  on  23 August 2005.  Special  provisions  apply  to  Ireland  and  the  United  Kingdom 
(transmission of requests for assistance), to Luxembourg (protection of personal data) and to Norway 
and Iceland (provisions linked to the Schengen acquis and the entry into force of the Convention). 
The Europol  Convention  and its amending Protocols, together with the other related acts sets up the 
framework of police cooperation between Member States.344 
The Council  Decision 2002/187/JHA on Eurojust  sets up the cross-border cooperation framework 
in respect to investigations and prosecutions in cases of serious crime amended by Council Decision 
2003/659/JHA and Council Decision 2009/426/JHA. 

342 “Offences punishable by the law of the issuing MS by a custodial sentence or a detention order for a maximum 
period of at least 12 months or, where a sentence has been passed or a detention order has been made, for 
sentences of at least four months”. 
343 C onvention on Mutual Assistance in C riminal Matters between the Member States of the European Union : Titles 
II and III define the specific forms of mutual assistance, such as restitution, temporary transfer of persons held in 
custody for purpose of investigation, hearing by videoconference, hearing of witnesses and experts by telephone 
conference, controlled deliveries, joint investigation teams, covert investigations, interception of 
telecommunications.  
344 It also collates and analyses information and intelligence; notifies the competent authorities of Member States 
without delay via the national units of information concerning them and of any connections identified between 
criminal offences; aids investigations in Member States; maintains a computerised system of collected information; 
helps Member States train their competent authorities; facilitates technical assistance between Member States.  

104 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Council Decision 2008/976/JHA on the EJN: The cooperation between competent authorities is set up 
via the EJN, composed of national contact points. 
As  for  the  international  treaties and conventions in the field, the MS ratified the following ones, 
with  impact  on  the  mutual  assistance  in  criminal  matters:  1959  European  Convention  on Mutual 
Assistance in Criminal Matters  – all 28 MS; 2001 Convention on Cybercrime - 25 MS (EL, IR and SE 
signed, but have not ratified the Convention); 2000 United Nations Convention against Transnational 
Organised Crime (UNTOC; Palermo Convention) – all 28 MS; 1990 Convention on Laundering, Search, 
Seizure  and  Confiscation  of  the  Proceeds  from  Crime  (Strasbourg  Convention)  – all 28 MS; 2005 
Council of Europe Convention on Laundering, Search, Seizure and Confiscation of the  Proceeds from 
Crime and on the Financing of Terrorism (Warsaw Convention) – 17 MS (11 MS signed, but not ratified 
the Convention). 

Source: Authors’ elaboration based on desk research 

With regard to the mechanisms for consultation when several Member States have jurisdiction 
on  the  same  offence,  both  the  Convention  on  Cybercrime  and  the  Framework  Decision 
2009/948/JHA  on  prevention  and  settlement  of  conflicts  of  exercise  of  jurisdiction  in  criminal 
proceedings   integrated the FwD with a mechanism for co nsultation between MS to determine the 
relevant jurisdiction.  

The  mechanism  for  consultation  aims  at  applying  the  principle  ne  bis  in  idem345  during  criminal 
proceedings and at avoiding the risk of inadequate exercise of jurisdiction  ( section 3.3.2). 

This integration of the FwD appears to be of the utmost importance in view of the increasing relevance 
of the cross-border component of NCP frauds where the data holder, the data provider, the server and 
the offender may have different locations. 

As for the contact points, there is evidence of MS designating already existing contact points, thus 
avoiding duplication and improving the efficiency of the overall cooperation system. Even though the 
analysis of national legislation does not provide enough information on the mapping of all the actors 
identified as contact points for the FwD, there is evidence of some MS leveraging on existing networks 
(e.g.  ENU,  EJN,  Eurojust  National  Desks).  This  choice  is  linked  to  the  fact  that  the  exchange  of 
information relating to the FwD relate to investigations, prosecutions and executions of warrants and 
may thus overlap with the scope of action of already existing networks.  

National  contact  points  have  different  backgrounds  and  access  to  different  types  of  information 
(European Judicial Network and Eurojust, 2014). MS are free to choose the most appropriate contact 
point for the exchange of information for the purposes of applying the FwD. Depending on the MS a 
contact point can be, for instance, member of the ENU or of the EJN and therefore have a different 
background346 (i.e. more investigation oriented in the first case and prosecution oriented in the second 
case) and access to different types of information and networks. This may hin der the overall coherence 
of the system and create some obstacles when exchanging information, even if it may sometimes 
provide an alternative source of assistance where there is a real or perceived blockage elsewhere. 

4.5  EU Added  value 

EQ17: What is the added value resulting from the EU intervention compared to what could be achieved 
by Member State action only? 

345 Legal principle that states that no legal action can be instituted twice for the same action.  
346This may be accentuated by the fact that even within the ENUs, there are disparities in the scope of work (Disley, 
Barrie, Hughes, and Patruni, 2012). 

105 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

EQ18: To what extent does the Framework Decision support and usefully supplement Member State’s 
policies in relation to fraud and counterfeiting of non-cash means of payment? 

This Section looks at the EU added value of the FwD – the benefits it brings over and above existing 
national  legislative  frameworks  in  relation  to  counterfeiting  of  and  frauds  in  non -cash  means  of 
payment.  

The FwD added value by setting a common criminal law framework o f reference for MS, even though 
this is also the result of the co-existence of other relevant EU legislation.  

Even  though  most  of  the  MS  have  transposed  the  FwD  provisions,  it  is  difficult  to  establish 
whether  the  current  level  of  harmonisation  is  the  result  of  the  FwD  only.347  When looking at 
the provisions of the FwD, there have been a number of relevant pieces of EU legislation that entered 
into force after 2001, that partially overlap and complement the scope of the FwD and that may have 
brought to changes in the national legislative frameworks.  

In order to identify the effect (and therefore the added value) of the FwD, the analysis focused on the 
dates of the last amendments  of national legislation and compared them to the entry into force of 
other relevant EU legislation,348 identifying three main groups of Member States. 

  MS for which the FwD did not have added value, when national legislation dates before 

2002.349  

  MS  for  which  the  FwD  did  have  some  added  value:  when  at  least  part  of  national 
legislation dates after 2002 but before the entry into force of other EU/International 
legislation.  In  these  cases  the  Evaluation  team  assumed  the  FwD was the only EU 
legislation to have affected national laws therefore bringing added value. 

  MS  for  which  it  is  not  clear  if  the  FwD  had  an  added  value:  when national legislation 
dates  after  2002  and  after  the  entry  into  force  of  other  relevant  EU/international 
legislation. In all these cases it was not possible to isolate the contribution of the FwD to 
the  current  legislative  framework  which  might  have  been  modified  following  other 
EU/international pieces of legislation. 

Table 13 summarises the results. 

Table 13 – Overview on the added value per FwD provision 

Added  value  Partial added 

No added 
value 
FI, IE, EL 

3 
BE, FI, IE  

Definition 
payment 
instuments 

Tot.  
Criminal 
offences 

Tot.  
Legal Person 

0 
CZ,  DE,  FR, 
HU,  NL,  SK, 
UK 
7350 

3 
BE,  FI,  IE,  IT,  AT, CY, HU, LT  SK, RO 

4 

value 
IT,  LU,  MT,  NL, 
PL, RO 

6 
CY, IT, LU, SI 

Not clear if any 
addedd  value 
AT,  BE,  BG,  CY,  CZ, 
DE,  DK,  EE,  ES,  FR, 
HR,  HU,  LT,  LV,  PT, 
SE, SI, SK, UK  
19 
AT,  DK,  EL,  ES,  NL, 
PT,  SE,  UK,  EE,  LT, 
MT, BG, HR, RO 
14 
DE,  DK,  EL,  ES,  FR, 

Tot. 

28 

28 

347See also the limitations underlined in the analysis of the effectiveness in section 4.2. 
348 See sections on coherence of the FwD provisions for the list of relevant laws considered for each provision. 
349 2002 is approximately the year in which MS started to transpose the Framework Decision into their national 
legislation. 
350 In particular, in FR and in DE, most of the FwD offences were already covered in the national laws but the FwD 
created the opportunity to clarify or extend their scope. Indeed, the implementation of the FwD resulted in the 
creation of specific laws such as the one on the possession of IT systems enabling NCP frauds in FR, in adding a 
new paragraph about the counterfeiting of cards in DE. 

106 

 
 
 
  
 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Added  value  Partial added 

Liability 

Tot.  
Penalties  

Tot.  
Jurisdiction 

No added 
value 
LV, PL, PT, SE, 

8 
BE,  EL,  FI, IE, 
PL, PT, SE 

7 
BE, EL, FI, FR, 
IE  IT,  PT,  SE, 
UK, LV, PL 

4 
FR,  NL,  UK, 
CZ,  HU,  LV, 
MT, RO 
8 

Tot.  
Extradition 

11 
BE,  ES, FI, IE, 
PL, PT, SE 

0 

Tot.  
Cooperation 

7 
BE, EL, FI, FR, 
NL, PL, PT, SE 

0 

Tot. 
Source: Authors’ elaboration based on desk research 

0 

8 

value 

2 
SK, CY 

2 

0 

0 

0 

Not clear if any 
addedd  value 
LU,  NL,  MT,  BG,  HR, 
CZ, EE, SI 
13 
AT,  DE,  DK,  ES,  IT, 
LU, EE, LT, SI, HR  

10 
DE,  DK,  ES,  IT,  LU, 
NL,  CY,  CZ,  EE,  HU; 
LT,  MT,  SI,  SK,  HR, 
RO 
16 
AT,  BG,  CY,  CZ,  DE, 
DK,  EE,  EL,  FR,  HR, 
HU,  IT,  LU,  LT,  LV, 
MT,  NL,  RO,  SI,  SK, 
UK  
21 
AT,  BG,  CY,  CZ,  DE, 
EE,  ES, HR, HU,IE, IT, 
LU,LV,  LT,  MT,NL, RO, 
SI, SK, UK,  
20 

Tot. 

27 

27 

27 

28 

28 

Overall, only for few Member States it is possible to state that the FwD had an added value, while for 
the majority of MS the added value is uncertain, and for some the FwD did not bring added value since 
their national legislative frameworks already integrated FwD provisions. Moreover, even though the 
FwD supported the development of the digital single market by creating the basis for secure non -cash 
payment  transactions  when  the  Euro  was  replacing  national  currencies,  other  EU/international 
legislation seem to be more relevant and in line with current developments and needs . This is also 
confirmed by stakeholders involved in the study  who hardly recall the FwD and make reference to 
more recent EU level legislation. 

While  the FwD contributed, at least to some extent, to the progressive  approximation of national 
criminal  law  frameworks,  it  brought  limited  add  value  to  the  cooperation  and  the  exchange  of 
information needed to improve cross-border investigations and prosecutions. As highlighted in section 
3.3.3,  Member  States  still  face  some  operational  difficulties  and  cross -border  investigations  and 
prosecutions are sometimes hindered by a limited exchange of information, by different application of 
data protection legislation or by complex and lengthy procedures. Representatives from public and 
private sectors launched autonomously a number of initiatives and partnerships that remain essentially 
national  (see  section  4.2.4)  to  address  these  obstacles.  This  highlights  an  area  for  further 
improvement. 

107 

 
 
  
 
 
 
 
 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

PART II – IMPA CT  ASSESSMENT  REPORT 

5  PROBLEM  DEFINITION 

5.1  Rationale  of the identified  problem   

The table below summaries the rationale of the three identified problems, as presented in Sections 4.1 
and 4.2, in terms of: a) underlying drivers; b) dimension (national or international); c) who is affected 
and to what extent; d) consequences. 

Table 14 – Rationale of identified  problems 

Drivers 

for 

and 
Uncertainty 
obstacles 
law 
enforcement  activity 
judicial 
and 
cooperation 

Limited 
harmonisation  of  the 
legislative 
framework 

Financial  and  social 
costs 
incurred  by 
economic  operators 
and consumers 

Increase  in  non-cash 
in 
payment 
particular 
cross-
border and new forms 
of fraud 

frauds, 
in 

Increase  in  non-cash 
in 
payment 
particular 
cross-
border and new forms 
of fraud 

frauds, 
in 

Increase  in  non-cash 
in 
payment 
particular 
cross-
border and new forms 
of fraud 

frauds, 
in 

of 

Lack 
specific 
protection  for  victims 
of  NCP 
fraud  and 
identity theft 

Differences  in  criminal 
frameworks across EU  

Differences  in  criminal 
frameworks across EU  

Obstacles 
investigations 
prosecutions 

to 
and 

Lack  of  common  rules 
for  facilitating  public-
private 
cooperation 
and  reporting  to  the 
authorities 

Lack  of  common  rules 
for  facilitating  public-
private 
cooperation 
and  reporting  to  the 
authorities 

of 

Lack 
specific 
protection  for  victims 
of  NCP 
fraud  and 
identity theft 

Dimension 
(national/international) 

Who is affected and to 
what extent 

International,  due  to 
the  increasing  cross-
border  dimension  of 
NCP  frauds,  and  the 
obstacles 
in  cross-
border  investigations 
and persecutions. 

International,  due  to 
the  different  level  of 
implementation  of  the 
FwD across MS and the 
differences  in national 
legislative frameworks. 

since 
International, 
economic 
operators 
and  consumers  of  all 
EU  MS  are  bearing 
costs  related  to  card 
frauds.  

-  Representatives  of 
law 
enforcement 
agencies  and  judicial 
representative,  who 
are facing difficulties in 
effectively  responding 
to  the  crimes  relating 
to  non-cash  means of 

-  LEAs  and 
judicial 
representative who are 
in 
involved 
transnational 
investigations 
prosecutions 

and 

-  OCGs,  who  can 
exploit the differences 

Economic 
operators 
and  consumers  facing 
NCP  frauds, who bear 
social  and 
financial 
costs. 

108 

 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

between MS and focus 
their  criminal activities 
(or  some  of  them)  on 
MS  with  holes  and 
gaps  in  their  national 
criminal framework. 

payments; 

-  OCGs,  who  can 
the 
exploit 
shortcoming 
for 
increasing 
opportunities 
criminal 
relating 
instruments 

for 
activity 
NCP 

to 

Consequences 

- Threats to EU citizens 
security 

- Threats to EU citizens 
security 

-  Digital  single market 
imbalances 

-  Digital  single market 
imbalances 

5.2 

Identification  of the problem 

The overall problem is the frauds relating to non-cash payments, a growing phenomenon that is 
likely  to  further  increase  in  the  next  years   (European  Central  Bank,  2015a).  Even  though 
comprehensive EU statistics on frauds related to  the main NCP instruments are not available  (See 
section 4.2.3), some interesting trends allow for an estimation of the magnitude of the overall problem 
(European Central Bank, 2015a):  

 

Fraud on cards issued within SEPA has been growing in both absolute and relative terms. 
In  2013, the total value of card fraud amounted to €1.44 billion, increasing by 8.1% 
from  2012  and  representing  the  highest value in the previous five years  (European 
Central Bank, 2015a). 

  The overall increase in card frauds is mainly linked to the growth of frauds relating to 
CNP transactions. There were more than 8 million cases of CNP frauds in 2013, for a 
correspondent value of €958 million. The overall value of CNP frauds in 2013 grew by 
20.6% from 2012. Only five MS were able to reduce the level of CNP frauds in absolute 
terms: Greece, Cyprus, Sweden, Romania, and the UK (European Central Bank, 2015a). 

Based on the elements emerging from the evaluation (see Part I), there are three core problems that 
need to be addressed through an EU policy intervention on the NCP frauds: 

5.2.1  Uncertainty  and obstacles  for law enforcement  activity and  judicial cooperation 

This  problem  gathers  the  operational  issues  faced  by  LEAs  and  judicial  representatives  who 
are facing difficulties in effectively responding to the crimes relating to non -cash means of payments. 
These difficulties are related to the increase of the cross -border dimension of NCP crimes. The foreign 
element of NCP crimes makes investigations and prosecutions more complex, and creates room for 
jurisdiction  conflicts  linked  to  difficulties in the application of the territoriality principle.  This is also 
supported by example of serious jurisdiction problems provided by Europol.351 Operational elements 
further contribute to make the jurisdiction over a cross -border case a complex issue. For instance, the 
different languages spoken nationally hinder a smooth exchange of information at EU level, and the 
different types of information to be included in the request for information and the various deadline set 

351 There are jurisdiction problems when: (i) a suspect travels on the base of tickets booked legally in possession of 
a big amount of C C data/dumps with no links to the country of detention; (ii) a suspect travels on the base of 
tickets booked fraudulently with no links to the country of detention (Source: Europol EC3, Airline ticket fraud – 
jurisdiction issues).  

109 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

up by the contacted authorities to reply to submitted requests may also represent an obstacle to the 
effective collaboration on jurisdictional issues.  

The impact assessment supporting the proposal for a Directive on attacks against information systems, 
and repealing council framework decision 2005/222/JHA further highlights the need for clarification of 
jurisdiction  rules  in  cross-border  cyber  incidents.  The  current  legal  framework  is  reported  not  to 
properly address the issue of cross-border cooperation. Moreover, the majority of Member States have 
put in place national contact points to respond to requests for assistance from other Member States, 
but their capacity to react swiftly and efficiently is still low (European Commission, 2010). 

There is also uncertainty due to the emerging of new forms of fraud (that are not covered by the 
current criminal framework in some cases) and to different level of transposition of the FwD across 
MS.352 Further obstacles are related to challenges in investigations and prosecutions, such as the lack 
of adequate skills and resources among LEAs and judicial authorities, also affecting the priority given 
to NCP frauds (Europol, 2016b¸ Levi, Doig, Gundur, Wall, and Williams, 2015; Levi, Rajeev V., Wall, 
Doig, and Williams, 2017).353This problem also covers issues in terms of cooperation (e.g. sharing and 
exchange  of  information)  at  national  (Disley,  Barrie,  Hughes,  and  Patruni,  2012;  Europol,  2012; 
European Commission, 2013c)) and EU level,354 as well as between the public and the private sectors 
(e.g. reporting of crimes).355).  

From  a  different  perspective,  this  problem  also  enables  OCGs  to  exploit  these  obstacles  and 
uncertainities  for  criminal  activities  relating  to  non-cash  means of payment. Specifically, frauds 
still represent more than a half of the total identified OCG activities, and are the types of crime mostly 
carried out by the 3,600 international active criminal groups based in Europe (Europol, 2013c). The 
interest of OCGs for card payment fraud can be explained in particular by a lower risk if compared to 
other criminal activities (e.g. human trafficking). 

This problem is linked to both the policy  framework (the increase of the cross-border dimension 
of NCP crimes, and the emerging of new forms of fraud , lack of common rules for facilitating public-
private  cooperation  and  reporting  to  the  authorities )  and  the  implementation  framework 
(differences  in  criminal  frameworks  across  EU,  Challenges  in  investigations,  prosecutions  and 
cooperation). 

It is not possible to provide an estimation of the magnitude of the problem, since statistics on the 
number of NCP crimes reported/investigated/persecuted/sanctioned are not available. 

Different stakeholders  are affected by this problem. This problems relates only to the reporting fraud 
and so only the cost of reporting fraud to the various stakeholders can be taken into account in this 
section. 

Even though enablers and payees are the stakeholders who bear the highest cost of fraud in general 
but they also regularly do not report frauds to law enforcement. This is particularly the case of Critical 
Infrastructure which include main enablers and main payees. Th us, they are affected by the lack of 
effectiveness of law enforcement and judicial response only on the proportion of fraud they report. 
Furthermore, the lack of adequate skills and resources among LEAs may create inefficiencies in the 

352 See Table 6 on the EU/national legislation coverage of criminal offences and the Authors’ analysis of MS 
transposition of the FwD in section 3.2. 
353 This is also confirmed by: experts participating to the 1 st EGM; Interview feedback from LEAs and EU institutions 
and bodies. 
354 Survey feedback from LEAs. 
355 Survey feedback from the private sector and inputs from experts participating in the 1st EGM. 

110 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

public-private cooperation, in particular cross-border, which in some cases results in enablers and 
payees investing to fight fraud but only for mitigated benefits not their side.356 

Payers  bear  costs  related  to  the  lack  of  effectiveness  of  the  investigations  and  prosecutions  
eventhough they do not necessarily report the frauds. Generally, they do not bear the economic cost of 
fraud (see section 4.3.1). However, identity theft does cause both financial and non-financial costs to 
the victims, in particular when the case remains unsolved as unless the liability is proven, identity 
thefts can have negative consequences on the individual credit ratings. 

It is difficult to understand whether payers on one side and payees on another side bear the heaviest 
consequences of this problem but in both cases these are significant. Indeed, even though payers bear 
less economic costs than the private sector they also proportionally report more crime than the latter. 
In addition, payers bear non-financial costs of unsolved reported cases  and enablers and payee bear 
the cost of exchange of information with the authorities. These two types of cost are of two different 
natures and cannot be compared. 

5.2.2  Limited  harmonisation  of the legislative framework 

This  problem  is  strictly  linked  to  the  previous  one, since differences in criminal and procedural 
frameworks across EU can affect LEAs and judicial representatives who are involved in transnational 
investigations and prosecutions (see section 3.2 and 3.3.1).357 

Most of FwD offences are punishable in most of the MS358, but there are still some differences in terms 
of level of transposition of the FwD, and some forms of conduct (especially fraudulent use of unlawfully 
appropriated payment instruments) are not criminalised in all MS (see section 3.2). Different levels of 
penalties across the EU have also been identified as an issue .359 It is noteworthy that the current level 
of harmonisation of the national laws is also the result of EU legislation issued  after the FwD (e.g. the 
PSD1 and 2 with regard to the definition of payment instruments).360 

New and emerging forms of NCP instruments (e.g. mobile money) and criminal behaviours (e.g. social 
engineering), which are not covered by the FwD, leaving room for interpretation to MS (see section 
3.2),361 and this can open the way to possible conflicts. 

Finally, both the conditions for reporting the NCP frauds to authorities and the level of protection of 
victims are different among MS which hampers cross -border cooperation.  

The  lack  of  harmonised  legislation  among  MS  has  wide  impacts  on  the  different  stakeholders 
identified for the FwD. 

Even if concrete evidence is not available, there is the risk the OCGs can exploit these differences and 
focus their criminal activities (or some of them) on MS with holes and gaps in their national criminal 
framework (see section 4.3.1). 

The problem is mostly linked to the policy and legal framework. 

The payer is the category of stakeholder most affected by this problem. First, in some MS some 
forms of NCP fraud and preparatory and supportive conduct are not criminalised and so the natural 

356 2nd EGM feeback: some representatives of the private sector reported the lack of response of law enforcement 
when they communicate information to them, in particular in cross -border cases. 
357 Also confirmed by experts participating in the 1st EGM. 
358 12 MS have fully transposed the FwD and most of the remaining MS (15) have criminalised most of the offences 
of the FwD (see section3.2). 
359 Validation Focus Group feedback: one participant. 2nd EGM feedback: some represententives of the Private 
sector. (See Annex 14 for further details). 
360 See section 2.2.1. 
361 Also confirmed by experts participating in the 1st EGM. 

111 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

and legal persons are not protected and the victims are not compensated in this regard. However, the 
individuals, and so the payers, are the main victims of fraud (see section 4.2.5. Second, although such 
means might add layers of security against frauds (see section 3.1.1 ), differences in the applicable 
legal framework can facilitate phishing attempts from fraudsters which have a direct impact in terms of 
data breaches for payers. 

Enablers  and  payees  are  also  affected  by  this  problem  to  a  lesser  extent.  Differences  in  the 
national legislation increase the need for information exchange and the time needed for prosecutions 
especially in case of transnational offences (See section3.3.1). As a consequence, this increased the 
uncertainty for law enforcement and judicial cooperation and so it increases the risks of financial losses 
for mainly the enabler and the payee but also for the payer as explained in the previous section for 
the first problem.  

5.2.3  Financial and  social costs incurred  by economic  operators  and consumers 

The problem relates to both financial and social costs. 

Financial costs  which are the costs associated to economic losses (see section 4.3.1). As a proxy of 
the magnitude of the overall financial costs, the total value of frau dulent transactions conducted using 
cards issued within SEPA and acquired worldwide amounted to €1.44 billion in 2013  (European Central 
Bank, 2015a).362 The value of fraud as a percentage of the total value of transactions for cards issued 
varied considerably between different EU Member States in 2013,363 but all MS were concerned by the 
phenomenon (see section 3.1). 

Social  costs  concern  psychological  and  social  distress,  impacts  on  fundamental  rights  (e.g. data 
protection and privacy), and, especially in case of identity theft, reputational damage and costs to 
rectify  the  consequences  of  the  theft  (e.g.  replacing  identity  documents; rectification of negative 
entries in victims’ credit history) (see section 4.3.1).  

The  emerging  new  forms  and  trends  in  non-cash  payment  frauds, and the growing international 
dimension of crime are increasing the financial and social costs borne by EOs and consumers victim of 
NCP frauds (see section 4.3.1). The latter ones are also affected by differences in the level of victims’ 
protection and the lack of protection for victims of identity theft.364  

The  problem  is  mostly  linked  to  the  policy  and  legal  framework.The  three  problems  are  further 
elaborated  in  terms  of  their  drivers  and  consequences  in  the  next  section.  The  figure  below 
summarises, by way of the problem tree, the identified problems and related causes, as well as the 
links  between  them, and indicates the possible “ultimate effects” which can arise from this set of 
problems and causes. 

Enablers  are  the  stakeholders  most  affected  by  the  financial  costs.  First,  financial  institutions 
and card issuers bear most of the costs relating to fraudulent transactions (see section 4.3.1) which 
are currently increasing (see section 3.1) and constantly taking new forms, generating heavy365 and 
increased (Capgemini, 2015) spending in fraud detection and prevention. Credit card schemes may 
also  be  affected  by  fraudulent  transactions  as  they  have to handle and manage the chargeback 
processes (see section 4.3.1).  

362 Additional evidence is available only on anecdotal basis: identity theft costs to the UK economy nearly €2 billion 
per year, with more than 100,000 people affected each year (Fraud Prevention Expert Group, 2007) (Robinson, 
Graux, Parrilli, Klautzer, and Valeri, 2011). In France, instead, it is estimated that in 2009 the annual cost to the 
victims is around €474 million (i.e. €2,229 per victim) (European Commission, 2012).  
363 The rates of fraud were highest in France, the United Kingdom and Luxembourg, while Hungary, Lithuania, 
Romania and Poland, which had the lowest rates. 
364 Interview feedback from representatives of Victims Associations and Academia. 
365 2nd EGM feeback: some representatives of the private sector said they support heavy spendings to fight fraud.  

112 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Payees  also  bear  significant  costs  of  fraudulent transactions366, in particular airline companies 
(European Commission, 2016b) and e-commerce 367. The payee bears the financial costs only when he 
or she does not comply with EMV standards in card-present transactions and does not require strong 
customer authentication in all types of transactions (see section 4.3.1) or when fraudulent transactions 
are blocked by the competent authorities. 

The payer bears less financial costs than these two types of stakeholders and only when he or she 
acted  with negligence or fraudulently (see section  (see section 4.3.1). However, the payer bears 
most  of the social costs related to NCP fraud related conduct. 

The following sections describe drivers by thematic area, intermediate causes, core problems , and 
ultimate effects. 

5.3  Drivers and consequences  of the identified  problems   

The following problem tree summaries the identified problems and related drivers, as we ll as the links 
between them, and indicates the possible consequences which can arise from this set of problems and 
causes. 

Figure 2 – Problem tree 

Source: Authors’ elaboration 

366 This is the case only when they are not fully compliant with the security standards. 
367 2nd EGM feeback: some representatives of the private sector agreed on the fact that e-commerce fraud represent 
significant costs to merchants. 

113 

 
 
  
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

5.3.1  Drivers 

Increase of the cross-border dimension of non-cash payment frauds, and emerging of new forms of 
fraud (Problem n. 1, n. 2 and n. 3) 

  Cross- border  transactions  are  more  affected  by  frauds  than  are  domestic 

transactions: 

- 

Even though the value of domestic payment card transactions made up to 92% of all 
transactions value, and cross-border transactions only 8%, they accounted respectively 
for 49% and 51% of the value of fraudulent transactions in 2013.368 

-  Between 2009 and 2013, the number of cross -border transactions within SEPA that 

- 

were fraudulent rose faster than that of those that were not fraudulent; 
In  2013,  cross-border  fraud  within  SEPA  and  domestic  fraud  exceeded their 2009 
levels,  

  New  form s of NCP frauds and criminal conduct are emerging also due to recent forms 

of non-cash payment instruments:  

-  Virtual currencies are potentially vulnerable to fraud. They allow for greater anonymity 
than traditional non-cash payment instruments,369 and can be traded on the Internet 
through non-face-to-face customer relationships, and thus allow for a certain level of 
anonymous funding, at least until the funds are cashed out; 

-  Conduct which is preparatory to or supportive of NCP frauds (such as data breaches 

- 

- 

and identity theft/theft of credentials) is increasing in importance.370  
There is anecdotal evidence of frauds related to non-corporeal payment instruments 
that  are  increasingly  used  such  as  electronic  ticket  restaurants ,  coupons, 
fidelity/loyalty cards. 
Technological advancements allowed for the development of new business models that 
enable individuals to carry out part of crimes that were previously limited to OCGs. The 
Internet  is  a  key  facilitator  as  proved  by  the  number  of hidden marketplaces and 
underground  forums  (typically  developed  in  the  darknet)  where  cybercriminals 
advertise and sell their products and services. 

a.  Differences in criminal frameworks across EU (Problems n.1 and n. 2)371 

  Despite  the  FwD  is  complemented  by  other  EU  legislation 372  which criminalises also 
preparatory and supportive conduct of non-cash payment fraud, illegal interception of 
computer data and attacks against information systems, differences between MS are still 
present with regard to the crim inal fram ework:  

- 

The form s of crim inal conduct included in the FwD have been fully transposed by 
only 12 MS. Most of the remaining MS (15) have criminalised most of the offences of 
the FwD and only one MS has not transposed or have only partially transposed more 
than half of the offences listed in the FwD.373  

368 The overall number of fraudulent transactions with French cards increased to 3.7 million of cases, for a 
corresponding value of EUR 416 million. 
369 It is noteworthy that this greter anonymity may soon be reduced by the revised AML directive which may impose 
a more stringent legislative framework for the transactions of virtual currencies. 
370 OPC  feedback: the most important means to obtain credentials to use in fraudulent tra nsactions are: data 
breaches (90% (n=27) of representatives from practitioners considered them as “very important” or “important”), 
phishing (87%, n=27), acquisition on the dark web (84%, n=21), malware (83%, n=25), social or behavioural 
scams (79%, n=23) and skimming or shimming (66%, n=19), while acquisition on the open web (38%, n=10) is 
deemed less important. 
371 OPC  feedback: 58% (n=19) of pratictioners think it is necessary to have more similar definitions of non-cash 
means of payment in criminal law across the EU and 71% (n=30) more coherent definitions of offences. 
372 The Directive 2013/40/EU on Attacks against Information Systems and the Cybercrime Convention.  
373 According to the OPC respondents (general public) the following activities should be crimin alised: Identity theft 
(86%, n=18), Acquisitions of credentials to use in fraudulent transactions (90%, n=19), Selling of credentials to 
use in fraudulent transactions (95%, n=20), Mobile payments with stolen card credentials (100%, n=21), Online 
transactions with stolen card credentials (100%, n=21), Phone transactions with stolen card credentials (100%, 
n=21), ATM withdrawals with counterfaits cards (95%, n=20), Online transactions with stolen credentials (e.g. 
paypal) (95%, n=20), Fraudulent transactions with virtual currencies (80%, n=16), Fraudulent transactions with 

114 

 
 
                                                 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

-  Preparatory   or  supportive  conduct  that  precedes  frauds  without  being  directly 
linked  to  it  (such  as  data  breaches,  identity  theft/theft  of  credentials   and  social 
engineering)  is  currently  not  criminalised  by  the  FwD.  Despite  that,  several  MS 
widened the scope of forms of conduct criminalised. Specifically, most MS (22) cover 
identity theft and data breaches in their national legislation. Phishing and acting as a 
money mule when related to NCP frauds covered by the national laws a re covered in all 
MS but not always ina n explicit manner. In addition the lack of a common definition of 
identity theft makes it hard to clearly assess the level of coverage of this conduct at 
national level.  

  The heterogeneous classification of NCP frauds between MS hinders the creation of links 
and correlation among different cases and therefore the identification and dismantling of 
organised crime groups. Likewise, differences are present in terms of lev el of penalties 
for NCP fraud: 

- 

- 

The FwD does not provide specific indications to MS on the type and level of penalties 
and  it  sets  some  high  level  principles  (e.g.  the  penalties  should  be  “effective, 
proportionate and dissuasive”) leaving room for interpretation for the MS which have 
to decide which action to take to sanction the FwD offences.374  
Even  though  other  EU  legislation 375  complement  the  FwD  by  setting  a  range  of 
administrative  sanctions  and  maximum  terms  of  imprisonment  for  some  types  of 
criminal offences, the level of penalties for NCP fraud strongly differs among MS and it 
is not equally dissuasive.376 Most of the MS provide deprivation of liberty at least in 
serious  cases.  In  the  current national legislation, counterfeiting and falsification of 
payment  instruments  (Art.  2  (b))  is  the  most  heavily  punished  FwD  offence.  The 
offences relating to specifically adapted devices (Art. 4) are  punished with the lowest 
levels of penalties.  

 

Penalties  alone  can  never  make  up  for  the  low  actual  and  perceived  probability  of 
apprehension and conviction in relation to NCP frauds. However, the existing differences 
between levels of sanctions foreseen at national level for the same criminal offence limit 
the overall proportionality of the level of penalty at EU level.377 

b.  Challenges in investigations, prosecutions a nd cooperation between authorities (Problem n.1): 

  Several challenges are related to national investigations and prosecutions: 

- 

- 

Lack of skills among LEAs and judicial authorities to fight and prosecute NCP frauds. 
The  main investigative challenges for LEAs,  which are common to areas relating to 
cybercrime, are attribution, anonymisation and encryption of data. NCP frauds often 
require LEAs to have highly specialised technical skills (e.g. IT acquisitions, processing 
of  unstructured  electronically  stored  information  (ESI),  IT  forensics).  There  is  also 
evidence  that  judicial  representatives  sometimes  lack  needed  competencies  in 
cybercrime offences) (Council of the European Union, 2016a); 
Limited capacity/motivation/power of LEAs to prioritise investigations on NCP frauds 
compared with other forms of crimes. The level of priority attributed to NCP frauds is 

pre-paid means (e.g. vouchers, gift cards) (86%, n=18). 
374 The national legislation is more stringent that the FwD, often resulting from the transposition of another EU or 
international. This is the case for example for the perimeter of application of the jurisdiction which is often broader 
than the FwD.  
375 For example the Directive 2013/40/EU on attacks against information systems, see section 4.4 for more detail. 
376 OPC  feedback: 91,5% (n=54) of pratictioners think it is necessary to have more coherent level of penalties for 
offences related to non-cash means of payment across the EU. 
377 E.g. national laws have defined the FwD forms of conductoffences in many different ways which are not easily 
comparable, National legislation often further detail offences defined in the FwD by adding cosnitions and 
circumstances thus making it difficult to identify a comparable category of offence throughout all MS . Very few MSs 
set minimum sanctions and in the MS where penalties are specified, the lowest minimum penalty for counterfeiting 
is 6 months (Germany) and the highest 4 years (Spain) and for offences relating to computers the minimum is 6 
months in Italy and Spain and 3 years in Romania. Disparities in the punishments relate for example the 
counterfeiting and falsification of payment instruments: PL punishes this offence with a particulartly high maximum 
offence of 25 years. However, the average maximum imprisonment is 6.1 years, which remains far above average 
levels of penalties for the other offences.  

115 

 
 
                                                                                                                                                              
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

somewhat linked to: a) the existence of underreporting practices ; b) whether the MS 
follows the legality principle, with legal obligations on some LEAs to initiate an official 
investigation whenever they receive information about a crime and when its prejudice 
is  above  a  defined  threshold  which  can  be  very  low ;  c)  the  limited  availability  of 
resources and skills within LEAs;  

  Additional and specific additional challenges are related to cross-border investigation and 

prosecutions, requiring cooperation between MS authorities: 

- 

-  Differences between national criminal law frameworks (such as the differences in the 
classification and in the coverage of criminal offences described under Driver B above ) 
may affect the cooperation between agencies and Member States making it difficult to 
perfom cross-border investigations and prosecutions. 
In cybercrime cases (including NCP frauds), the crimes often include a foreign element 
and the risk of jurisdictional conflicts is high. Therefore, the jurisdiction based on the 
territoriality  principle  becomes  progressively  a  complex  affair.  The  FwD  does  not 
specifically  mention  the  criteria  according  to  which  the  jurisdiction  should  be 
established. A subsequent relevant EU legislation set some common rules for s olving 
conflicts of jurisdiction. However the different implementation of these rules by MS still 
leave the risk of double jeopardy and sometimes is at the origin of lengthy procedures 
of exchange of information. 

-  Difficulties in cross-border cooperation are also due to different national standards on 
the  admissibility  of  evidence  that  can  prevent  the  investigations  from  continuing. 
Obtaining evidence located outside the state leading the investigation can be a lengthy 
and time-consuming procedure. Difficulties in the exchange of information relate also 
to: a) the lack of common working practices in the collection and sharing of data and 
information  related  to  NCP  frauds ;  b)  to  different  reporting  practices  (as  better 
explained under Driver D below) that may bring to limited availability of information on 
cross-border  cases;  c)  the  existence  of  different  systems  for  data  collection  and 
exchange in use by judicial authorities and LEAs, which makes it difficult to identify the 
owner of some information; d) also different languages may create obstacles to the 
communication between MS. All these difficulties made the exchange of information 
one of the most costly activities linked to the implementation of the FwD. Furthermore, 
some exisiting forms of judicial cooperation, such as the system of Joint Investigation 
Teams (JITs),  were not really designed to cope with forms of crime where cross-border 
components are a routine element.  

  Criminal  activities  performed  in  third  countries  are  also  an  obstacle to cross-border 
cooperation. In most cases, LEAs and judicial authorities are limited by legal provisions, 
time frames and financial restrictions. This brings them to prioritise national cases and 
makes it difficult for them to prioritise cases with an international dime nsion. 

c.  Lack of common rules for facilitating public-private cooperation and reporting to the authorities 

(Problem n. 1 and n. 2) 

  Even  though  public- private  cooperation  is  widely  considered  an  enabler  to  fight 
against non-cash payment frauds, the FwD did not include a specific provision on public-
private cooperation: 

-  Despite the lack of specific provisions in the FwD, MS and EU agencies and institutions 

implemented cooperation initiatives with different levels of formalisation.378  

-  According  to  most  of  the  surveyed  stakeholders,  the  level  of  public-private 
cooperation/partnership is not fully effective , tough. The main obstacles seem to be 
relating to the data and information sharing between private and public institutions, 
both domestically and internationa lly when countries must comply with different data 
protection rules and practices.379 Other obstacles relate to the lack of clarity in the 

378 The UK seems to be the country with the most developedpublic-private cooperation and the highest amount of 
partnership initiatives developed to address non-cash payment frauds cases. 
379 According to OPC respondents (general public) financial institutions should be allowed to spontaneously share 
with national police and police of another EU country personal information of victims, such as: bank account (54%, 
n=7), IP address (54%, n=7), name (50%, n=7), address (46%, n=6), phone number (46%, n=6), email address 

116 

 
 
                                                 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

rules to be followed by private stakeholders to collect information that can be used as 
evidence  in  proceedings,  and to the limited harmonistaion of data and NCP frauds 
within and between MS. 

 

Likewise,  the  FwD  does  not  provide  any  legal  obligation  for  reporting  to  law 
enforcement agencies criminal offences relating to NCP: 

- 

-  Despite  that,  a  slight  majority  of  Member  States  (16)  decided  to  adopt  national 
measures to favour reporting practices. However, almost half of the Member States in 
2011 did not make available any reporting mechanisms dedicated to Internet crimes 
other  than  turning  directly  to  the  police  and submitting th e complain at the Police 
station.  When  online  reporting  systems  are  in  place,  the y  often  do  not  provide 
feedback to the victims once they submit their cases therefore feeding the consumers’ 
lack of trust in the overall enforcement system.  
Furthermore, underreporting is a quite common practice in NCP related frauds. The 
limited reporting (especially of cross-border cases) may lead to an underestimation of 
the size of the phenomenon by LEAs  and so to a low level of prioritisation of such cases 
within LEAs, as mentioned above. This also ends up in a situation where the increase in 
NCP fraud is not reflected in the statistics of cases reported and investigated by EU 
police  forces.  Consequently,  this  phe nomenon  is  not  prioritised  and  it  therefore 
becomes difficult to initiate international cooperation (e.g. Joint Investigation Teams) 
in such cases. 

-  Reporting  by  the  private  sector  is  inhibited, among others, by concerns about the 
potential  negative  impact  that  reporting  NCP  frauds  may  have  on  their  business 
reputation.380 

  The cross border dimension of many episodes involving identity theft is generally not 
addressed in the current systems of reporting. Moreover, the current legal framework 
does not properly address the issue of cross-border cooperation (European Commission, 
2010). 

d.  Lack of specific protection for victims of NCP fraud and identity theft (Problem n.2 and n. 3) 

  The level of protection of victims is different among MS: 

-  When looking at national provisions (direct approach),381 there are some specific rights 
that are heterogeneously ensured to victims across the EU, with some Member States 
ensuring, at least in principle, a w ider protection than others. This is the case especially 
for: the right to be heard, the right to legal aid, the right to protection of victims during 
criminal  investigations  and  the  individual  assessment  of  victims  to identify specific 
protection needs. From 10 to 18 Member States do not cover these rights through their 
legislation thus leaving potential room for different levels of protection. Interviewed 
stakeholders  confirmed  that the coverage of victims’ rights ensured by the current 
legislative framew ork appears to be not fully adequate to address all the needs of 
victims  of  fraud  and/or  identity  theft.  The  limited  stakeholders’  satisfaction is also 
linked  to  the  poor  level  of  enforcement  of  penalties  of  the  existing  legislative 
framework.  

-  Differences in the level of protection of victims are also linked to the heterogeneous 
levels of penalties established at national level for NCP offences (indirect approach).382 
In addition, there is the perception that the level of penalties is overall too low to have  
a deterrent effect on the trend of NCP frauds (European Commission, 2008).However, 

(31%, n=4). For some information a higher percentage of respondents thinks that information should be shared 
solely with national police: email address (69%), phone number and address (54%). 
380 Private sector indeed may feel damaged by reporting data breaches or cybercrime issues that company has 
experienced.  
381 Direct approach refers to the adoption at national level of specific provisions regarding victims’ rights which are 
complementary to those provided by Directive 2012/29/EU. 
382 Indirect approach refers to the adoption at national level of different levels of penalties and sanctions, and of 
techniques adopted to determine them. Such a modulation could affect the effectiveness of penalties, in terms of 
deterring the fraudsters while improving consumers’ perception of level of protection and safeguard.  

117 

 
 
                                                                                                                                                              
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

it is worth mentioning that it was not possible to find conclusive evidence on the effects 
that penalties alone may have on the level of NCP frauds. 

  Despite identity theft being an increasing phenomenon,383 there is an overall lack of 
provisions,  at  both  EU  and  national  level,  addressing  explicitly  the  primary  and 
secondary  victims  of  identity  theft.  Specifically,  in  the  MS  covering  identity  in  their 
national legislation, the rights of the victims are included in the same general guarantees 
for the fraud attacks. 

5.3.2  Consequences 

The  obstacles  to  investigations  and  prosecutions   and  the  increasing  costs  incurred  by  EOs  and 
consumers victim of NCP frauds can have adverse economic and social consequences on the EU as a 
whole, considering that Europe is increasingly a less cash oriented society, as suggested by the trend 
of NCP transactions over the last years (see section 2.3). For instance, the use of fraudulently acquired 
payment data has consequences for the individuals: privacy violation, financial losses, and theft of 
credentials are considered to be the main damages, while the impact of NCP frauds on the willingness 
to make transactions on line and the lack of access to online services seems to be limited. As long as 
identity theft is concerned, according to the EC, the visible effects on the society and econ omy are the 
increase in the costs of credit, depressive effects on the economy, and loss of trust in e -commerce 
(European Commission, 2012).  

Specifically,  the  identified core problems are expected to trigger two main consequences that are 
strictly linked one to each other.  

1)  Threats to EU citizens security (problem n.1 and n. 2) 

The increase of NCP frauds and the obstacles to their investigation, prosecutions and convictions can 
lead to threats to the actual security (i.e. the concrete risk of being a victim of crime) and perceived 
security384 (i.e. the personal sensation of potentially being the victim of a crime) of EU citizens.  

2)  Digital single market imbalances (problem n.1 and n. 2) 

Digital single market imbalances can arise from the high profitability and attractiveness of NCP frauds 
for OCGs, whose illicit gains lead to significative economic and financial losses throughout the “digital” 
supply chain across different sectors.385 Furthermore, consumers’ concerns about security of digital 
transactions  and  personal  data  can  imply additional adverse effects on the volume of goods and 
services purchased by the means of non-cash payment instruments. 

5.4  Evolution  of the problem 

Limitations in data availability on the dimension of NCP frauds include also the lack of forecast on their 
evolution in the low and medium term.  

Nevertheless, it has been noted that: 

383 The UN Threat Assessment on Globalisation of Crime issued in 2010 estimates that 1.5 million persons were 
victims of identity theft, with an estimated financial loss USD 1 billion. 
384 With regard to the perceived security, the 2014 Eurobarometer report on cyberse curity provides figures on the 
Internet users’ perspectives observed in different Member States. On average 63% of respondents across the EU 
said that they were concerned about online banking or bank card fraud (+14% with respect to 2013). In particular 
Latvia, France, and Spain seem to be the most concerned, with respectively 79%, 76%, and 74% of the 
respondents declaring to be very or fairly concerned. 
385 The airline sector seems to be the most affected.The airline industry faced estimated losses for €1 bi llionper year 
as a result of airline tickets purchases using compromised card data. 

118 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

  NCP transactions have been steadily increasing in Europe over the last years, in both 
volumes and values (European Central Bank, 2016a).386 Furthemore, anecdotal evidence 
suggests that non cash payments will become even more firmly established over the 
next decade.387 
Likewise, the value of all fraudulent transactions using cards online  increased in the 
Eurozone between 2009 and 2013.388 Such trend is mostly due to the overall increase of 
the value of all card transactions, rather than the increase of frauds as a share of the 
total value of transactions (European Central Bank, 2015a). 

 

Taking into account the recent and expected trends of NCP transactions, and assuming that the share 
of fraudulent transactions in all NCP transactions frauds will be the same, the problem can be expected 
to deteriorate if the current status remains unchanged. 

However,  it  has  be  noted  that  the  PSD2 Directive will impose strong customer authentication for 
remote transactions which are expected to bring down fraud rates after the full implementation and 
enforcement of the Directive (2018 onwards). At the same time, the PSD2 will also have a focus on 
significantly facilitating entry of new, third-party payment providers, that could lead to the emerging of 
new forms of NCP instrument and modalities, as well as to an increase of the overall NCP transactions, 
with the risk of new opportunities for criminal activities . 

Therefore, it can be assumed that the problem is not necessarily expected to decrease in absence of 
an EU intervention addressing the NCP frauds. 

To this end, furter remarks on the foreseen evolution of  some of the identified core problems and 
drivers can be done. 

If the current trends of the NCP industry (such as the increase in the number and types of players and 
a diversification of their offering; and the spread of new enabling technologies) will continue, they can 
lead in the next future to the appearance of new payment instruments and to the emerging of new 
forms  of  crimes  and  criminal  conduct  associated  to  them.  If  not  criminalised  in  the  national 
legislative frameworks, these new forms of crimes and conduct could further intensify the limitations 
in the harmonisation  between MS, also leading to an increase of uncertainty. 

If the current trend in cross-border fraudulent transactions will continue, it could lead to further issues 
in terms of cooperation  between MS authorities,  with obstacles  for law enforcement  activity. 

As  regards  the  financial  and  social  costs  incurred  by economic operators and consumers, the 
same reasoning of the foreseen evolution of the NCP frauds can be done, suggesting that they are not 
necessarily expected to decrease in the future. 

5.5  EU right  to act, necessity  test and EU added value 

EU right to act 

The legal basis for Union action in the area is established in Title I of the Treaty on the Functioning of 
the European Union which concerns Provisions on  Cooperation the Area of Freedom, Security and 
Justice. Moreover, the Union shares competence on this area of freedom, security and justice with all 
Member States, as stated in article 4 para.2 let. j) of the Treaty (consolid ated version). 

386 Overall, the total volume of NCP transactions in the EU increased by 5.6% from 2013 to 2014 and by 8.6% in 
2015, for a corresponding number of 112.2 billion transactions. The total value of non-cash transactions in 2015 
amounted to more than €276.9 trillion, +9% with respect to 2014. 
387 According to UK C entre for Economics & Business Research, it is estimated that non cash transactions will 
represent the 68% of UK total transactions in 2026, +13% with respect to 2014 (Paul Hastings LLP, 2016). 
388 In 2013, the total value of card fraud using cards issued in SEPA increased of 8.1% compared with 2012, and of 
3.9% compared with 2009. 

119 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Title  V  states  the  measures  the  EU  shall  take  for  the  assurance  of  a  high  level  of  security  for 
prevention  and combating crime, racism and xenophobia. The measures refer to coordination and 
cooperation between police, judicial authorities and other competent authorities, as well as to the 
assurance  of  mutual  recognition  of  judgments  in  criminal  matters  and,  if  necessary,  of  the 
approximation of criminal laws and regulations of the Member States. 

The Treaty focus on: 

  defining  strategic  guidelines  for  legislative  and  operational  planning  in  the  area  of 

 

 

 

 

freedom, security and justice , in accordance with article 68 of TFEU; 
adopting rules and procedures for ensuring recognition throughout the Union of all forms 
of  judgments  and  judicial  decisions  and  prevention  and  settlement  of  conflicts  of 
jurisdiction between Member States , as stated under article 82; 
approximation  of  laws  and  regulations  of  the  MS,  by  establishing  minimum  rules 
concerning the definition of criminal offences and sanctions in the  areas of particularly 
serious crime with a cross-border dimension; the areas of crime cover among others, 
money  laundering,  counterfeiting  of  means  of  payment,  and  computer  crime,  in 
accordance with articles 83 and 84; 
strengthening  the  coordination and cooperation between national investigating and 
prosecuting  authorities  of  the  Member  States  in  relation  to  cross -border  serious 
criminality with the support of Eurojust and Europol, in accordance with articles 85 and 
88; 
strengthening  the  police  cooperation  involving  all  the  Member  States'  competent 
authorities, including police, customs and other specialised law enforcement services in 
relation to the prevention, detection and investigation of criminal offences, including on 
collection, storage, processing, analysis and exchange of relevant information, training 
of staff and using common investigative techniques, as stated in article 87 of TFEU; 

Necessity test  

The problem of frauds and counterfeiting of non-cash means of payment falls under a competence 
shared between the EU and the Member States.  

The main features of NCP crimes would call for an EU intervention, in accordance with article 83 para. 
1:  

 

 
 

cross-border dimension of the crime, by establishing minimum rules on the definition of 
criminal  offences,  especially  the  serious  crimes,  including  counterfeiting of means of 
payment and computer crime, and their sanctions;  
combating the cross-border serious offences on a common basis  at EU level; 
impact on the proper functioning of EU Digital single market 

Because of the increasing digitalisation in non-cash means of payments, the cross border nature of 
the crime is one of the main charateristics that identifies this crime. Available evidence outlined the 
difficulties for tackling NCP frauds when they are committed or have their consequences in more than 
one MS (see section 3.3.1).  

Moreover, imbalances caused by frauds in  NCP payments can reduce the trust in the digital single 
market and cause deviations in consumers’ choices and buying behaviours. Thus, an EU intervention 
could  help  in  levelling  the  protection  of  consumers  and  EOs in the digital single market era, also 
fostering a closer cooperation among police forces, customs and judicial and competent authorities . 

EU added value 

In comparison to Member States action, an EU intervention would present the following advantages in 
tackling the identified problems: 

120 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

 

approximation of the legal framework across MS that allows for uniformity in response to 
the crimes (e.g. establishing minimum rules for approximation of the criminal law of MS 
in defining serious crimes, sanctioning the offences);389  
effective and efficient systems to exchange information and obtain evidence between the 
Member States; 

  Equivalent protection for individuals and business against NCP frauds that can ensure 

equity and remove distortions of competition in the digital single market; 

  Complement of other existing EU policy and legislative initiatives in relevant fields (such 
as  the  PSD2  Directive  in  the  field  of  payment  instruments;  the  Directive  on  Euro 
counterfeiting  in  the  field of traditional currencies;  the Directive on the protection of 
personal data; the Directive establishing minimum standards on the rights, support and 
protection of victims of crime), reinforcing the development of common and consistent 
EU framework. 

6  DEFINITION  OF THE  OBJECTIVES 

6.1 

Identification  of the main  objectives  

On the basis of the problems and associated drivers and consequences, the following strategic and 
specifc objectives have been identified for an EU intervention (see Section 5.2). 

General  objectives  (the  overall  objectives  expressed  in  terms  of  the  ultimate  impact  of  the  EU 
intervention): 

  Reinforcing the trust of consumers and economic operators in the digital single market; 
Fighting the different forms of non-cash payment frauds, to decrease its occurrence and 
 
disrupt organised crime. 

Specific objectives(the immediate objectives expressed in terms of direct and short-term effects or 
outcomes):  

  Establishing  common  minimum  rules  for the criminalisation and investigation of non-

cash payment fraud, addressing new forms and their possible evolution; 

  Enabling law enforcement investigations and judicial prosecutions against new forms of 
non-cash payment fraud, as well as a stronger cooperation between MS law enforcement 
agencies and between the public and the private sectors; 

  Ensuring  better  protection  for  consumers and economic operators against non -cash 

payment fraud. 

The  figure  below  presents  the  identified  objectives,  along  with  an  indicative   list  of  possible  for 
measuring  the  achievement  of  global  objectives (impact indicators) and specific objectives (result 
indicators). 

389 It is not worthy that homogenised legal framework does not necessarily mean homogenised LEAs working 
practices and prioritisation of NCP frauds with regard to other forms of crime. 

121 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Figure 3- Objective tree 

Authors’ elaboration 

6.2  Rationale  of the identified  objectives  

The general and specific objectives have been elaborated in order to address the problems and their 
associated  consequences  and  drivers ,  as  summarised  in  the  problem  tree  (see  Table  below).

122 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment regarding possible options f or a future EU 
initiative in combatting fraud in and counterfeiting of non-cash means of payment 

General and  specific objectives 

Rationale 

Reinforcing  the  trust  of  consumers  and 
economic  operators  in  the  digital  single 
market (General obj.) 

Directly addressing the consequence “Digital single market imbalances” since consumers’ concerns about 
security of digital transactions and personal data can imply additional adverse effects on the volume of 
goods and services purchased by the means of non-cash payment instruments. 

Fighting  the  different  forms  of  non-cash 
payment fraud, to decrease its occurrence 
and disrupt organised crime (General obj.) 

Indirectly addressing the consequence “Threats to EU citizens security”, since the reinforced trust would 
imply an improvement of the perceived security when operating in the digital single market  

Directly addressing: 

- the consequence  “Threats to EU citizens security”, since it aims at reducing the number of NCP frauds 
and thus the concrete risk of being a victim of these crimes ; 

- the consequence “Digital single market imbalances” since it aims at reducing the attractiveness and 
profitability of NCP frauds for OCGs, and the economic and financial losses due to the illicit gains of these 
groups 

Establishing  common  minimum  rules  for 
the  criminalisation  and  investigation  of 
non-cash payment fraud, addressing new 
forms  and 
their  possible  evolution 
(Specific obj.) 

Directly addressing the problem “Limited harmonisation of the legislative framework” (problem 2) since 
it addresses: 

- the differences in criminal frameworks across EU (driver B), also taking into account the emerging of 
new forms of fraud (driver A) 

- the lack of common rules for facilitating the reporting to authorities (driver D) 

Indirectly addressing the problems: 

- “Uncertainty and obstacles for law enforcement activity and judicial cooperation” (problem 1), since it 
addresses the uncertainty related to the emerging of new forms of fraud (driver A) and to the different 
level of transposition of the FwD across MS (driver B) 

- “Financial and social costs incurred by economic operators and consumers” (problem 3), since it can 
address these costs due to the emerging of new forms of fraud (driver A) 

123 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment regarding possible options f or a future EU 
initiative in combatting fraud in and counterfeiting of non-cash means of payment 

General and  specific objectives 

Rationale 

Enabling  law enforcement investigations 
and  judicial  prosecutions  against  new 
forms of non-cash payment fraud, as well 
as a stronger cooperation between MS law 
enforcement  agencies  and  between the 
public  and  the  private  sectors  (Specific 
obj.) 

Directly  addressing  the  problem  “Uncertainty  and obstacles for law enforcement activity and judicial 
cooperation” (problem 1), since it addresses the obstacles and challenges related to: 

- the cooperation between MS authorities (driver C) in case of cross-border crimes (driver A) 

- the cooperation between the public and private sectors (driver D)  

Indirectly  addressing  the  problem  “Financial  and  social  costs  incurred  by  economic  operators  and 
consumers” (problem 3), since improvements in investigations and prosecution can lead to a decrease of 
these costs. 

Ensuring better protection for consumers 
and economic operators against non-cash 
payment fraud and empowering economic 
operator (Specific obj.) 

Directly  addressing  the  problem  “Financial  and  social  costs  incurred  by  economic  operators  and 
consumers” (problem 3), since it addresses the lack of specific protection for victims of NCP fraud and 
identity theft (driver E) 

124 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

6.3  Assessment  of the consistency  with the EU and international  policy developments 

The objective tree presented above integrates the objective of reinforcing the trust of the consumers in 
the digital single market with the need  to better address the non-cash payment fraud framework, 
including the new and evolving forms of fraud, while decreasing the occurrence of fraud and deterring 
potential related criminal activities at EU level. 

The fight against fraud represents one of the European Commission priorities, in line with the Chapter 
6 – Combating Fraud - of the Treaty on the Functioning of the European Union (TFEU), which states at 
Art.  325  para.  1 that “the Commission and the Member States shall counter fraud and any illegal 
activities affecting the financial interests of the Union.”  

On the same time, the 2011 Antifraud Strategy envisages the objective of the European Commission to 
improve  prevention  and  detection  of  fraud,  by  setting  up  clear  responsibilities  for  the  relevant 
stakeholders,  strengthening  the investigation process and applying proportionate and dissuasive 
sanctions. 

Moreover, the European Internal Strategy 2011-2014 and the follow -up actions focus on five main 
strategic objectives aimed to overpass the current challenges in order to make “the EU more secure”. 
The European priorities related to anti-fraud area refer to: 

 

identifying  and  dismantling  criminal  networks  through  drawing  up  a  strategy  for 
information collection and use by law enforcement and judicial authorities, reinforcing of 
joint  operations  and  joint  investigation  teams  and  improving  the  application  of  the 
European arrest warrant; 

  building capacity in law enforcement and the judiciary, by developing the EU countries’ 

capacities for investigation and prosecution; 

  working  with  industry  to  empower  and  protect  citizens,  by  setting  up  a system for 

 

reporting cybercrime incidents; 
ratification of the Budapest Convention on Cybercrime. 

 
  One  of the priorities of the new European Agenda on Security 2015 -2020 is fighting 
cybercrime. The COM has set out the main actions to be followed for complying with this 
objective and they refer to: 
implementation  of  existing  policies  on  cybersecurity and attacks against information 
systems; 
reviewing  and  possibly  extending  le gislation  on  combating  non-cash  fraud  and 
counterfeiting by including new forms of crime against financial instruments; the FwD 
2001/413/JHA appears to no longer reflects today’s realities and new challenges, such as 
virtual currencies and mobile payment ; 
identifying  obstacles  to  criminal  investigations  on  cybercrime,  notably  on  issues  of 
competent jurisdiction and rules on access to evidence and information. 

 

 

The 7th COM Progress Report based on the European Agenda on Security highlights the legislative a nd 
non-legislative initiatives taken by the EU in the field of crime prevention, which have an important 
impact on combating fraud, such as: 

 

increasing the Europol role of EU hub for information exchange on serious cross -border 
crime, in order to become more effective, efficient and accountable; 

  building  the  MS  capacities  for  cybercrime  resilience  and  implementing  the  Network 

 

Information Security (NIS) Directive;  
strengthening the mandate of the EU Network and Information Security Agency (ENISA) 
and developing the cyber security standards, certification and labelling to make systems 
and  devices  more  cyber secure; by adoption of NIS Directive, the role of ENISA was 
reinforced especially by the support it offers in addressing, response and prevention of 
incidents, providing technical guidelines and recommendations for the adoption of NIS 
standards, as well as by assuring the cooperation between different stakeholders in the 
information security field; 

125 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

improving the access to electronic evidence to investiga tors in cross-border cases; the 
COM  planned  to  develop  a  common  approach  among  MS  in  order to determine the 
jurisdiction  of  law  enforcement  authorities when they directly access data stored or 
located abroad, including to adopt adequate legislative measure s, if the case. Moreover, 
COM adopted a series of legislative acts to improve the cooperation between the MS’ law 
enforcement authorities, including on making more efficient the collection of evidence 
process, respectively through European Arrest Warrant Framework Decision, European 
Investigation Order Directive and Injunction Directive. 

In March 2017, the EU Council concluded on the continuation of the EU Policy Cycle for organised and 
serious international crime for the period 2018-2021. For the next 4 years, EU Policy will focus on 
policy development on basis of 2017 EU SOCTA (Crime in the Age of Technology) that provides an 
overview  of  the  criminal  threats  in  EU,  including  on  document  fraud,  malware  and  identity theft, 
cryptoware, network attacks and payment card fraud; identification of priorities and developing Multi-
Annual Strategic Plan; implementation and monitoring of annual Operational Action Plans (OAP) for 
combating organised criminality and other serious crimes. 

Developing a unique Digital Single Market (DSM) represents one of the 2015 European Digital Agenda’ 
objectives under the umbrella of the Europe 2020 Strategy. The existing key challenges in assuring a 
better access to digital goods and services across Europe refer to providing adequate protection to 
consumers and businesses’ assets and to tacking cybercrime through the adoption and implementation 
of a strong and effective legislation in this field. The new EU legislative framework with relevance on 
combating cybercrime and complementing the 2001 Budapest Convention on Cybercrime, respectively 
Directive on attacks against information systems and NIS Directive, aim to strengthen the national 
cybercrime  laws  and  to  introduce  more  effective  criminal  sanctions,  as  well  as  to  assure  a  high 
common level of security of network and information systems across the Union.  

The role of public authorities and private sector is paramount in strengthening the cybersecurity and 
non-cash  fraud  as  well.  By  the  adoption  of the revised Payment Service Directive  (PSD2), the EU 
legislator aimed to enhance the role of public-private partnerships, both for increasing the awareness 
of the consumers to the current threats, as well as for supporting the law enforcement in investigation 
and prosecution in identifying the  frauds and collection of evidence. PSD2 also focusses on assurance 
of the consumers’ protection against unfair and misleading practices. In addition to PSD2 provisions, 
the Interchange Fee Regulation promotes adequate and effective out-of-court complaint and redress 
procedures in case of the settlement of disputes between payees and their payment service providers.  

On the same line, the Victims’ Directive also emphasises the need to improve the access of victims to 
their rights and assure adequate protection measures and this can be achieved by enhancing the 
cooperation between the relevant civil society organisations and public and private stakeholders.  

Relevant actions are taken by the Commission also in the area of fraud detection and reporting. PSD2 
gives the option for both the payment service provider (PSP) and the user to notify any loss, theft, 
misappropriation or unauthorised use of the payment instrument. In the case of a major operational or 
security incident, PSP shall, without undue delay, notify the competent authority in the home Member 
State of the payment service provider. In addition to this, the 4 th AML Directive aims to identify and 
follow -up with submission of reports any suspicious transfers of money, including on non -cash fraud 
and  counterfeiting  to  the  Financial  Intelligence  Units  (FIUs).  The  extension  the scope of the AML  
directive (currently under discussion) to virtual currencies exchange platforms and custodian wallet 
providers is aimed to assure a better regulatory framework (due  diligence) in situation of exchanging 
virtual for real currencies. 

126 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

7  POLICY  OPTIONS 

7.1  Approach  to the identification  of the policy options 

The following approach has been adopted:  

a)  Identification  of the possible  set of the policy m easures, in terms of : 

a.  delivery instruments,  including:  

 

 

 “non-legislative measures” , consisting in the use of soft law 390 for launching other 
supporting initiatives such as: a) improve the implementation of the FwD and b) provide 
a self-regulatory framework for public private cooperation; 
“legislative  measures”,  consisting  in  amending  the  existing  legislation  (the  FwD) or 
proposing new legislation; 

b.  scope and content  of the policy measures and alternative sub-measures; 

b)  Screening of the m easures, in order to retain the most viable ones.391 

c)  Description of the retained policy m easures and sub- m easures (see Annex 9). 

d)  Im pact  assessm ent  of  the  retained  policy  m easures  and  sub-m easures  in  both 
qualitative and quantitative terms (see Annexes 12 and 13). The assessment has been carried 
out according to the methodology presented in sections 8.1 and 8.2.  

e)  Selection of the preferred sub-m easures, to be included in the policy options; 

f)  Identification  of the policy options,  combining the policy measures and the preferred sub-
measures selecting the lev el of aggregration of the retained policy options, articulating them 
in basic options with a narrow scope targeting a specific set of provisions and issues. The 
content  of  the  basic  options  have  been  futher  articulated  in  Sub -measures,  consisting in 
(alternative) packages of measures. 

The figure below illustrates the identified policy measures for the EU Intervention and the articulation 
in further Sub-measures, distinguishing between non-legislative and legislative measures .  

390 The term "soft law" refers to quasi-legal instruments which do not have any legally binding force. 
391 The key criteria for screening the viability of the options have been: Legal feasibility; Technical feasibility; 
Previous policy choices; Coherence with other EU policy objectives; Effectiveness and efficiency; Proportionality; 
Political feasibility; Relevance. 

127 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment regarding possible options f or a future EU 
initiative in combatting fraud in and counterfeiting of non-cash means of payment 

Figure 4 - Full set of retained  policy measures and sub-measures 

Source: Authors’ elaboration 

128 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

On the basis of the impact assessment of the policy measures, the following policy options have been 
identified: 

 
 
 

 
 

Policy Option 0 “Status quo” (baseline scenario); 
Policy Option 1 “Soft law”, combining B1 and B2;  
Policy Option 2 “Revision of regulation in the area of criminal law and law enforcement 
cooperation”, combining C1.1, C2.1, C3.3 and B2; 
Policy Option 3 “New legislation”, combining C1.1, C2.1, C3.3, C3.4, C4.2 and C5.2;  
Policy  Option  3bis  “New  legislation  with  additional  provisions  for  cross-border 
cooperation”,  combining C1.1, C2.1, C3.1, C3.2, C3.3, C3.4, C4.2 and C5.2. 

The discarded options and measures are presented  in section 7.3.2. 

The identification and assessment of the sub-measure C3.4, as well as the review of the assessment of 
the sub-measure C4.1 hase been based on input provided by the Commission at the draft final review 
stage. 

7.2  Description  of the  policy options 

7.2.1  Policy option  0 - Status quo 

Current developments in MS would continue within the existing legal framework, which would remain 
unchanged and ongoing activities would continue. Coverage of new forms of crimes, approximation of 
the MS’ jurisdiction, cooperation between the private and the public sectors would depend on any 
autonomous developments inherent to the current system.  

In particular, to the current state of acquis, the FwD establishes a minimum level of approximation 
between MS in terms of definition, offences, jurisdiction, pe nalties, covering major forms of crimes 
such as card present frauds or offences to computers, ensuring they are sanctioned (at least in form) 
and imposing the standards for cooperation between MS. 

There have been since 2001 significant changes in the EU le gal framework in related areas, notably on 
preventive measures linked to increased resilience and greater security of payment systems, in terms 
of judicial cooperation and on victims’ rights through the victims’ directive. For example, certain parts 
of the activities of non-cash payment fraud offenders (e.g. hacking into a retailer’s data storage to 
steal  customers’  payment  credentials)  are  also  covered  under  the  directive  on  attacks  against 
information systems. As a result, parts of the problems outlined a bove are better addressed now than 
they were a few years ago. 

However, while the NIS Directive and the PSD2 will increase the security of financial transactions, it 
might reinforce the worldwide cross-border dimension of these crimes, or stimulate potentia l changes 
in criminal methods and in the types of fraud attempted in the EEA. In the absence of an initiative 
addressing  current  and  possible  future  criminal  conduct,  the  deficiencies  identified  in  respect  to 
effective application of sanctionatory regime a nd to enabling prosecution where prevention has failed 
are therefore likely to persist or increase. It would also leave some new payment instruments and new 
forms of crimes uncovered, provide no incentive to further exchange information between the MS, 
leave the private and the public sector without any guidance on how to co -operate to fight fraud and 
would not eliminate the existing data protection breaches. 

7.2.2  Policy option  1 - Soft law 

This option would combine the policy measures B1 and B2. 

Thus,  it  would  first  support  and  improve  the  implementation  and  enforcement  of  the 
Framework  Decision  and  of  the  complementary  EU  legislation (e.g. PSD2, Directive on attacks 
against information systems) (B1) and increase the capacity building of the LEAs. They could include: 

129 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

 

 

the  publication  of  a  third  implementation  report  on  the FwD alongside a guidebook 
explaining the legislative framework in each MS, highlighting best and good practices, to 
LEAs and other stakeholders, in order to facilitate cooperation; 
other  public  campaigns  on  the  provisions  of  the  FwD and of the complementary EU 
legislation and on best-practice; 
specific  activities  promoted  by  the  COM (e.g. guidelines, training courses, workshop 
events with country representatives and exchange of good practice and experiences) for 
ensuring  that  the  provisions  of  the  FwD and of the complementary EU legislation is 
utilised to their fullest extent and increasing capacity building of the LEAs, as well as of 
developed IT tools and human resources to LEAs. 

In  addition,  a  self-regulatory  framework for public-private cooperation (B2) between relevant 
actors from the financial services industry, LEAs and other stakeholders such as merchants would 
improve the cooperation, exchange of information and good practice between the p ublic and private 
sectors. 

Such public-private partnerships already exist in a number of MS, such as Action, Cifas and Financial 
Fraud  Action  UK,  for  facilitating  reporting  of  fraud  to  LEAs,  and  can  rely  on  existing  legislation 
governing  data protection and other issues but there is no dedicated framework governing other 
questions such as cooperation, such as liability, how to treat information shared, etc.  

Self-regulation could be envisaged at national or at EU level (or could include further countries). If 
created  at  the  national level, a self-regulatory model would allow for national solutions that take 
account of, for example, specific regulatory requirements in a MS.  

The  COM  could  incentivise  the  creation  of  such  public-private  partnership  through  a  dedicated 
Communication to LEAs and the Private sector in the MS. Data protection issues should however be 
paid  particular attention in order to get the stakeholders in the field of data protection on board. 
Indeed, they may be reticent to share personal da ta with more stakeholders, in particulare of other 
MS. Participants might themselves define the framework for their cooperation and determine which 
rules to apply 

This  Option  would  then  indirectly  improve  the  assistance to victims through a better cooperat ion 
between tha stakeholders and through an enhanced protection thanks to increased investigations and 
prosecutions. 

A main advantage of this Option is that investigations and prosecutions would be improved by a more 
harmonised and slightly more relevant framework for regulating the offences covered by the FwD and 
by a more effective and efficient public-private cooperation. This would be done without the existing 
public-private  partnerships facing any changes that might affect how they operate. However, th is 
option would not fully address new technological and criminal developments and therefore might not 
cover a rising portion of criminal activity and harm to victims in this field.  

7.2.3  Policy option  2 - Revision of the regulation  in the area of criminal law and law 

enforcement  cooperation 

This Option would combine the Policy measures C1.1, C2.1, C3.3, C3.4 and B2. 

The Option provides for an extended scope covering new forms of payments instruments, NCP frauds 
and  preparatory  and  supportive  conduct  through  a  broad  definition  of  payment  instrument  and 
offences  in  order  to  capture  all  possible  present  and  future  crimes.  It  would  also  facilitate  law 
enforcement  cooperation  through  imposing  and  suggesting  to  MS  specific  operational  actions  to 
implement  in  this  field,  as well as updating jurisdiction rules in coherence with the proposal for a 
Directive on attacks against information systems . However, only non-legislative initiatives would be 
taken by the COM in order to foster public-private cooperation through a self-regulated framework, 
which would indirectly enhance the assistance to victims, as already described in the Policy Option 1. 

130 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Specifically,  the  definition  of  payment  instruments  and  of  forms  of  crime  contained  in  the  new 
legislation would be based on the PSD2 (C1.1) which is the following: “‘payment instrument’ means a 
personalised device(s) and/or set of procedures agreed between the payment service user and the 
payment  service  provider  and  used  in  order  to  initiate  a  payment order”.  All MS comply with the 
definition  of  payment  instruments  included  in  PSD2.  Moreover,  it  has  been  taken  over, in similar 
terms,  by  25  MS  in  their  regulatory  framework  transposing  PSD2.  It has the advantage of being 
technology neutral, covering all the forms of value transfer identified in this report with the exception 
of virtual currencies and so, covering most of the forms of crime relating to payment instruments. This 
definition could, if required, be complemented with additional definitions (e.g. of e -money or virtual 
currencies) or adapted in order to make it even broader. 

However,  this  definition  could  leave  room for interpretation, making its concrete application more 
complex, creating the risk that the provision is interpreted in different ways depending on the MS. In 
particular, attention should be paid on the fact that some MS have a very specific criminal law and 
these broad definitions should ensure that all new forms of crimes are covered even in these cases. To 
mitigate this risk, a precise definition of list of forms of payment and forms of crime covered could be 
provided as examples and included in the recital of the revised legislation. 

In  order  to  further  extend  the  scope  of  application  of  the  revised  legislation  and reach a better 
approximation of the national criminal laws, this sub measure (C2.1) sets a lower limit for a maximum 
level of sanction, for conduct criminalised in the revised legislation which would include conduct which 
is supportive of or preparatory to NCP fraud. For example identity theft but also phishing, selling and 
buying card credentials or acting as a money mule is often preparatory or supportive to CNP fraud.  

Preparatory and supportive conduct would be criminalised and be covered with minimum levels of 
sanctions  independently  from  the  fact  that  the  payment  fraud  has occurred  or of whether it has 
generated financial losses for the victim. The effective enforcement of clear rules on data theft and 
trade  and  proportionate  criminal  sanctions  would  allow  to  better  combat  carding  websites  and 
complement the security and data breach rules to create better data protection.  

The strength of this Sub-measure is that it could allow the LEAs to reduce their costs to fight NCP fraud 
as  the  fraud  would  be  detected  and  punished  at  an earlier stage, before the case becomes too 
complex, requiring many resources in investigations. It would also have a deterrent effect. In addition, 
it raises the chances for the fraudster to be prosecuted because it raises the number of cases of 
detected fraud, which can be reported.  

Furthermore, this Sub-measure defends the interests of the victims of such preparatory or supportive 
conduct. Indeed, victims can have been troubled in their tranquillity, their honour could have been 
questioned  (as  covered  by  the  French  legislation  in  case  of  identity  theft)  and  can  suffer  from 
psychological damage, in particular when they are victims of social engineering techniques such as 
phishing. 

This  option  would  also  include  the  following  actions  for boosting reciprocal help between the MS 
(C3.3): 

 

 

collecting statistics on investigations and prosecutions of NCP offences. It could also help 
the Private sector to better prevent NCP fraud and so reduce the amount of charge backs 
they have to pay when their customers are victims of fraud; 
strengthening and clarifying the role of the dedicated contact points. Where possible, 
several contact points may be designated for a same MS, in order for them to specilise 
either on a type of offence or on a type of actor so that they would know the specificities 
of the stakeholders they represent or of the type of fraud they work on;392 

392 2nd EGM feeback: some representatives from both the private and the public sectors raised the need for clearly 
identified dedicated contact points. 

131 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

incentivising the MS to share information with Europol. 

In order to facilitate cooperation between national judicial authorities when several Member States 
claim  jurisdiction  over  the  same  case,  the  option  would also clarify rules for interpretation of the 
territoriality principle, and sets some information obligations (C.3.4). When Member States will assess 
whether the offence has been committed “in whole or in part within their territory”, they should also  
establish their jurisdiction where: 

- 

- 

the offender commits the offence when physically present on its territory, whether or not 
the offence is committed using computers or an information system on its territory; or  

the  offence  is  committed  using  computers  or  an  information  system  on  its  territory, 
whether or not the offender commits the offence when physically present on its territory. 

Moreover, Member States would be required to inform the Commission in case they decide to establish 
jurisdiction over an offence committed outside thier territory where (i) the offender has his or her 
habitual residence in their territory, or (ii) the offence is committed for the benefit of a legal person 
established in their territory. 

Therefore, the option would require the Member States concerned to cooperate in order to decide 
which of them will prosecute the offenders, w hen an offence falls within the jurisdiction of more than 
one Member State and when any of the States concerned can validly prosecute  on the basis of the 
same facts. The aim would be, if possible, to centralise proceedings in a single Member State. To this 
end, the Member States may have recourse to Eurojust in order to facilitate cooperation between their 
judicial authorities and the coordination of their action.  

The positive effects expected from a self-regulatory framework for public-private cooperation (B2) 
would be multiplied by:  

 

 

this extended scope of the revised legislation which would make sure that the PPP that 
would emerge or be supported thanks to this self-regulatory framework would tackle 
also new payment instruments and forms of crime; 
the  facilitated  cross-border  cooperation,  making  it  easier  for  these  PPP  to  involve 
stakeholders from different MS and better tackle cross -border frauds. 

7.2.4  Policy option  3 - New legislation 

This Option would combine the Policy measures C1.1, C2.1, C3.3, C3.4, C4.2 and C5.2. 

This Option would tackle of the issues identified through a new legislation. It would include the same 
measures as Option 2 in the field of criminal law, cross -border cooperation but would address also 
problems related to public-private cooperation and victims’ right with legislation solutions. 

Indeed, provisions to address obstacles to the establishment of Public-Private Partnerships (C4.2) 
would be included in the new legislation, they could include for example: 

 

 

 

creating a framework allowing for the sharing of personal information where required 
(for instance, for detecting high scale card frauds) subject to the necessary safeguards 
and applicable legal framework; 
addressing liability issues that may arise for the parties of the partnership as a result of 
the cooperation; 
facilitating the exchange of fraud-related threat intelligence between private actors. 

The  cooperation  between  public  and  private  sectors  should  aim  at  exchanging  a  wide  range  of 
information, such as fraud incidents and/or suspicious trans actions, modus operandi, and strategic 
information. 

132 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

This Option enables more efficient and effective investigations and fraud detection and empowers the 
Private sector, in particular banks, strengthening their cybercrime prevention strategies.393 Moreover, 
the  preventive  measures  taken  by the supervisory and self-regulatory bodies overseeing specific 
industry  sectors  (i.e.  from  a  regulatory,  oversight  and  control  perspective)  could  support  the 
identification of NCP fraud cases.  

Additional provisions on reporting of frauds, data breaches, modus operandi, and strategic information 
relating to NCP (C4.2) would also be included in the new legislation: 

 

 

setting clear and user-friendly reporting systems and mechanisms such as dedicated 
online platforms; 
incentivising the LEAs to communicate with the private sector and victims to help protect 
themselves against fraud. 

Facilitated  reporting  can make LEAs work more effective and more efficient. In particular, it would 
facilitate the obtention of the evidence  for each of the victims in cases of large scale card fraud with 
many victims, sometimes located in different countries, and in many different banks. 

Finally,  this  Option would include provisions for protecting natural and legal persons (in particular 
SMEs) (C5.2), both as primary and secondary victims, complementing those already contained in the 
PSD2  and  E-money  Directive,  in  particular  when  faced  with  identity  theft, which could include for 
example: 

  provisions enabling a better communication on the existence of the different types of 

non-cash payment frauds and the risky behaviour; 

  provisions aiming at improving the access to support services; 
  provisions aiming at protecting and guaranteeing a financial compensation even in case 
of scam of other social engineering techniques and so the victim has been tricked by 
fraudsters into making the transfer of funds; 

  provisions for protecting the victims from the consequences of a negative credit history 

due to a fraud. 

In this Option, a balance has to be found betw een data protection requirements and and improved 
exchange of information between the stakeholders. Indeed, information gathering and sharing required 
to  fight  crime  can  also  affect  the privacy and data protection rights of the victims or third parties 
where their personal data are concerned and so it is important to provide adequate safeguards in this 
field.  While  developing  this  Option,  it  will  also  be  necessary  to  keep  the  objective  not to create 
additional  heavy  administrative  burden  to  LEAs  due  to  increased  reporting  and  exchange  of 
information, which would have a counter-productive effect. 

7.2.5  Policy option  3bis - New legislation  and new procedural  rules  

This Option would combine the Policy measures C1.1, C2.1, C3.1, C3.2, C3.3, C3.4, C4.2 and C5.2. 

This  Option  corresponds  to  the Option 3 extended to other measures in the field of cross -border 
cooperation, in particular facilitating the exchange of the evidence across MS both for investigations 
and prosecutions. 

In more detail, it would include provisions: 

 

to complement the European Investigation Order (EIO) (C3.1)with measures adapted to 
NCP fraud; 

393 As a way of example, an evidence of the effectiveness of sharing information between the public and the private 
sector in the field of NC P is provided by the “European Money Mule Action Day” organised by Europol, which 
resulted in investigations and prosecutions. 

133 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

adapt the rules on injunctions 394 for cooperation/evidence purposes (C3.2). 

This Option would make the most of the existing cooperation mechanisms and go beyond them. 

It is noteworthy that the enhanced public-private cooperation (also in a cross-border environment) and 
cooperation  between  MS  expected  from  this  Option  will  reduce  the  need  to  the  cooperation 
mechanisms mentioned above. 

7.3  Rationale  of the identified  policy options  and options  discarded 

7.3.1  Rationale  of the identified  policy options 

The  identified  list  of  policy  options  gathers a selection of measures that have been selected and 
combined in order to best address each of the problems identified. The problem drivers, the problems, 
the objectives and the policy options as well as the links between these elements are summarised in 
Figure 5 to enhance the understanding of the overall rationale of the present impact assessment.  

In Figure 5, the continuous line arrows indicate the direct links between the elements while the dotted 
line arrows indicate those that are indirect. 

Figure 5 – Solution tree 

394 An injunction is an order granted by a court or an administrative body whereby someone  is required to perform 
or to refrain from performing a specific action. For example, under the Directive 2009/22/EC, injunctions are court 
proceedings, which allow qualified entities in a MS A to apply to the courts or administrative authorities in a MS B  
for measures that include an order to require the cessation or prohibition of any infringement of the consumers’ 
rights and interest, including victims, in the MS B under specific European protection measures.  

134 

 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

7.3.2  Options and measures  discarded 

In  addition  to  the  identified policy options, the other following options were considered but  early 
discarded on the basis of the preliminary screening: 

a)  Regulation: 

Through  this  legislative  instrument  the  EU  could  establish  a  definition  of  the  NCP  criminal  and 
procedural framework NCP. Within the scope of the Regulation there would be no variation between 
MS. National authorities would take care of monitoring and enfo rcement.  

Reasons for discarding: the use of a regulation appears to be not consistent with: 

  proportionality  principle395  and,  more  in  particular,  with  the  minimum  legal  constraint 
principle.  More  simple  forms  of  Community  action  are  possible  and  it  appears 
insufficiently justified in the light of the identified objectives  

  previous policy choices, in the light of the FwD. 

b)  Full harmonisation  of sanctions  for NCP crime 

This  option  would  introduce  the  same  level  of  sanctions  across  EU,  including  the  maximum  and 
minimum  levels of penalties for NCP crimes, as well as the minimum level of the minimum penalties. 

c)  Reasons for discarding: the option is not legally feasibile in the field of EU criminal law, which 
can  introduce  only  minimum  rules  concerning  the  definition  of  sactions  in  the  areas  of 
particularly serious crime with a cross-border dimension. Creating an EU database on fraud 
data 

This option would introduce an EU database to share information about fraud data including personal 
information. 

Reasons for discarding: the option would not be technically feasibile, since technological and technical 
constraints would not allow for its implementation, monitoring and/or e nforcement. Furthemore, the 
option would raise significant issues in terms of coherence with the EU Data Protection Directive, and 
protection of personal data. 

d)  Full harmonisation  of rights  of NCP crimes’ victims 

This option would introduce the same rights for NCP crimes’ victims across EU. 

Reasons  for  discarding:  the  option  would  not  be  politically  feasibile,  since  I  would  lead  to  an 
unacceptable levelling down of certain victims rights. 

In addition to the early discarded options presented above, the other following policy measures were 
discarded on the basis of the relative impact assessment (see Annexes 11 and 12): 

a)  Developing  detailed  minimum  common  definitions  covering  a  comprehensive  lists  of 
NCP  instruments  and  forms  of  crimes,  including  the  new  forms  of  NCP  instruments 
and frauds (C.1.2) 

As  compared  to  to  broad  and  technology-neutral  definitions  (C.1.1), this measure would be less 
effective in addressing the forms of NCP instruments a nd crimes that could arise in the next years, 
with  the  risk  of  of  becoming  outdated  in  a  short  time.  Furthemore,  it  would  create  issues  of 
consistency with the existing EU legal framework, especially with the definition of payment instruments 
included  in  the PSD2 Directive and in the Regulation on interchange fees for card -based payment 

395 “Under the principle of proportionality, the content and form of Union action shall not exceed what is necessary 
to achieve the objectives of the Constitution.” 

135 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

transactions.  This  would  also  lead  to  significant  administrative  costs  in  transposing  the  specific 
definitions at national level, since 25 MS already adopted the PSD2 definition. 

b)  Identifying  aggravating  circumstances  for  addressing  preparatory  or  supportive 
conduct  and  Setting minimum  levels of maximum  sanctions  for NCP fraud (C.2.2)  

As compared to the criminalisation of preparatory or supportive conduct (C.2.1), this measure could 
entail less administrative and financial costs for LEAs, especially those in MS applying the principle of 
legality,  because  preparatory  or  supportive  activities  will  not  be  investigated,  persecuted  and 
sanctioned as such. For the same reason, it would be much less effective in preventing and fighting the 
different forms of non-cash payment crimes, since LEAs would act only after the actual fraud occurred. 
Furthmore, it would neither grant any protection to the potential victims of the frauds, nor red uce 
significantly the risk for a consumer of being victim of fraud.  

c)  Adding  provisions  on  reporting  NCP  related  information  to  LEA,  imposing  obligations 

to fraud victims and private actors (C.4.1) 

As compared to voluntary reporting (C.4.2), the measure could be more effective in increasing the 
chances of detecting, prosecuting and sanctioning perpetrators, since a much higher number of cases 
will be reported to LEAs, that would rely on a much higher volume of information given the mandatory 
nature of reporting. However, these benefits are likely to be outweighted by the dramatic increase of 
the administrative and financial costs borne by LEAs, especially those in MS applying the principle of 
legality, and especially by the private sector and the citizens, that will have an obligation to report 
suspect cases, incidents and frauds.  

8  ANA LYSIS  OF IMPA CTS  OF EA CH  POLICY OPTION 

This section presents the assessment of the policy options identified with respect to a set of criteria 
and formulates a judgment on the expected impacts of each of them. This analysis forms the basis for 
the comparative assessment and ranking of the various policy options. 

The section starts with the identification of the likely economic and social impacts, carried out through 
the structuring of an impact causal model, and the definition of a set of criteria against which the 
policy options will be assessed. 

8.1 

Impact  Identification:  the impact  causal model 

The purpose of this step of the Impact Assessment is to predict potential consequences that can arise 
as a result of the policy options identified, across the main policy dimensions involved and the main 
targeted  groups.  The  aim  is  to  consider  a  wide  range  of  possible  impacts,  in  order  to  give  a 
comprehensive picture of the potential effects  -both intended and unintended, positive and negative – 
of each policy option. 

The approach used in identifying impacts has been based on the structuring of a causal model, as a 
“bottom-up exercise” that starts with the identification of the impacts that wo uld arise as a result of 
the policy attaining its set objectives. These initially identified impacts then have formed the basis for 
identifying further rounds of impacts, and so on. Therefore, the links between different policy options 
and  the  impacts  considered as well as the link between the impacts have been investigated and 
represented through the development of the impact causal model. 

This set of impacts will form the basis for the assessment of each policy option and the comparison of 
the options against each other.  

In the context of the present study, this approach allowed for the investigation of the way in which the 
elements of a possible EU intervention in the combatting non-cash payment fraud (i.e. extension of the 
scope  of  criminal  offences,  initiatives  to  incentivise   public-private  cooperation)  can  affect  the 

136 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

dimension of crime and the investigations and prosecutions of NCP frau ds, generating economic and 
social impacts on the various categories of stakeholders. 

The figure that follows illustrates the map of the impacts identified and the cause -and-effect linkages 
between each of the policy options/instruments and their impacts. 

Particular attention has been paid in identifying specific impacts on different categories of stakeholders 
and Member States. 

Figure 6 - Impact  causal model 

Authors’ elaboration 

The intermediate impacts identified have been also  analysed together through the assessment of 
aggregated impacts as shown in the figure above. 

8.2  Assessment  criteria 

For assessing of each policy option identified and formulating a judgment on the expected success of 
each of them, the following set of criteria has been developed:  

Assessment 
criteria 

Coherence 

Rationale  for the assessment 

Internal coherence with the strategic objectives of the Intervention: 

  Reinforcing the trust of consumers in the digital single market and ensuring 

compliance with data protection legislation. 

137 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

  Addressing new and evolving forms of NCP fraud, to decrease its occurrence 

and deter potential criminal activities  

External coherence with relevant existing EU legislation: 

  TFEU 
  Revised Payment Service Directive (PSD2); 
  Directive on attacks against information systems; 
  Directive on counterfeiting of euro; 
  Regulation on interchange fees for card-based payment transactions; 
  NIS Directive; 
  The 4th AML Directive; 
  EAW Framework Decision; 
  EIO Directive; 
 
Injunction Directive; 
  Victim’s Rights Directive; 
  Directive  (EU)  2016/680  on  processing  of  personal  data  by  competent 
authorities for prevention, investigation, detection or prosecution of criminal 
offences or the execution of criminal penalties  

  General Data Privacy Regulation 
  Regulation (EU) 2016/794 on Europol 
  Decision 2009/426/JHA on the strengthening of Eurojust 
  2000  Convention  on  Mutual  Assistance  in  Criminal  Matters  between  the 

Member States of the European Union 

Effectiveness  Economic impacts: 

 

Intermediate impacts: Increasing consumption and trade flows due to higher 
consumers’  trust  in  digital  purchases  of  goods  and  services;  Increasing 
consumer  choice  due  to  reduction  of  frauds;  Increasing  cost -savings  for 
economic operators (i.e. financial services providers, retail goods or services 
providers) that are the victims of fraud. 

  Aggregate impacts: Better functioning of the digital market and competition; 

Economic growth and employment. 

Social impacts: 

 

Intermediate  impacts:  Increasing  law  enforcement  capacity  to  address 
criminal activity relating to new forms of non-cash payment frauds; Increasing 
chances  of  detecting,  prosecuting,  and  sanctioning  criminals;  Decreasing 
number of criminal acts and organised crime gains relating to new forms of 
non-cash  payment  frauds;  Increasing  protection  for  victims  of  non -cash 
payment  fraud;  Stronger  cooperation  between  public  institutions/private 
sector. 

  Aggregated  impact: Improvement of security 
Financial  and  administrative  costs:  one-off  and continuous costs for public and 
private sectors 

Simplification  benefits  for  businesses/citizens,  and  for  national/regional/local 
administrations. 

Personal data protection;  

 
  Right to liberty and security 
 
  Consumer protection. 
  Right to an effective remedy, in particular the remedies available before the 

Freedom to conduct business;  

courts 

138 

Efficiency 

Fundamental 
rights 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Added 

EU 
Value 

Description of additional benefits resulting from an EU Intervention compared to 
what could be achieved by Member State action only (e.g. relating to the cross -
border dimension of the phenomenon) 

8.3  Qualitative assessment  of the policy options 

Source: Authors’ elaboration 

The assessment of policy options is carried out with respect to the policy objectives, the expected 
impacts as well as other issues influencing EU action where the proposal of legislative instruments is 
concerned.  

The assessments of policy options are presented in the tables below. The assessment grids are divided 
into five sections, each of them reporting the analysis relating to the assessment criteria (and sub -
criteria).  

Table 15 – Assessment of policy options 

Descriptor 

Score396 

Explanation 

Significant 
positive impact 

+2.5  and 
+3.0 

This  score  was  assigned  when  the   magnitude of impact was highly 
positive (for example, when the option was likely to result in substantial 
cost savings for firms, much better protection of victims, much broader 
scope for law enforcement, etc.) 

Moderate 
positive impact 

+1.5  and 
+2.0 

This  score  was  assigned  when  the  magnitude  of  impact  was  fairly 
positive (for example, when impacts were still considerable but less far 
reaching, narrower in scope, etc.) 

Small positive 
impact 

+1 

This score was assigned when the magnitude of impact was posit ive 
(for example, where results were less certain or they were indirect) 

No impact 

+0.5, 
and -0.5 

0 

This  score  was  assigned  when  the  magnitude  of  impact  was  very 
uncertain, insignificant, or no change was expected  

Small negative 
impact 

-1 

This score was assigned when the magnitude of impact was negative  

Moderate 
negative 
impact 

Significant 
negative 
impact 

-1.5  and  -
2 

This  score  was  assigned  when  the  magnitude  of  impact  was  fairly 
negative 

-2.5  and  -
3 

This  score  was  assigned  when  the  magnitude of impact  was highly 
negative 

Source: Author’s elaboration. 

An advanced assessment of each policy option was carried out accordingly to the scoring system 
described below. A scoring system to assess each intermediate impact used the following scale: 

The following intermediate economic impacts have been assessed: 

396 Additional granularity of scores was introduced (half-points) to mark sometimes marginal differences of a given 
intermediate impact, when compared with the same impact in Status quo or the Sub-measure. 

139 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

 
 

Increasing  consumption  and  trade  flows  due  to  higher  consumer  trust  in  digital 
purchases of goods and services; 
Increasing consumer choice due to reduction of frauds ; 
Increasing cost-savings for economic operators (i.e. financial services providers, retail 
goods or services providers) that are the victim of the fraud. 

The overall score for economic impacts is an average score of intermediate economic impacts.  

The overall score for social impacts is an ave rage score of intermediate social impacts: 

 

Increasing law enforcement capacity to address criminal activity relating to new forms of 
non-cash payment frauds;  
Increasing chances of detecting, prosecuting, and sanctioning criminals;  

 
  Decreasing number of criminal acts and organised crime gains relating to new forms of 

non-cash payment frauds;  
 
Increasing protection for victims of non-cash payment fraud;  
  Stronger cooperation between public institutions/private sector. 

The  same  applies  to  fundamental  rights  impacts  (see  the  Table  above).  The  average  scores  for 
economic,  social and fundamental  rights impacts  were rounded up to the nearest half-points (see 
Annex 12). 

The  following  sections  of  the  report  present  the  average  scores  for  economic,  social  and 
fundamental rights impacts. Please see Annex 11 for detailed assessments and individual scores. 
Better  Regulation  guidelines  (2015)  require  an  assessment  of  environmental  impacts.  The 
evaluation results did not indicate any implications of the FwD for environment  and in the assessment 
of environmental impacts of the policy options were not considered significant. 

Some policy options could imply some trade -offs and thus have both positive and negative impacts 
with regard to an assessment criterion (e.g. setting an obligation to the victims and the private sector 
could allow LEAs to have relevant information for efficient investigations, reducing costs but at the 
same time would increase their costs as it may raise the number of investigations they will have to 
launch). 

A synthesis of the consulted stakeholders’ perspectives and opinions is also provided for each specific 
policy  option.  Where  contrasting  views  on  a  particular  policy  option  were expressed by different 
stakeholders, this is explicitly stated. The evaluation team also notes that consulted stakeholders 
rarely commented on every single policy option – often their views were limited to a few (or only one) 
policy option. As a result, some options were commented more than others and often the views were 
contradictory. For this reason comparing the number of stakeholders who shared their opinions on 
different options need to be treated with extreme caution, and this evidence should be regarded as 
qualitative in nature. 

Finally, each Sub-measure has been assessed separately. Consequently, the overall impacts of the 
basic provisions of each policy option have been assessed together with those of the Sub -measures. 

The impact assessment methodology requires the report to include certain elements of the analysis . 
These were framed under different assessment criteria and were examined for each policy option:  

  Description of the social and economic impacts – this is provided in Sections 7.3.1-7.3.8 
under  ‘Effectiveness.  A  detailed  assessment  is  provided  in  Annex  12 in worksheets 
dedicated to each policy options A-C5.1 (rows 7-19 in each worksheet). 

  Description of who will be affected by the initiative and how – this is provided in Sections 
7.3.1-7.3.8 under ‘Effectiveness’. An explanation on which stakeholders will be affected 
and how is provided in Annex 12 in worksheets dedicated to each policy options A-C5.1 
(columns J-S and rows 7-26 in each worksheet). 
Impacts  on  SMEs  –  this  is  presented  in  Sections  7.3.1-7.3.8  under  ‘Effectiveness  / 
Economic Impacts’ and under ‘Efficiency/Financial and administrative costs’. A detailed 

 

140 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

 

assessment is provided in Annex 13 in worksheets dedicated to each policy options A-
C5.1 (column J and rows 9 and 26 in each worksheet). 
Impacts on competitiveness – the evaluation team examined the impact on the better 
functioning  of  the  digital  market  and competition. This is provided in Sections 7.3.1 -
7.3.8  under  ‘Effectiveness/Eco  Economic  Impacts/Aggregated  impacts ’.  A  detailed 
assessment is provided in Annex 13 in worksheets dedicated to each  policy options A-
C5.1 (row 10).397 

  Description of the consultation strategy and the results obtained from it – the description 
of the strategy is provided in the Introduction (Methodological approach) and the results 
are presented in Sections 7.3.1-7.3.8 under ‘Stakeholders and experts view’. 

397 As impacts on competitiveness was considered as an aggregated effects of intermediate impacts (see the impact 
causal model above) the aggregated scores for competitiveness were re -scaled to reflect the descriptors used in the 
remainder of the analysis (i.e. significant, moderate, small, no impact). The re -scaling assumptions are provided in 
Summary worksheet in Annex 13. 

141 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

8.3.1  Policy option  0 - Status quo 

A Status Quo – Status quo 

Assessment criteria 

Description of the impacts and affected groups  

Score 

Internal 
(Relevance) 

Maintaining the status quo is unlikely to address either of the 
two strategic objectives. 

0 

Coherence 

External  

Maintaining the status quo is unlikely to raise specific issues 
since the FwD is already coherent with the main EU legislation 
dealing with NCP frauds and counterfeiting (see Section 3.4). 
At  the  same  time,  neither  additional  synergies  nor  mutual 
reinforcing effects can be expected.  

+0.5 

Effectiveness 

Economic 
Impacts 

and 

private 

individual 

consumers 

for  which  European 

A steady increase in number and value of NCP transactions –a 
proxy for consumption and trade flows- is likely to continue 
at the same incremental pace (+1). The stakeholders affected 
include 
sector 
representatives. 
Consumer  choice  may  decrease  because  of higher  risks of 
being victims of fraud398 due to increasing use of cards and 
increasing value of fraudulent card transactions over the last 3 
level  data  are  available 399 
years 
(correlation of 0.8 between the value of card payments and of 
card fraud). However, it is uncertain if the value of NCP fraud 
will  continue  to  grow,  once the PSD2 is fully implemented 400 
and with new fraud detection technique s in operation.401 Also, 
the  main  target  of  card  fraud  shifted  from  consumers  to 
payment  industry  so the effects on individual customers are 
likely 
small  
(-1). 
The costs for economic operators are expected to increase 
(rather than fall) due to better protection needed against new 
forms  of  crime.  Because  payment industry became the main 
target of fraud, and because EOs and SMEs in particular will 
bear most of the costs, the impact is likely to be moderate (-
2). 

be 

to 

-1.5 

398 The link between consumer anxiety about fraud and reduced levels of expenditure/consumer choice is not well 
established. While people who feel are concerned about the risk of fraud would likely to continue engaging in NC P 
transactions, they may avoid new or unknown firms (or those that do not have good strong customer ratings) and 
that might reduce competition and to some extent their choice. Indeed, fraud exposes the individual to financial 
losses and negative credit ratings and so may deter the consumer from using these unknown websites. 
Furthermore, high risk of fraud may deter consumers from purchasing online or through other relevant sales 
formats relying on NCP instruments, reducing its choice. 
399 Although these data are dated (and more recent analysis are provided by national fraud observatories, such as 
Observatoire de la Sécurité des Cartes de Paiements and Final Fraud Action UK), the evaluation team decided to 
rely on EC B C ard Fraud Reports which provides aggregated data for the EU. 
400 See for instance a view of the European C onsumer Organisation (BEUC) on the security of payments under the 
revised Payment Services Directive: <http://www.beuc.eu/publications/beuc-x-2017-
012_mgo_security_of_payments_under_the_revised_payment_services_directive.pdf > 
401 <https://www.ecommerce-europe.eu/app/uploads/2016/09/Suggestions-to-improve-European-Online-
Payments-Regulation.pdf> 

142 

 
 
                                                 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Looking at aggregated impacts: 
NCP transactions will facilitate digital purchases of services and 
goods thus improving functioning of the digital market and 
competition  but the growing level of fraud and its costs borne 
by consumers and EOs are likely to prevail and their impact is 
likely to be negative and moderate. 
By making it easier, faster and cheaper to make transactions, 
some  gains  for  economic  growth  and  employment  can  be 
expected but likely to be outdone by increasing level and costs 
of fraud -moderate negative impact. 

The  Status  quo  is  expected  to  have  no  impact  on  LEAs’ 
capacity  to  address  criminal  activity  (0).  This  is  because 
their capacity is related to the level of reporting required which 
is likely to remain the same. 
The  chances  of  detecting,  prosecuting  and  sanctioning 
criminals  are  expected  to  be  unchanged.  No  impact  is 
expected  (0).  This  is  because  barriers  such  as  inadequate 
provisions/discrepancies  in  addressing  NMP,  new  forms  of 
fraud,  discrepancies  in  provisions  establishing  competent 
jurisdiction and in rules on extradition are likely to remain in 
place.  
The  number  of  criminal  acts  and  organised  crime  gains 
are expected to continue rising and the impact is likely to be 
moderate  (-2).  This  is  because  payment  card  fraud  is  still 
considered low risk and highly profitable criminal activity, and 
fraudulent  transactions  more  broadly  are  on  the  rise.  The 
stakeholders affected include individual consumers and private 
sector representatives. 
The  level  of  protection  for  victims  of  NCP  fraud  is  likely to 
stay  the  same  –  no  impact  is  expected  (0).  Deficiencies  in 
ensuring  a  satisfying  level  of  protection,  no  provisions 
protecting victims of identity theft and insufficient information 
for  victims  of  fraud  crime,  which  without  further  action  will 
remain in place. 
The  level  of  cooperation  between  public  institutions  and 
private  sector  is  likely  to  remain  the  same  –  no  impact  is 
expected (0). This is because without additional incentive so 
far  only  a  few  PPP  were  established  and  aimed to address 
exclusively NCP frauds. 
Looking at aggregated impacts: 
The  increasing  number  of  criminal  acts  and  organised crime 
gains are likely to have moderate negative impact on security. 

Maintaining a status quo in this area, the administration burden 
is expected to be largely unchanged. An increased number of 
fraudulent  transactions  is  likely  to  lead  to  a  higher  level  of 
reporting. Since the change is negligible, no quantification is 
provided. 

Social 
impacts 

Financial and 
administrativ
e costs 

Efficiency 

Simplificatio
n benefits 

No impact. 

Fundamental rights 

As regards the impact of this measure on fundamental rights, it 
is  likely that with the status quo scenario, the perception of 

143 

-0.5 

0 

0 

0 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

security will remain largely the same. 
Particular attention should be paid to the right to the protection 
of personal data (Article 8 of the EU Charter), considering that 
identity  theft  is  a  criminal  conduct  can  be  preparatory  or 
supportive to NCP frauds and it is increasing. 
The FwD does not explicitly refer to personal data protection. 
However, the protection of personal data is ensured currently 
through the application of the Charter of Fundamental Rights of 
the EU, the Directive 95/46/EC (that shall be replaced by the 
Regulation  (EU)  2016/679  starting  with  May  2018)  and  the 
Framework  Decision  2008/977/JHA  within  the  scope of their 
application.  There  was  a small reduction in perceived risk of 
cybercrimes  over  time  measured  as  a  share  of  population 
concerned about experiencing identity theft (from 61% in 2012 
to 52% in 2013) (Eurobarometer 2013).  
Despite this, personal data continues to be stolen and used for 
fraudulent NCP transactions. This is likely to continue without 
EU action and bear economic and social costs explained above.  
There is a small reduction in perceived risk of cybercrimes over 
time  measured  as  a  share  of  population  concerned  about 
security  of  online  payments  (from  38%  in  2012  to  35%  in 
2013)  (Eurobarometer  2013).  Still,  this  forms  a  significant 
proportion of the population who is more reluctant to engage in 
NCP (considered as lost opportunity). 
With  no  further  EU  action,  the  level  of  consumer protection 
(guaranteed by Article 38 of the EU Charter) is likely to remain 
the same. As noted above, there are no provisions in the FwD 
ensuring  a  minimum  level  of  protection  for  victims  of  NCP 
frauds  and  a  minimum  level  of  penalties  and  sanctions  for 
fraud criminals. 

EU added value 

No impact. 

0 

Stakeholders  and  experts 
view  

Interviews: 
Only one interviewee considered this option to be the best one (P). 
Focus group: 
None of the participants explicitly favoured this option. 
Open consultations: 
Only two respondents from trade, business or professional associations, 
two  from  International  or  national  public  authorities  and  one 
respondent  from  private  enterprises  considered  that  EU  legal 
instruments already provide a precise definition of non-cash means of 
payment, thus no change is needed. Similarly, three respondents from 
International or national public authorities considered that current EU 
legal instruments provide precise definitions of offences.  

144 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

8.3.2  Policy option  1 - Soft law 

Policy option 1 – “Soft law”, including: 

 

Implementation and enforcement of the FwD and of the complementary EU legislation  also 
through the increase of the capacity building of the LEAs (B1) 

  EU communication for facilitating self-regulatory framework for public-private cooperation (B2) 

Assessment criteria 

Description of the impacts and affected groups  

Internal 
(Relevance) 

Coherenc
e 

External  

Effectiven
ess 

Economic 
Impacts 

Improving  implementation  and  enforcement  of  the FwD (B1) 
can address the objective of decreasing the occurrence of NCP 
frauds, even if new forms of crimes will not be addressed at EU 
level. 
A self-regulatory framework for public-private cooperation (B2) 
can address the objective of reinforcing the trust of e conomic 
operators in the digital single market, being more involved in 
detecting and contrasting NCP frauds. It could also affect the 
trust of consumers, but mostly indirectly.  
Taking into account that measures under this option would not 
be  legally  binding,  the  overall  im pact  is  likely  to  be 
positive, yet sm all (+1). 

Providing guidance on how to implement the FwD (B1) also in 
synergy  with  the  PSD2,  the  Directive  on  attacks  against 
information  systems,  the  NIS  directive  and  the  Directive 
on victims’ rights  would improve their enforcement. Providing 
adequate training to the relevant authorities on cybercrime and 
on how to provide better access of victims to their rights would 
also  improve  the  enforcement  of  the  Directive  on  attacks 
against  information  systems  and  of  the  Directive  on 
victims’ rights. 
Facilitating  a  self-regulatory  framework  for  public-private 
cooperation  (B2)  would  be  complementary  with  the  EU 
legislation aiming to improve public-private cooperation, such as 
: 

 

 

 

the  Directive  on  attacks  against  information  systems 
which  also  aims  to  raise  the  awareness  of  SMEs  about 
threats and vulnerabilities to such attacks; 
the NIS Directive which also envisages close cooperation 
between designated authorities and DPAs; 
the Directive on victims’ rights, in the field of consumer 
awareness. 

  Taking into account that measures under this option would 
not be legally binding, the overall im pact is likely to be 
positiv e, yet sm all (+1). 

Improved implementation and enforcement of the  FwD, PSD2 
and  e-money  directive  (B1)  are  expected  to  bring  results 
similar to PO 0: moderate increase in consumption and trade 
flows  (+1.5).  This 
is  due  to  training,  guidelines  and 
communication campaigns to raise awareness of NCP fraud and 
good  practice  in addressing it that could positively affect the 
business climate. Additional limited positive effects in terms of 

145 

Scor
e 

+1 

+1 

-1 

 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

awareness  and  business  climate  can  arise 
from  the 
establishment of PPPs facilitated by self-regulatory framework 
for public-private cooperation (B2).  
The stakeholders affected are individual consumers and EOs. 

The  risk  for  consumers  of  being  victims  of  fraud  is 
expected  to fall slightly due to the campaigns and reinforced 
investigations  and  prose cutions  (B1)  and better information 
sharing  through  PPPs  (B2),  with  marginal  improvements  of 
consumer choice. However, the level of fraud is likely continue 
to  grow  because  many  areas  (including  New  Methods  of 
Payments and new forms of crime) remain  unregulated at EU 
level, yet this trend is expected to be marginally slower than in 
PO  0:  negligible  impact (-0.5). The stakeholders affected are 
individual  consumers. 
More benefits in form of cost savings to EOs can be expected 
compared to PO 0, given that new PPPs (B2) would include a 
representative from the private sector. As such, the position of 
EOs  is  expected  to  be  better  protected  possibly resulting in 
lower costs of protecting against fraud. The expected impact is 
moderate  (-1.5).  The  stakeholders  affected  are  EOs,  in 
particular big companies as SMEs may be unrepresented in new 
PPPs. 

likely 

Looking at aggregated  im pacts: 
The level of fraud and its cost for individual consumers and EOs 
is 
increasing 
to  be  somewhat  compensated  by 
consumption  and  the  ov erall  im pact  on  functioning  of  the 
digital  m arket  and com petition is expected to be negligible 
yet negativ e. This, coupled with additional administrative and 
financial  costs  (see  Efficiency  below),  is  expected  to  have 
m oderate  negative  im pact  on  econom ic  growth  and 
em ploym ent. 

Overall  econom ic 
negative 

im pact  of  the  option:  sm all  and 

Compared  to  PO  A,  LEAs’  capacity  to  address  criminal 
activity  is  expected  to  increase  through  training  courses, 
guidance,  tools  and  campaigns  (B1)  and  their  possible 
participation  in new PPPs (B2) along other stakeholders and 
gaining  access  to  (better)  information  and  good  practice. 
However,  LEAs  capacity  of  addressing  and  prosecuting  new 
methods  of  fraud  will  be  still  limited.  The expected impact is 
small  (+1).  The  stakeholders  affected  are  LEAs,  judicial  and 
judicial cooperation representatives, and the legal profession. 
The  chances  of  detecting,  prosecuting  and  sanctioning 
criminals are also expected to increase through training (B1) 
and  better  collaboration  between  public  and  private sectors 
(B2),  although  these  will  still  be  limited  to  current  legal 
provisions. The expected impact is small (+1)  but it fares better 
than PO 0. The stakeholders affected are LEAs, judicial and legal 

+1 

146 

Social impacts 

 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

profession, individual customers, victims’ associations, national 
bank federations, and EOs. 
The  number  of  criminal  acts  and  organised  crime  gains 
related to of NCP fraud (especially the new forms) are expected 
to be only marginally lower than in PO A: small impact (-1). The 
stakeholders affected are private sector representatives (EOs) 
and individual customers. 

The level of protection for victims of NCP fraud compared to 
PO  A  is  likely  to  improve:  small  impact  (+1).  This  is  due  to 
enforced detection, prosecution and sanctioning (B1), as well as 
improved  assistance  to  victims  through  better  cooperation 
among  interested  entities  (B1  and  B2).  The  stakeholders 
affected are consumers and EOs. 
The  level  of  cooperation  between  public  institutions  and 
private sector is likely to improve thanks to the self-regulatory 
framework. The impact is expected to be moderate/significant 
(+1.5/+2),  depending on the take up. The stakeholders affected 
are LEAs, private sectors representatives, banking federations, 
victim  associations, EU institutions and PPP. 

Looking at aggregated  im pacts: 
Improved  collaboration  between  public  and private sectors (B2) 
and  capacity  to  address  NCP  fraud,  together  with  enforced 
prosecution (B1) are expected to lead to sm all im provem ents 
of security .  

Overall social im pact of the option: sm all and positive 

The administration burden is expected to be higher than in PO 
0, but very limited given that the legal basis for prosecuting the 
fraud cases will remain unchanged.  
The main costs will consist of: 

  one-off  costs  for  the  EU:  publication  of  the  3rd 
implementation  report;  publication  of  a  guidebook  on 
national legislation to foster collaboration (B1), develop 
and publish the communication (B2); 
for 

interested  public  and  private 

  one-off  costs 

Efficiency 

and 

Financial 
administrative 
costs 

 

 

stakeholders to set up PPP agreements (B2); 

continuous  (though  very 
stakeholders to participate in these agreements (B2); 

limited)  costs 

for  these 

-1 

continuous  costs  for  EU:  training  courses  or  workshop 
events  with  country  representatives  and  LEAs;  public 
campaigns  to  increase awareness of current provisions 
and good practice; other activities to help LEAs develop IT 
tools and human resources (B1). 

Given that MS and stakeholders are not required to implement 
the measures of the option, it is not possible to assess to which 
extent these actions will be taken up. 

Overall im pact: sm all and negative 

147 

 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Simplification 
benefits 

The  proposed  option  is  unlikely  to  lead  to  a  further 
approximation of different national approaches or developing a 
single  procedure  for  all  MS  in  case  of  cross -border  cases. 
However,  information  about  these  differences  will  be  better 
available and shared. 
On  the  other  hand,  self-regulatory  frameworks  (B2)  may 
actually increase the lack of legal certainty a round the issues 
left out for self-regulation, especially if interpretations among 
different PPP agreements at the national level will differ. 

-0.5 

Overall im pact: no im pact 

As  regards  the  impact  of  this  policy  option  on  fundamental 
rights,  only  minor  improvements  in  the  consumer  protection 
(Article 38) can be expected due to reinforced prosecution of 
NCP fraud crimes (B1), although the unchanged material scope 
of the legislation limits the magnitude of this impact. 
Despite current provisions for data protection guaranteed by 
Article  8  of  the  EU  Charter  (Directive  95/46/EC  and  the 
Framework Decision 2008/977/JHA), personal data continues to 
be stolen and used for fraudulent NCP transactions. This is likely 
to continue (B1, B2). 
Nevertheless,  an  improved  capacity  of  the  law  enforcement 
authorities will conduct to a better assessment of the criminal 
offence  and  will  safeguard  the  principle  of  legality  and 
proportionality in criminal matters. It is important that the LEAs 
actions  to  consider  an  improvement in the application of  the 
victims’ rights in respect to the criminal proceeding (rights when 
making  a  complaint,  when  the  victims  request  information 
about their case, right to be heard, right to review a decision 
not  to  prosecute,  right  to  be  protected  in  the  context  of 
restorative justice). A more consistency is needed in assuring 
the right to a fair trial both for victim  and perpetrator, as well as 
on the assurance of the presumption of innocence and right of 
defence for the accused person and on the right not to be tried 
or punished twice, as stated in the EU Charter. 

In  addition,  the  establishment  of  PPPs  (B2)  may  potentially 
raise issues related to data protection (such as the sharing and 
processing of personal data). 

0 

Overall im pact: no im pact 

Better sharing information and good practice, guidance, training 
and  communication  campaigns  (B1)  is  expected  to  facilitate 
collaboration in cross-border cases, compared to the Status quo 
scenario, and it is unlikely to be achieved at the same scale by 
MS acting alone. However, the magnitude of this added value is 
likely to be limited (to the material scope of current legislation). 
It is not clear how effective the COM communication will be in 
incentivising voluntary PPP agreements (B2). In addition, given 
that  a  number  of  such  agreements already exist, the added 
value of the communication is likely to be quite limited. Where 

+0.5 

148 

Fundamental rights 

EU added value 

 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Stakeholders  and  experts 
view  

the  value  could  be  still  added  is  the  governance  of  such 
agreements  in  terms  of  e.g.  liability,  management of shared 
information. 

Overall im pact: no im pact 

Interviews: 
Two interv iewees favoured B1 and were of the opinion that the FwD 
should be kept as is but its implementation and enforcement should be 
improved  (L,  M).  In  particular,  they  pointed  to  the  need  for  better 
information about differences in legislation between MS (L). Only one 
interviewee did not see areas for improvement, although they were 
speaking for their own country’s perspective (AE). 
Two  interviewees  favoured  B2  and pointed to the need for better 
cooperation across MS (M) and for a cultural change (AC), rather than 
new legislative solutions. In addition, one interv iewee recognised the 
need for better sharing of information which would be facilitated by this 
option (L). 

Focus group: 
One  participant  suggested  that  current  problems  could  be  due  to 
incomplete implementation of the FwD or to an imperfect application of 
the existing framework. 
One  participant  suggested  that  the  current  legal  framework offers 
many opportunities to co-operate across MS but these were not take up 
by MS. 

Open consultations: 
As  for  the  implementation  and  enforcement  of  the  FwD,  nine 
respondents from private enterprises pointed that it’s necessary to have 
more similar definitions of non-cash means of payment in criminal law 
across the EU. Similarly, seven respondents from private enterprises 
stressed the need for more coherent definitions of NCP offences. Non-
governmental organisations (platform or network) underlined that there 
are  still  diverging  levels  of  security  requirements  to  be  applied 
depending on the non-cash payment means.  
In total, 19 respondents underlined that different levels of penalties 
across EU MS may result in different prioritisation of cases at national 
level,  hampering  cross-border  cooperation.  Finally,  12  respondents 
from private enterprises stressed that such differences may create “safe 
havens”  for  criminals  while  three  other  respondents  from  trade, 
business or professional associations underlined that such differences 
may create insufficient deterrence  (B1). 
One respondent from private enterprises pointed to the lack of relevant 
tools  and  channels  to  allow for a proactive exchange of information 
between public and private sectors and hindering the industry capacity 
to respond to fraudulent activities. In this sense, secure channels would 
radically benefit the security and stability of the financial system as a 
whole (B2). 

149 

 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

8.3.3  Policy option  2 – Revision of the  regulation  in the area of criminal  law and law 

enforcement  cooperation 

Policy option 2 – “Revision of regulation in the area of criminal law and law enforcement cooperation”, 
combining: 

  Developing broad minimum common definitions covering new forms of crime and building on 
the PSD2 definition of payment instrument, if required, completing it to cover the new forms of 
value transfer (C.1.1) 

  Criminalising  preparatory  or  supportive  conduct  and  setting  minimum  levels  of  maximum 

sanctions for both NCP fraud and preparatory/supportive conduct (C.2.1) 
Facilitating operational law enforcement cross -border cooperation (C.3.3) 

 
  Updating jurisdiction rules in coherence with the proposal for a Directive on attacks against 

information systems (C.3.4) 

  EU communication for facilitating self-regulatory framework for public-private cooperation (B2) 

Assessment criteria 

Description of the impacts and affected groups 

Score 

Internal 
(Relevance) 

As compared to PO 1, this option can better responds to both 
strategic objectives: 

 

firstly,  broad  minimum  common  definitions  (C.1.1)  and 
minimum  sanctions (C.2.1) would address different forms 
of fraud, including new and emerging ones, cross -border 
crimes  (C.3.3  and  C.3.4),  and  preparatory  activities 
(C.2.1); 

+2 

  secondly, by addressing these types of fraud and conduct, 
this  option  would  raise  consumers'  and  economic 
operators’  trust  in  NCP  transactions  and  digital  single 
market. 

Overall im pact: m oderate and positiv e 

Coherence 

External  

replicating 

information  systems, 

This  option  would  any  be  consistent  with  the  definition  of 
payment  instrument  (C.1.1)  of  the  PSD2  and  with  the 
Regulation  on  interchange  fees  for  card-based  payment 
transactions,  which  also  uses  this  definition.  Therefore,  no 
risk of different and conflicting legal definitions would arise. 
The option is consist with Directive 2013/40/EU on attacks 
against 
same 
the 
conditions as far as jurisdiction is concerned (C.3.4). 
The  option  would  also  complement  the  minimum  rules 
established  by  the  Directive  on  Euro  counterfeiting  that 
defines criminal offences and sanctions and sets up minimum 
maximum  levels  of  penalties  for  counterfeiting  of  physical 
currencies. 
At the same time, possible conflicts can arise with the  PSD2 
and  the  Regulation  on  interchange  fees  for  card-based 
payment transactions which leave to the MS the decision to 
set up penalties for the offences co vered by their respective 
scopes,  instead  of  setting  up  minimum  levels  of  maximum 
sanctions across all MS (C.2.1). 
Collecting statistics on investigations and prosecutions at EU 
level (C.3.3) is consistent with Regulation No 223/2009 on 
European  statistics  Eurostat  and  with  the  4th  AML 
Directive.  Strengthening  the  role  of  the  contact  point  will 

+2 

150 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

support the application of both of Regulation  (EU) 2016/794 
on Europol and of Council Decision 2009/426/JHA on the 
strengthening  of Eurojust. 

Overall im pact: m oderate and positiv e 

Same as PO 1 with regard to  B2. Only additional impact are 
described. 

A broad and technology-neutral definition of NCP instruments 
and  related  crimes  (C.1.1)  will  extend  the  coverage  of  EU 
legislation especially around NPM (New Payment Modalities), 
while  setting  a  minimum  level  of  maximum  sanctions  for 
fraudulent  activities  and  for  actions  preparatory  to  and 
supportive of fraud will better prevent frauds (C.2.1). Clearer 
rules  about  jurisdiction  (C.3.4)  and  improved  cooperation 
between  MS  (C.3.3)  should  also  better  tackle  cross-border 
crimes. As a result, the enhanced protection of customers will 
help build trust in and security of NCP transactions leading to 
increased  consumption  and  trade flows in the medium and 
long term. The increase is expected to be higher compared to 
PO  A:  moderate  positive  impact  (+2).  The  stakeholders 
affected include individual consumers and EOs. 

Effectiveness 

Economic 
Impacts 

Preparatory  actions  will  be  prosecuted  and  sanctioned 
regardless  of  whether  or  not  the  fraud  actually  occurred 
(C.2.1).  This  would  be  complemented  with  addressing new 
forms of non-cash payments and crimes (C.1.1), clarifying the 
rules on jurisdiction (C.3.4), incentivising sharing information 
among  MS  and  strengthening the role of dedicated national 
contact points (C.3.3). As a result, improvements in the level 
of risk of being victims of fraud  and thus consumer choice 
are expected to be significant (+2.5), if compared to PO 0. 
The stakeholders affected include individual consumers. 

+2 

if 

If  and  only 

A moderate impact (+2) is expected in terms of cost savings 
resourced 
for  economic  operators. 
appropriately, enforcement agencies would be able to step in 
sooner (C.2.1) and more effectively for a wider range of cases 
(C.1.1  and  C.2.1),  including  cross-border  ones  (C.3.3  and 
C.3.4).  As  a  result,  potential  financial  losses  would  be 
prevented or at least limited.  
The  stakeholders  affected  include  EOs;  in  particular  big 
companies, such as card issuers that bear most of the costs. 
However,  the  benefits  are  likely  to  spill  over to other firms, 
including SMEs, as the cost of doing business could be reduced. 

Looking at aggregated  im pacts: 
Accumulated  benefits  of  consumptions,  trade  flows,  consumer 

151 

 
 
 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

choice  and  cost  savings  for  EOs  are  expected  to  drive 
significant  positive  im pacts  on  functioning  of  the digital 
m arket  and  com petition.  However, 
to 
econom ic  growth  and  em ploym ent will be m oderate, due 
to  increased  administrative  and  financial  costs  (see  Efficiency 
below)  related to this option.  

the  benefits 

Overall 
econom ic 
m oderate/significant and positive 

im pact 

of 

the 

option: 

The  option  would  affect  LEAs  capacity  to  address  a wider 
spectrum  criminal  activities  (C.1.1)  and  preparatory 
activities (C.2.1). It would also strengthen the role of national 
contact  points,  including  the possibility to designate several 
contact points in one MS so they would specialise in different 
type  of  fraud  or  stakeholders  they collaborate with (C.3.3). 
However, the enforcement of the option would require LEAs to 
have  an  adequate  level  of  resources  and  expertise  for 
investigating and persecuting the new forms of crimes (C.1.1 
and C.2.1), as well as for collecting stats on investigations and 
prosecutions (C.3.3). As a whole, the impact on LEAs capacity 
is  expected  to  be  small  in  the  short  term  (+1),  but  it could 
increase over time if resources and skills are made available.  

The  chances  of  detecting,  prosecuting  and  sanctioning 
criminals  are  expected  to  increase  through:  a)  the  broad 
definition of NCP transactions and fraud crimes, covering new 
and  emerging  forms  of  crimes  (C.1.1);  b)  investigations 
starting  before  fraud  occurs  and  common  minimum  levels 
maximum  sanctions  (C.2.1);  c)  facilitating  LEAs  cooperation 
and exchange of information (C.3.3), especially when several 
Member States claim jurisdiction over the same case, thanks to 
clearer  rules  about 
jurisdiction  (interpretation  of  the 
territoriality principle) and to the support of Europol (C.3.4). 
Although broad definitions will be open to interpretations, the 
impact 
is  expected  to  be  significant  (+2.5),  with  an 
improvement if compared to PO 0. The stakeholders affected 
include LEAs, judicial representatives and legal profession. 

+2 

Criminalising  preparatory/supportive  conduct  and  setting 
minimum  levels of maximum  sanctions for both NCP fraud and 
preparatory/supportive conduct (C.2.1) can have a deterrent 
effect, thus preventing and limiting the number of frauds and 
organised  crime gains.  However, the evidence suggests that 
certainty  of  punishment  is  a  stronger  deterrent  than  the 
severity  of  punishment.402  With  the  option  comparing 
favourably to PO 0, impact is expected to be moderate (+2). 

Social 
impacts 

402 Nagin, D.S (2013) Deterrence: a review of the evidence by criminologist and economists, Annual review of 
Economics. 

152 

 
 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

The  stakeholders  affected  include  individual  consumers  and 
EOs. 

The  impact  on  the level of protection for victims is likely to 
be  moderate  (+2).  This  is  because  the  new  EU  definitions 
(C.1.1) will provide protection from a wider range of new and 
future  fraud  crimes,  while  criminalisation  of  preparatory 
activities  (C.2.1)  will  expand  protection  to  potential  victims  
and the measures addressing obstacles to cooperation due to 
legal and operational reasons (C.3.4 and C.3.3) will enhance 
protection  of  victims  of  complex  cross-border  fraud  cases. 
However, the option does not foresee any measure addressing 
the  actual  rights  of  the  victims  (direct  approach),403  as 
improved assistance to victims can be expected only through 
better cooperation among interested entities p articipating to 
PPPs (B2). 
The  stakeholders  affected  include  individual  consumers  and 
EOs. 

the 

Likewise, 
level  of  cooperation  between  public 
institutions  and  private  sector  is  likely  to  improve  only 
because of the self-regulatory framework (B2). The impact is 
expected to be moderate/significant (+1.5/+2), depending on 
the take up. 

Looking at aggregated  im pacts: 
Given  the  lack  of  binding  measures  addressing  the  rights  of 
NCP  frauds’  victims  and  the  cooperation  between  public  and 
private  sectors,  a  m oderate  im pact  is  expected  in  terms  of 
the  im provem ent  of  security,  mostly  due  to  the  increased 
chances of detecting,  prosecuting and sanctioning criminals . 

Overall  econom ic  im pact  of  the  option:  m oderate  and 
positive 

As compared to PO 0, the option is expected to increase the 
administrative burden for the EU institutions and MS, providing 
that enforcement agencies will be actively following the wider 
range of criminal activities, including cross -border cases. The 
following costs are expected: 

Efficiency 

Financial and 
administrativ
e costs 

  one-off  costs  for  the  EU:  developing  new  legislation, 
including  definitions  (NCP  instruments  based  on  PSD2 
definition, crimes and preparatory conduct) and minimum 
level of maximum sanctions; 

-1.5 

  one-off  costs  for  a  few  MS:  adopting  new provisions to 
their national settings (e.g.: as the legislation would only 
set  a  minimum  level  of  sanctions  for  the  maximum 
penalty, it would leave flexibility as to setting the ceilings, 

403 Direct approach refers to the adoption of specific provisions regarding victims’ rights which are complementary 
to those provided by Directive 2012/29/EU. 

153 

 
 
 
 
 
  
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

as well as levels for the minimum penalty; these, if defined  
in national legislation would have to be adjusted); 

  continuous costs for EU : facilitating cooperation through 
Eurojust among all MS claiming jurisdiction over the same 
case (C.3.4) 

  continuous costs for MS: implementing and enforcing the 
new  legislation,  such  as  costs  for  investigating  and 
persecuting  the  crimes  under  the  scope  of  the  option 
(C.1.1  and  C.2.1),  costs 
for  collecting  stats  on 
investigations  and  prosecutions,  and  sharing them with 
other MS and Europol (C.3.3) ; costs for cooperating with 
other MS concerned by the same cross-border cases and 
costs for eventually centralising proceedings in a single MS 
(C.3.4) 

Overall, the cumulative impact of this option on administrative 
and  financial  costs  could  be very high for those MS that will 
face  a  significant increase of possible crimes because of the 
new definitions and the criminalisation of preparatory conduct, 
not currently covered by their national legislation.404 Therefore, 
the administrative and financial impacts are expected to be at 
least  moderate,  primarily  affecting  LEAs,  judiciary,  legal 
profession and EU institutions. 

Overall im pact: m oderate and negativ e 

This  option  would  further  approximate  the  national  criminal 
frameworks,  providing  common  definitions  (C.1.1)  and  a 
common minimum level of sanctions for the maximum penalty 
(C.2.1).  Reducing  the  differences  between  MS  should  also 
facilitate  the  cooperation  between  MS  in  investigating  and 
persecuting cross-border cases. To this end, the clearer rules 
on  substantial  jurisdiction  (C.3.4),  the  reinforced  role  of 
national contact points and the sharing of data and information 
between MS and with Europol (C.3.3) could further simplify the 
procedures and practices for cooperating.  
However, broad and all-encompassing definitions: 

  would be more difficult to transpose to national legislation 
in MS where a detailed definition was adopted (e.g. DE); 
  would  be  open  to  diverse  interpretations,  limiting  the 

simplification benefits. 

+1 

Overall im pact: sm all and positive 

The option will have a positive impact on the right to security 
(Article  6  of  the  EU  Charter)  and  consumer  protection 
(Article 38 of the EU Charter) by regulating forms of NCP not 
covered  by  current  EU  legislation,  improving  chances  for 
prosecuting  fraud  criminals,  and  better  protecting  victims of 

+1.5 

Simplificatio
n benefits 

Fundamental rights 

404 As regards preparatory activities, available data suggest that there are few MS that do not criminalise several 
activities (such as social engineering, data breaches, identity theft and acting as a money mule) (see section 3.2).  

154 

 
 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

NCP fraud and associated preparatory conduct (C.1.1, C.2.2). 
In addition, consumer protection  is likely to be improved by: 

- 
- 

better information sharing (C.3.3) 
clarifying rules on jurisdictions and making it easier to 
pursue complex cross-border fraud cases (C.3.4). 

A particular attention should be paid by the MS to assurance 
that  the  principles  of  legality  and  proportionality  of  criminal 
offences and penalties shall be respected (according to Art. 49 
of the EU Charter) and the victim’s right to a fair trial shall not 
be affected (Art. 47 EU Charter). 
The  criminalisation  of  some  preparatory  activities  (such  as 
stealing  of  data,  trafficking  of  credentials,  identity  theft  - 
C.2.1)  would  indirectly  contribute  to  protection of personal 
data (Article 8 of the EU Charter) compared to the Status quo 
scenario. However, the establishment of PPPs (B2) may also 
potentially raise issues related to data protection (such as the 
sharing and processing of personal data). 

A positive impact is estimated in respect to the increasing of 
the knowledge and awareness of the consumers in respect to 
risks and vulnerabilities to NCP fraud (understanding the rights 
when  submitting  complaints,  when  participating  in  criminal 
proceedings and/or trial). 

Overall im pact: m oderate and positiv e 

Although  representing  a huge improvement to the FwD, the 
new  EU definitions of NCP instruments and crimes (including 
preparatory activities) would have a limited added value since 
many  MS  have  already  adopted  the  PSD2  definition  and/or 
have criminalised new forms of crime and preparatory conduct 
in their national legislative frameworks. However, a higher EU 
added  value  can  be  associated  to  the  provision  setting 
minimum  levels of sanctions (which are expected to reduce the 
disparities  between  MS  and  to  ensure  a  more  coherent 
treatment  of  fraud  criminals  across EU), as well as to those 
facilitating  cross-border  cooperation.  Indeed,  MS  would  be 
unlikely to achieve results in these areas to the same extent as 
through the EU action. 

+1.5 

Overall im pact: m oderate and positiv e 

Interviews: 
Among the interviewees, six agreed that a broader definition might be 
needed and would be better than a detailed one . 
Four  interviewees  were  in  favour  of  this  option  with two predicting 
decrease of workload thanks to stopping criminals at an earlier stage. 
Some  interviewees  were  more  critical  of  a  blanket  approach  and 
emphasised that motives for preparatory actions should be taken into 
account. 
Focus group: 
One participant favoured this option. 

155 

EU added value 

Stakeholders  and  experts 
view  

 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Some participants agreed that penalising preparatory act would give 
tools to the LEAs to stop the criminal early on and this would reduce the 
pressure  on  the  police  resources.  Others  pointed  to  the  increased 
workload to LEAs and a possibility that the impact of the minimum level 
of sanction were over estimated 
Open consultations: 
One respondent from private enterprises stressed the importance of 
considering new types of fraud and counterfeited non-cash means of 
payment. This input supports the need to extend the scope of the FwD. 
One  respondent  from  trade,  business  or  professional  associations 
underlined  that  the  EU  legal  framework  should  be  updated to take 
account  of  new  types  of  non-  cash  payment  fraud  related  to 
dematerialised payment instruments. 
Expert Group Meeting (EGM): 
There  was  a  general consensus on the need for technology-neutral 
definitions. 
Several  experts  underlined  that  a  comprehensive  legal  framework 
clearly defining the preparatory acts would enable a better functioning 
of cross-border cooperation. Better defining offences linked to phishing 
and carding would also add value to the current framework. 
Europol also stressed the importance of a harmonised legal framework 
including penal laws and sanctions as well as procedural laws. 
LEAs and judiciary experts agreed on replicating the conditions of the 
attacks  against  information  system  directive  as  far as jurisdiction is 
concerned. 

8.3.4  Policy option  3 - New legislation 

Policy option 3 – “New legislation”, combining: 

  Developing broad minimum common definitions covering new forms of crime and building on 
the PSD2 definition of payment instrument, if required, completing it to cover the new forms of 
value transfer (C.1.1) 

  Criminalising  preparatory  or  supportive  conduct  and  setting  minimum  levels  of  maximum 

sanctions for both NCP fraud and preparatory/supportive conduct (C.2.1) 
Facilitating operational law enforcement cross -border cooperation (C.3.3) 

 
  Updating jurisdiction rules in coherence with the proposal for a Directive on attacks against 

 

information systems (C.3.4) 
Facilitating the establishment of Public-Private Partnerships and the reporting of NCP related 
information to LEA without imposing legal obligations to private sector and citizens (C.4.2) 

  Developing additional specific protection for both natural and legal persons (especially the 

SMEs), when faced with NCP crimes, and especially identity theft (C.5.2) 

Assessment criteria 

Description of the impacts and affected groups  

Score 

Coherence 

Internal 
(Relevan
ce) 

Same as PO 2 with regard to C.1.1, C.2.1, C.3.3 and C.3.4. Only 
additional  intermediate  impacts  are  described,  while aggregate and 
overall  impacts are presented for the option as a whole. 

+2.5 

This  option  would  better  pursue  the  strategic  objective  of 
reinforcing the trust of consumers and economic operator, through 
specific protection to natural and legal persons (C.5.2). 

156 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Overall im pact: significant and positiv e 

Same as PO 2 with regard to C.1.1, C.2.1, C.3.3 and C.3.4. Only 
additional  intermediate  impacts  are  described,  while aggregate  and 
overall  impacts are presented for the option as a whole. 

External  

This option will provide protection also for legal persons who are 
victims  of  NCP  crimes  (C.5.2),  complementing  the  Directive  on 
victims’ rights  that defines as victim only a natural person. 
The option (C.4.2) would also complement the PSD2 which sets 
provisions  on  the  reporting  for  the  PSPs for incident relating to 
security in connection to the payment instrument, any suspicion of 
unauthorised or fraudulent use of the payment instrument. 

+2 

Effectiveness 

Economi
c 
Impacts 

Overall im pact: m oderate and significant 

Same as PO 2 with regard to C.1.1, C.2.1, C.3.3 and C.3.4. Only 
additional  intermediate  impacts  are  described,  while aggregate and 
overall  impacts are presented for the option as a whole. 

The option foresees provisions to protect natural and legal persons 
(C.5.2)  that  are  expected  to  further  build  trust  in  NCP 
transactions,  reduce  the  financial  and  social  costs  attached  to 
frauds  (especially  identity  theft)  and  also  increase busines s-to-
business  online  transactions, especially involving SMEs. This will 
lead  to  increased  consumption and trade flows compared with 
both PO A and PO 2: significant impact (+2.5). The stakeholders 
affected are individual consumers and EOs, including SMEs. 

Enhanced  public-private  cooperation  (C.4.2)  would  enable 
exchange  of  strategic  information (e.g. about new threats/modi 
operandi),  which  could  improve  prevention,  reduce  the  risk  of 
being  victim  of  frauds  and  improving  consumer  choice  in  a 
moderate manner (+2). 

+2.5 

The protection for legal persons (C.5.2) is expected to bring cost 
savings to companies and especially SMEs which are likely to be 
more  vulnerable  to  frauds  and  their  negative  financial  effects. 
Furthermore, economic operators will be allowed to report only the 
most significant NCP frauds and incidents  (that are likely to lead to 
significant  financial  losses  to  them  if  not  contrasted),  while not 
bearing additional costs due to mandatory reporting (C.4.2). The 
impact is expected to be moderate (+2). The stakeholders affected 
are EOs, including SMEs. 

Looking at aggregated  im pacts: 
Accumulated benefits (C.1.1, C.2.1, C.3.3, C.3.4, C.4.2, C.5.2) of 
consumer  choice  and  protection  (both  natural  and  legal  persons), 
consumptions 
(both  business-to-customer  and  business-to-
business),  and  cost  savings  for  EOs  are  expected  to  drive 
significant  positive  im pacts  on  functioning  of  the  digital 
m arket  and  com petition.  However,  the  benefits  to  econom ic 

157 

 
 
 
 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

growth  and  em ploym ent  will  be  m oderate,  due  to  increased 
administrative  and  financial  costs  (see  Efficiency  below),  although 
no addition  costs will be attached to mandatory reporting.   

Overall  econom ic  im pact  of  the  option:  significant  and 
positive 

Same as PO 2 with regard to C.1.1, C.2.1, C.3.3 and C.3.4. Only 
additional  intermediate  impacts  are  described,  while aggregate and 
overall  impacts are presented for the option as a whole. 

LEAs’  capacity to address criminal activity would be improved 
through  the  collaboration  with  the  private  sector  thanks to the 
establishment  of  PPP  and  reporting  on voluntary basis  (C.4.2). 
These should enable the sharing of strategic information (such as 
most significant fraud incidents and/or suspicious transactions, new 
threats  and  modi  operandi),  expertise  and  good  practices.  The 
expected impact would range from small to significant (+1/+2.5), 
depending  on  the  extent  to  which  partners’  liabilities  and 
responsibilities will be addressed within the PPPs and the frequency 
and nature of reported information. 

Social 
impacts 

of 

detecting, 

prosecuting 

The  legal  certainty  of  reporting  and  setting  up  of  dedicated 
channels  and  tools  for  facilitating  it  (C.4.2)  could  increase  the 
chances 
sanctioning 
perpetrators.  Furthermore, voluntary reporting could help LEAs to 
get  targeted  information  and  focus  on  major  perpetrators.  The 
expected impact would range from small to significant (+1/+2.5), 
depending on t on the frequency and nature of information actually 
reported by the private sector. The stakeholders affected are LEAs, 
EOs, NBFs, and individual consumers. 

and 

+2.5 

The  options  would  substantially  improve  the  protection  for 
victims,  granting additional specific rights (C.5.2) to both natural 
and legal persons (for reducing the negative consequences of both 
new  forms  frauds  (C.1.1)  and  preparatory  activities  (C.2.1). 
Specifically, the option would address the non-financial costs (such 
as  those  attached  to  identity  theft)405  borne  by  the  victims, 
including citizens and SMEs.406 Further protection for legal persons 
would  arise  from  the  voluntary  reporting,  allowing  economic 
operators to focus on those incidents/cases that could represent a 
significant threat for themselves.  The expected impact is likely to 
be  significant  (+2.5).  The  stakeholders  affected  are  individual 

405 Examples of such costs are: reputational damage, psychological and social distress, impacts on fundamental 
rights (e.g. data protection and privacy) and costs to rectify the consequences of the theft (e.g. replacing identity 
documents). 
406 Also legal persons can suffer of reputational damage. For instance, in 2011 Sony's PlayStation Network was 
victim of cyberattack stealing credit card credentials of an estimated 77million people 
(https://www.theguardian.com/technology/2011/apr/26/playstation-network-hackers-data). It is reasonable to 
assume that if an e-commerce website run by a SMEs is victim of a similar attack, the reputational damage with its 
customers would be dramatic.  

158 

 
 
 
 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

consumers and EOs, especially SMEs. 

The  level  of  cooperation  between  public  institutions  and 
private sector is expected to increase through the establishment 
of  PPPs  and  other  provision  consistent  with  the  principle  of 
cooperation,  such  as  voluntary  reporting  (C.4.2). The expected 
impact would range from small to significant (+1/+2.5), depending 
on the extent to which partners’ liabilities and responsibilities will 
be addressed within the PPPs 

Looking at aggregated  im pacts: 
A significant im pact is expected  in terms of the im provem ent of 
security,  due  to  the  increased  chances  of  detecting,  prosecuting 
and  sanctioning  criminals  (C.1.1,  C.2.1,  C.3.3  and  C.3.4),  the 
enhanced  protection  of  NCP  frauds’  victims  (C.5.2)  and  the 
facilitation  of public-private  cooperation and of reporting  (C.4.2)  . 

Overall  econom ic  im pact  of  the  option:  significant  and 
positive 

Same as PO 2 with regard to C.1.1, C.2.1, C.3.3 and C.3.4. Only 
additional  specific  impacts  are  described,  while  overall  impact  is 
presented for the option as a whole. 

The option is expected to increase the administrative burden for 
the  EU  institutions  and  MS.  The  most  likely  additional  costs 
associated with this option include: 

  one-off costs for the MS: one-off costs for setting-up PPPs, as 
well as dedicated channels and tools for facilitating reporting 
(C.4.2); 

Financial 
and 
administ
rative 
costs 

Efficiency 

  continuous costs for MS: implementing a wider protection for 
natural 
education  measures, 
communication  campaigns  (C.5.2), running the established 
PPPs (C.4.2). 

legal  persons; 

and 

-2 

  continuous  costs  for  LEAs:  maintaining  dedicated channels 

and tools to facilitate reporting (C.4.2). 

  continuous costs for EOs: reporting targeted NCP fraud cases 

(C.4.2). 

 

Additional  costs  will  mostly  affect  LEAs ,  without  imposing  any 
significant  cost  to  the  private  sector  and  citizens  due  to  the 
voluntary nature of reporting.  

Overall im pact: m oderate and negative 

Simplific
ation 
benefits 

Same as PO 2 with regard to C.1.1, C.2.1, C.3.3 and C.3.4. Only 
additional  specific  impacts  are  described,  while  overall  impact  is 
presented for the option as a whole. 

+1.5 

This  option  is  expected  to  bring  some  additional  simplification 
benefits,  since  the  legal  certainty  for  reporting  and  the 

159 

 
 
 
 
 
  
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

establishment  of  specific  channels  and  tools  for  facilitating  it 
(C.4.2), as well as the lack of additional administrative burden on 
the private sector and citizens.  

Overall im pact: m oderate and positive 

Same as PO 2 with regard to C.1.1, C.2.1, C.3.3 and C.3.4. Only 
additional  specific  impacts  are  described,  while  overall  impact  is 
presented for the option as a whole. 

This  option is expected to improve  consumer protection (Article 
38  of  the  EU  Charter)  for  natural  and  legal  persons  which  are 
victims of NCP crimes (including identity theft), through assistance 
and support services, awareness campaigns and other provisions 
addressing the negative financial and non-financial consequences 
(C.5.1, C.5.2). 
At the same time, information gathering and sharing required to 
fight  crime  (C.4.2)  can  also  affect  the  privacy  and  data 
protection  rights (Article 8) of the victims or third parties where 
their personal data are concerned and so it is important to provide 
adequate safeguards in this field. A particular attention should be 
paid to the protection of the victims’ rights when participating in 
criminal  proceedings  (Chapter  3  of  Directive  2012/29/EU), 
respectively  to  the  assurance  of  a  fair  trial  (Art.  47  of  the  EU 
Charter)  both  in  home  and  foreign  jurisdictions.  Moreover,  it  is 
important that the transfer of personal data should not go beyond 
the  purpose  for which data is used, in order to comply with the 
rights  of  protection  the  privacy, personal integrity and personal 
data of the victim.  

Overall im pact: m oderate and positive 

Same as PO 2 with regard to C.1.1, C.2.1, C.3.3 and C.3.4. Only 
additional  specific  impacts  are  described,  while  overall  impact  is 
presented for the option as a whole. 

+2 

It  is  unlikely  that  MS would be able to achieve a similar level of 
approximation  in  protection  for  both  natural  and  legal  persons 
without an EU action (C.5.2). Specifically, although most of the MS 
cover identity theft by their national legislation, the rights of the 
victims are included in the same general guarantees for the fraud 
attacks,  without  a  specific  protection  (such  as  rectification  of 
negative entries in victims’ credit history).  

+2.5 

Overall im pact: significant and positiv e 

Interviews: 
Many  interviewees  were  in  favour  of  voluntary,  rather  than  obligatory 
reporting of fraud incidents. 
Open consultations: 
One  respondent  from  private  enterprises  stressed  the  importance  of 
considering  new  types  of  fraud  and  counterfeited  non-cash  means  of 
payment. This input supports the need to extend the scope of the FwD. One 

160 

Fundamental rights 

EU added value 

Stakeholders 
experts view  

and 

 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

respondent from trade, business or professional associations underlined 
that  the  EU legal framework should be updated to take account of new 
types  of  non-cash  payment  fraud  related  to  dematerialised  payment 
instruments (C.1.1). 
One respondent from private enterprises stressed that it is important to 
raise awareness among legal entities about the concepts implicit in these 
means of payment, as well as the role / responsibilities of financial entities 
and clients in the use of these types of means of payments  (C.2.1). 
One respondent from private enterprises stressed that law enforcement 
does  not  always  realise  that  collecting  data  and  information  is  a  time  
consuming task. Working for more sharing of information and specific data 
directly related to specific investigation between the financial industry and 
the  authorities  would  particularly  be  suitable  in  smaller  and/or  one -off 
cases. 

8.3.5  Policy option  3bis - New legislation  and new procedural  rules 

Policy option 3 – “ Revision of regulation in all the areas with an emphasis on cross-border cooperation 
” 

  Developing broad minimum common definitions covering new forms  of crime and building on 
the PSD2 definition of payment instrument, if required, completing it to cover the new forms of 
value transfer (C1.1) 

  Criminalising  preparatory  or  supportive  conduct  and  setting  minimum  levels  of  maximum 

sanctions for both NCP fraud and preparatory/supportive conduct (C2.1) 
Including rules to complement the European Investigation Order (EIO) (C3.1) 

 
  Adapting the rules on injunctions for cooperation/evidence purposes (C3.2) 
 
Facilitating operational law enforcement cross-border cooperation (C3.3) 
  Adding  provisions  on  reporting  NCP  related  information  (e.g. frauds, data breaches, modi 

operandi) to LEA based purely on voluntary cooperation (C4.2) 

  Developing additional provisions for protecting the natural person, as well as the legal persons 

(in particular the SMEs), also when faced with identity theft (C5.2) 

Assessment criteria 

Description of the impacts and affected groups  

Score 

Coherence 

Internal 
(Relevance) 

External  

Effectiveness 

Economic 
Impacts 

This  option  responds  to  the  first  strategic  objective  by 
criminalising preparation for fraud and thus improving trust in 
NCP transactions. 
It also responds to the second strategic policy objective since 
thanks to increased investigations and prosecutions which will 
allow in particular to disrupt OCG. 

This  option has the same consistencies and inconsistencies 
with the EU and international legal framework than C3 except 
that this option would regulate the access to the electronic 
evidence when the COM is currently developing an horizontal 
initiative to tackle this topic for  offences not only relating to 
NCP (C3.1 and C3.2).  

+3 

-2 

Same  as  PO  3  with regard to C1.1, C2.1, C3.3, C.3.4, C4.2 
and  C5.2  Only additional specific impacts are described, while 
overall  impact is presented for the option as a whole. 

+3 

161 

 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Thanks to this option the consumption and trade flow would 
further increase thanks to reinforced law enforcement (C3.1) 
and judicial (C3.2) cooperation impacting the level of fraud – 
significant positive impact (+3). 

Overall im pact: significant and positive 

Looking at aggregated  impacts: 
Increasing level of consumption and trade flows will contribute 
to  better  functioning  of  the  digital  market  and  competition  -
significant  positive  impact.  Combined  benefits  for  individuals 
and  EOs  are  likely  to  translate  into  economic  growth  and 
employment,  but  will  be  moderated  by 
financial  and 
administrative costs. 

Same  as  PO  3  with regard to C1.1, C2.1, C3.3, C.3.4, C4.2 
and  C5.2  Only additional specific impacts are described, while 
overall  impact is presented for the option as a whole. 

This option will increase the chances for detecting, prosecuting 
and sanctioning criminals are higher, this option making the 
most of the existing law enforcement cooperation mechanisms 
i.e. the EIO (C3.1) and the injunctions (C3.2) for cooperation 
(+3).   

Social 
impacts 

The  level  of  protection  for  victims  is  expected  to  increase 
slightly more than in the option 3 thanks to improves cross -
border prosecutions (C3.2). 

+3 

Overall im pact: significant and positive 

Looking at aggregated  impacts: 
Despite  declines  in  LEAs  capacity,  improved  prosecution  of 
criminals  and  protection  for  victims  is  expected  to  contribute 
to the improvement of security – significant positive impact. 

Same  as  PO  3  with regard to C1.1, C2.1, C3.3, C.3.4, C4.2 
and  C5.2  Only additional specific impacts are described, while 
overall  impact is presented for the option as a whole. 

Complementing the EIO (C3.1) and maintaining a database in 
injunctions (C3.2) in order to better monitor injunction orders 
would represent additional continuous costs for MS, such as 
processing the increased number of EIO requests and provide 
feedback to the executing authority.  
Furthermore, 
increased  number  and  scope  of 
investigations  of  fraud  crimes  will  mainly  affect  LEAs, 
judiciary, legal profession.  

the 

-3 

Financial and 
administrativ
e costs 

Efficiency 

Overall im pact: significant and negative 

Simplification 
benefits 

 Same as PO 3 with regard to C1.1, C2.1, C3.3, C.3.4, C4.2 
and  C5.2  Only additional specific impacts are described, while 
overall  impact is presented for the option as a whole. 

+2 

162 

 
 
 
 
  
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

This  option  is  expected  to  have  the  same  simplification 
benefits as the option 3. In addition, the complemented EIO 
(C3.1)  and  injunctions  (C3.2)  would  further  improve  the 
efficiency of existing mechanisms for cross -border cooperation 
resulting in small additional simplification benefits. 

Overall im pact: m oderate and positiv e 

Same  as  PO  3  with regard to C1.1, C2.1, C3.3, C.3.4, C4.2 
and  C5.2  Only additional specific impacts are described, while 
overall  impact is presented for the option as a whole. 

Regarding data protection (Article 8 of the EU Charter), this 
introduces  a  risk  of  disproportionate  use  of 
option 
investigative  powers  and  techniques  (i.e.  increased  police 
surveillance, access to “no-need-to-know” personal data). This 
could  have  a  negative  impact  on  the  right  to  liberty  and 
security, the right to private and family life of third parties and 
the  protection  of  personal  data.  A  disproportional  use  of 
investigative techniques could also affect the presumption of 
innocence  and  the  right  of  defence  in  cases  where  such 
evidence is used in a trial. By transposing the Directive (EU) 
2016/680 the MS shall ensure adequate procedural safeguards 
to preserve the privacy of the citizens (C3.1). 
At  the  same  time,  it  also  looks  to  strengthen  consumer 
protection (Article 38) against fraud while respecting victims’ 
privacy at the same time (C3.2). 
Subject to the principles of necessity and proportionality, the 
protection  measures  of  the  victims  shall  be  set  up  under 
legitimate  and  sufficiently  important  objectives  that  could 
assure limitations to the interference in the private and family 
life. 

Overall im pact: m oderate and positive 

Same  as  PO  3  with regard to C1.1, C2.1, C3.3, C.3.4, C4.2 
and  C5.2  Only additional specific impacts are described, while 
overall  impact is presented for the option as a whole. 

+2 

Fundamental rights 

EU added value 

In  the area of cross-border collaboration, this option would 
add  some  value  over  and  above  to  what  MS  could  have 
achieved by acting on their own. cooperation  

+3 

Stakeholders  and  experts 
view  

Overall im pact: significant and positive 

In addition to the stakeholders and experts’ view already presented in 
the assessment of the option 3: 
Interviews 
Five interviewees were in favour of complementing the EIO  (C3.1) and 
noted the benefits it was expected to bring although for some others 
this  was  a  relatively  new  or  unknown  instrument  making  it  more 
difficult to take an opinion on it (AE, AK). 
Focus group: 

163 

 
 
 
 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

None of the participants explicitly favoured this option. 
Open consultations: 
As  for  (C1.1),  (C2.1) and (C.3.3) please see  Policy option 3 – “New 
legislation”. As for the other measures, not relevant input was provided 
by respondents.  

8.4  Quantitative  assessment  of the policy options 

The quantitative assessment aims at estimating for each Policy Options: 

 

 

the main financial and administrative  costs,  distinguishing between one-off and continuous 
costs; 
the main benefits (savings) linked to reduction of number of criminal acts and of organised 
crime gains related to new forms of non-cash payment frauds. 

The quantitative assessment of the policy options is based on the quantitative assessment of the policy 
measures (see Annex 13). 

8.4.1  Quantification  of the financial  and administrative  costs 

When estimating the financial and administrative costs, the evaluation team distinguishes between 
one-off costs and continuous costs. The following key assumptions underlie the quantitative impact 
assessment for the financial and administrative costs. 

With regard to the one-off costs of developing legislation at EU level, the evaluation team assumes 
that COM officials of level A8 are employed for the drafting of reports and legislation. Based on the 
average of a monthly salary around € 6,000, the evaluation team assumes a daily rate of € 300. Based 
on a similar IA the evaluation team assumes that 30 working days are needed for drafting a report 
(publication  of  an  implementation  report,  or  publication  of  a  guidebook);  60  working  days  are 
necessary for developing "simple" EU legislation (such as publishing a communication or developing a 
new definition); 80 working days are necessary for developing "more articulated" EU legislation (e.g. 
developing a new legislation) (European Commission, 2012).  

With  regard  to  the  one -off  costs  for  EU  MS  of  transposing  EU  legislation  into  national  laws, the 
evaluation  team  uses  the  average  monthly  earnings  for  the  public  administration  by  Eurostat. 
According to the latest the average EU28 monthly wage of a public administration employee is around 
€ 2,600, and the evaluation team assumes a daily cost of € 130.00 (assuming 20 working days in a 
month). Based on a similar IA the evaluation team assumes that 20 working days are necessary for 
transposing into national law "simple" EU legislation, 60 working days are necessary for transposing 
"more articulated" EU legislation.  

It has to be noted that the above assumption have been adapted for taking into account that identified 
policy options are a combination of different policy measures (both legislative and non -legislative). 
Therefore, the evaluation team assumes that each policy option would require to combine the one -off 
costs attached to the underlying policy measures, which have been estimated on the basis of the 
assumptions presented above. The evaluation team acknowledges that such approach could lead to an 
overestimation of the one-off costs, since some economies can occur when devoloping/transposing a 
legalisation combining two or more legislative and/or non-legislative measures.  

The table below summarises the one-off costs for the EU Institutions and the EU MS, while further 
details on assumptions, nature of costs, calculations of the single policy measures are provided in 
13. 
Annex 

164 

 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment regarding possible options f or a future EU 
initiative in combatting fraud in and counterfeiting of non-cash means of payment 

Table 16 – Quantification of one-off costs 

ONE-OFF COSTS FOR EU 

ONE-OFF COSTS FOR EU MS 

TOTAL ONE OFF 
COSTS 

POLICY OPTIONS 

EU 
official 
daily 
rate 

Nr of 
worki
ng 
days 

Total: 

Daily rate* 

working days  

MS PA 
officia
l daily 
rate 

Nr of 
workin
g days 

Nr of MS 
affected 

Total: 

Total EU 

Daily rate* 

+ 

working days 

Total MS 

0 - Status quo 

€ 300 

n.a. 

€ 0  € 130 

€ 300 

120 

€ 36,000  € 130 

n.a. 

n.a. 

n.a. 

n.a. 

€ 0 

€ 0 

€ 0 

€ 36,000 

1 - Soft law 
(B1+B2) 
2 - Revision of 
regulation in the 
area of criminal law 
and law 
enforcement 
cooperation 
(C1.1+C2.1+C.3.3+
C.3.4+B2) 

3 - New legislation 
(C1.1+C2.1+C3.3+
C.3.4+C4.2+C5.2) 

€ 300 

320 

€ 96,000  € 130 

120 

27 

€ 421,200 

€ 517,200 

€ 300 

380 

€ 114,000  € 130 

160 

27 

€ 561,600 

€ 675,600 

3bis - New 
legislation 
(C1.1+C2.1+C3.1+
C3.2+C3.3+C.3.4+C
4.2+C5.2) 
Source: Authors’ elaboration 

€ 300 

500 

€ 150,000  € 130 

200 

27 

€ 702,000 

€ 852,000 

165 

 
 
 
  
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

With regard to the continuous costs for the EU Institutions, the evaluation team assumes that training 
and  other  other  activities  for  LEAs  (B1)  would  require  28  working  days  per  year  each (e.g.  one 
seminar in each MS and one seminar at EU level); lastly the evaluation team assumes that a EU publlic 
awareness campaign (B2) would cost around € 120,000 per year. 

There  is  little  firm  basis  for  the  estimates  of  the  costs  for  MS  in implementing wider  and/or new 
legislation. Nevertheless, for the only purpose of comparing the policy options, the evaluation team 
assumes that for implementing "simple" legislation around 100 working days per year are needed in 
each MS, while for implementing "articulated" legislation around 200 working days are necessary.  

As in the case of one-off costs, the evaluation team assumes that each policy option would require to 
combine the continuous costs attached to the underlying policy measures, which have been estimated 
on the basis of the assumptions presented above. Likewise, remarks about the possible overestimation 
of these costs have to be taken into account. 

The table below summarises the continuous costs for the EU Institutions and the EU MS, while further 
details on assumptions, nature of costs, calculations of the single policy measures are provided in 
13. 
Annex 

166 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment regarding possible options f or a future EU 
initiative in combatting fraud in and counterfeiting of non-cash means of payment 

Table 17 – Quantification of the continuous  costs (per year)  407 

CONTINUOUS COSTS FOR EU 

CONTINUOUS COSTS FOR EU MS 

TOTAL 
CONTINUO
US 
COSTS 

OFF 

POLICY OPTIONS 

EU  official 
daily rate 

of 

Nr 
workin
g days 

Total: 

Daily 
rate* 

PA 

MS 
official 
daily rate 

of 

Nr 
workin
g days 

Nr  of 
MS 
affecte
d 

Total: 

Total EU 

Daily 
rate* 

+ 

working 
days  

workin
g days 

Total MS 

0 - Status quo 

€ 300 

n.a. 

€ 0 

€ 130 

n.a. 

n.a. 

€ 0 

€ 0 

1 - Soft law (B1+B2) 

€ 300 

56 

€ 16,800 

€ 130 

n.a. 

n.a. 

€ 0 

€ 136,800 

2  -  Revision  of  regulation  in  the  area  of 
criminal 
enforcement 
cooperation (C1.1+C2.1+C.3.3+C.3.4+B2) 

and 

law 

law 

n.a. 

€ 120,000 

€ 300 

24 

€ 7,200 

€ 130 

504 

27 

3 - New legislation 
(C1.1+C2.1+C3.3+C.3.4+C4.2+C5.2) 

€ 300 

24 

€ 7,200 

€ 130 

724 

27 

€ 
1.318.2
00 

€ 
2.090.4

€ 1,325,400 

€ 2,097,600 

407 As regards policy measure C.2.1, the criminalisation of some preparatory activities (such as social engineering, data breaches, identity theft/theft of credentials, 
trashing) is widespread with only a limited number of MS lacking relevant provisions (5-6 MS based on the evaluation findings). However, the criminalisation of other 
preparatory activities (such as phishing, pharming, carding website, etc.) is less well evidenced. As such, the evaluation team assumes that the overall number of MS 
affected by additional major continuous costs (due to the increase of the number of cases for investigation) would be 13. All 27 MS will bear costs for the overall 
implementation of the policy measure (see Annex 13 for details). 

167 

 
 
  
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment regarding possible options f or a future EU 
initiative in combatting fraud in and counterfeiting of non-cash means of payment 

3bis - New legislation 
(C1.1+C2.1+C3.1+C3.2+C3.3+C.3.4+C4.2
+C5.2) 

Source: Authors’ elaboration 

€ 300 

24 

€ 7,200 

€ 130 

924 

27* 

00 

€ 
2.792.4
00 

€ 2,799,600 

168 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

8.4.2  Quantification  of the main  benefits 

There is also little evidence and data available on the economic impacts and benefits of the different 
policy options. For the purpose of comparing the policy options, the evaluation team looks at the scale 
of reduction in the number of criminal acts estimated for each of the policy measures (see Annex 13), 
compared to the status quo (Policy option 1). Then, the reduction expected from the policy option is 
estimated summing up the reductions estimated for the policy measures that are  combined in the 
policy measure. We monetise this reduction using the ECB’s estimate of the current cost of fraudulent 
transactions - € 14.4 billion.408 If no action is taken (PO 1), the evaluation team estimates no change 
in  the  number  of  criminal  acts  and  organised  crime  gains,  and  the  current  cost  of  fraudulent 
transactions to keep accounting for € 14.4 billion per year. For the other policy options, drawing on the 
findings  of the qualitative assessment,  the evaluation team estimates a possible reduction of the 
problem included in the range of 2% (PO 1) and -10.5% (PO 3bis), compared to PO 0. The benefits are 
therefore calculated as the share (percentage) of the current costs of fraudulent transactions that 
could be saved implementing each policy option. As in the case of the calculation of main costs, the 
evaluation team acknowledges that such approach could lead to an overestimation of the monetised 
benefits. 

The outcomes of the quantification of the main benefits are summarisied in the table below , while 
detailed calculations of the single policy measures are provided in Annex 1 2.  

Table 18 – Quantification of main benefits   

 POLICY OPTIONS 

Change in the 
number  of criminal 
acts and organised 
crime gains 
(compared to 
baseline scenario)  

0 - Status quo (baseline scenario) 

1 - Soft law (B1+B2) 

2 - Revision of the regulation in the area of 
criminal law and law enforcement cooperation 
(C1.1+C2.1+C.3.3+C.3.4+B2) 

3 - New legislation 
(C1.1+C2.1+C3.3+C.3.4+C4.2+C5.2) 

3bis - New legislation and new procedural 
rules 
(C1.1+C2.1+C3.1+C3.2+C3.3+C.3.4+C4.2+
C5.2) 

0,00% 

-2,00% 

-8,50% 

-11,00% 

-13,00% 

Effect on cost 
of fraudulent 
transactions 
(total cost 
under  the 
baseline 
scenario: € 
1.44 bn)  

€ - 

 - € 28.8 
million  

Total value 
of 
fraudulent 
transactio
ns 
(1.44 bn – 
estimated 
reduction)   
€ 1.44 
billion 
€ 1.41 
billion 

 - € 122.4 
million  

€ 1.32 
billion 

 - € 158.4 
million  

 - € 187.2 
million  

€ 1.28 
billion 

€ 1.25 
billion 

408 "The total value of fraudulent transactions conducted using cards issued within SEPA and acquired worldwide 
amounted to €1.44 billion in 2013 (European Central Bank, 2015a).  

169 

 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

8.4.3  Summary of the quantification  exercise 

The outcomes of the quantification exercise are summarised in the table below . 

Table 19 – Quantification of main costs and benefits 

POLICY OPTIONS 

COSTS 

BENEFITS 

One-off 
Financial 
and 
administrati
ve costs  

Continuous 
Financial 
and 
administrati
ve costs 
(per year) 

Effect on 
cost of 
fraudulent 
transactions 
(total cost 
under  the 
baseline 
scenario: € 
1.44 bn) 

Total value 
of 
fraudulent 
transactions 
(1.44 bn – 
estimated 
reduction) 

0 - Status quo 

€ 0 

€ 0 

€ - 

€ 1.44 billion 

1 - Soft law (B1+B2) 

€ 36,000 

€ 136,800 

- € 28.8 
million 

€ 1.41 billion 

2 - Revision of the regulation in the 
area of criminal law and law 
enforcement cooperation 
(C1.1+C2.2+C.3.3+B2) 

3 - New legislation 
(C1.1+C2.2+C3.3+C4.2+C5.2) 

3bis - New legislation and new 
procedural rules 
(C1.1+C2.2+C3.1+C3.2+C3.3+C4.2+
C5.2) 

Source: Authors’ elaboration 

€ 517,200 

€ 1,387,320 

- € 122.4 
million 

€ 1.32 billion 

€ 675,600 

€ 1,325,400 

€ 852,000 

€ 2,097,600 

- € 158.4 
million 

- € 187.2 
million 

€ 1.28 billion 

€ 1.25 billion 

9  COMPA RISON  OF OPTIONS  A ND  THE  PREFERRED  POLICY OPTION  

9.1  Comparative assessment  of the policy options 

The comparative assessment presents the outcomes of impact assessment carried out, summarising 
the scores (qualitative assessment) and the overall estimated costs and benefits of each policy option.  

Table 20 –Comparative qualitative  assessment  of the policy options 

Assessment  criteria 

PO 0 

PO 1 

PO 2 

PO 3 

PO 3bis 

Internal coherence 
External coherence 

Effectiveness - Economic 
Effectiveness - Social 

Efficiency - costs 
Efficiency - benefits 
Fundamental rights 

EU added value 

0 
0.5 

-1.5 
-0.5 

0 
0 
0 

0 

2 
2 

2 
2 

-1.5 
1 
1.5 

1.5 

2.5 
2 

2.5 
2.5 

-2 
1.5 
2 

2.5 

3 
-2 

3 
3 

-3 
2 
2 

3 

1 
1 

-1 
1 

-1 
-0.5 
0 

0.5 

170 

 
 
  
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Assessment  criteria 
Overall score409 

PO 0 

-0.2 

PO 1 

0.1 

PO 2 

1.2 

PO 3 

1.7 

PO 3bis 

1.4 

Source: Authors’ elaboration 

Table 21 –Comparative quantitative  assessment  of the policy options 

Overall costs 
Overall 
benefits 
(savings) 

PO 0 

€0 

€ 0 

Source: Authors’ elaboration 

PO 1 

PO 2 

PO 3 

PO 3bis 

€ 172.800 

€ 1.816.320 

€ 2.746.920 

€ 3.625.320 

- € 28.8 
million 

- € 122.4 
million 

- € 158.4 
million 

- € 187.2 
million 

9.2 

Identification  of the preferred policy option 

On the basis of the assessment carried out, the identified preferred option is the Policy option 3 
– New legislation. 

 It combines the following policy measures : 

  Developing broad minimum common definitions covering new forms of crime and building on 
the PSD2 definition of payment instrument, if required, completing it to cover the new forms of 
value transfer (C.1.1); 

  Criminalising  preparatory  or  supportive  conduct  and  setting  minimum  levels  of  maximum 

 
 

sanctions for both NCP fraud and preparatory/supportive conduct (C.2.1); 
Facilitating operational law enforcement cross -border cooperation (C.3.3); 
Facilitating the establishment of Public-Private Partnerships and the reporting of NCP related 
information to LEA without imposing legal obligations to private sector and citizens (C.4.2); 
  Developing additional specific protection for both natural and legal persons (especially the 

SMEs), when faced with NCP crimes, and especially identity theft (C.5.2) 

It  has  to  be  noted  that  the  Policy  Option  3bis  scores  slightly  better  than  PO  3  against  several 
assessment criteria (such as social and economic impacts). However, some of its measures (C.3.1 and 
C.3.2) would overlap with an horizontal initiative that COM is currently developing for regulating the 
access to the electronic evidence for offences not only relating to NCP frauds. 

Hereinafter the main reason behind the identification of the  preferred policy options are described in 
terms  of  advantages  and  disadvantages  of  PO  3 ,  as  well  as  its  conformity  to  the  principles  of 
subsidiarity and proportionality. 

9.2.1  Main advantages 

The options would effectively pursue both the strategic objectives of the EU intervention  since: 

  broad  minimum  common  definitions  (C.1.1)  and  minimum sanctions (C.2.1) would address 
different forms of fraud, including new and emerging ones, cross -border crimes (C.3.3 and 
C.3.4), and preparatory activities (C.2.1); 
specific protection to natural and legal persons (C.5.2) would further reinforce the trust of 
consumers and economic operators in NCP transactions and the digital single market  

 

The expected economic impacts in terms of a) consumer choice and protection (both natural and 
legal persons), b) consumptions (both business -to-customer and business-to-business), and c) cost 
savings  for  EOs  are  likely  to  drive  significant  positive  impacts  on  the  functioning  of  the  digital 

409 The overall score is the average of the scores of a policy option for each assessment criteria. 

171 

 
 
 
                                                 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

market  and  competition.  Besides  consumers,  especially  SMEs  would  benefit from the protection 
granted to legal persons, since they are likely to be more vulnerable to frauds and their negative 
financial effects than large companies. 

Significant social impacts are also expected in terms of the  improvement of security, due to the 
increased chances of detecting, prosecuting and sanctioning criminals (C.1.1, C.2.1, C.3.3  and C.3.4), 
the enhanced protection of NCP frauds’ victims (C.5.2) and the facilitatio n of public-private cooperation 
and  of reporting (C.4.2). Specifically, criminalising preparatory and supportive conduct and setting 
minimum  levels of maximum  sanctions for both NCP fraud and preparatory/supportive conduct (C.2.1) 
can have a deterrent effe ct to criminals, thus preventing and limiting the number of frauds and the 
organised crime associated gains.  

As regards fundamental rights, the option is expected to improve consumer protection for natural 
and legal persons which are victims of NCP crimes  (including identity theft), through assistance and 
support services, awareness campaigns and other provisions addressing the negative financial and 
non-financial consequences (C.5.2).  

The EU added value of the option can be associated to the provisions a ) setting minimum levels of 
sanctions (which are expected to reduce the disparities between MS and to ensure a more coherent 
treatment of fraud criminals across EU), b) facilitating cross -border cooperation and c) approximating 
the protection for both natural and legal persons that are victims of NCP crimes. Indeed, MS would be 
unlikely to achieve results in these areas to the same extent as through the EU action. 

9.2.2  Main disadvantages 

The  use  of  broad  and  all-encompassing  definitions  for  NCP  instruments and crimes could lead to 
interpretation issues across MS, limiting the simplification benefits. 

Reporting on voluntary basis would not guarantee a dramatic increase in the number of information 
(fraud incidents and/or suspicious transactions) collected by LEAs. However, information (including 
modi  operandi  and  other  strategic information) could be shared by the private sectors within the 
established  of  PPPs,  provided  that  partners’  liabilities  and  responsibilities  will  be addressed and 
defined. 

The option would entail significant financial and administrative costs (about EUR 2.7 million) to EU 
institutions  and  MS  Authorities  for  developing,  transposing,  implementing  and  enforcing the new 
legislation. However, no additional significant costs are expected for the private sector and citizens, 
since no obligation of reporting is foreseen. 

9.2.3  Subsidiarity 

Given the international dimension and the scope of the problems to solve, the measures foreseen in 
the preferred policy options need to be adopted at Community level in  order to achieve the identified 
objectives. In particular, action by Member States would be insufficient with respect to the following 
main issues:  

  Reducing  th  differences  between  MS  in  terms  of  NCP  offences  criminalised  and  level  of 

 

 

sanctions, in oder to ensure a more coherent treatment of fraud criminals across EU; 
Levelling the protection of EU consumers and economic operators in order to reinforce their 
trust  in  the  digital  single  market  and  to  prevent  deviations  in  their  choices  and  buying 
behaviours. Thus, an EU intervention could help in levelling the protection of consumers and 
EOs in the digital single market era; 
Facilitating the cooperation between MS authorities in order to better address the cross border 
nature of the NCP crime, which is incre asing due to the digitalisation in non-cash means of 
payments. 

172 

 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

9.2.4  Proportionality 

Regulation has been discarded as delivery instrument of the policy option for giving MS a high degree 
of flexibility in terms of implementation. 

Indeed, the option would not pursue a full harmonisation of national legislative frameworks, but it will 
introduce  a  minimum  set  of  common  broad  definitions,  minimum  level  of  maximum sanctions and 
rights of victims. Therefore, MS will continue to maintain the control of the levels of sanctions as a 
whole. Likewise, MS will be allowed to grant more favourable rights to the victims of the NCP frauds. 
The option would also leave enough flexibility to MS for adapting the broad definitions to national 
circumstances, if needed. 

Furthemore, the option would not impose disproportionate obligations to the private sectors (including 
SMEs) and citizens, since reporting to LEAs will be on voluntary basis. 

Finally, the instrument chosen is a directive, which gives, also the delivery instrument of the p olicy. 

On the whole, the option does not go beyond what is necessary to achieve the objective identified for 
the EU intervention. 

10  MONITORING  A ND  EVA LUA TION  A RRA NGEMENTS 

The table below proposes a list of  impact and result indicators that could be used to assess the 
progress and effectiveness of the preferred option in achieving the general and specific objectives. 

Table 22 – Impact and result indicators 

Main Objectives 
General  objective:  Reinforcing 
the  trust  of  consumers  and 
economic operators in the digital 
single market 

security 

Perceived 

Potential  Indicators 
of 
- 
economic 
and 
consumers 
operators  on  the  digital  single 
market 
non-cash 
transaction  
- Increase of NCP transactions 

and 

Sources of Information 
- Eurobarometer 
-  Ad  hoc  surveys  at  EU  and 
national level 

- ECB 
- Eurostat  
- National statistics Bureau; 

General  objective:  Fighting the 
different 
forms  of  non-cash 
payment frauds, to decrease its 
disrupt 
occurrence 
organised crime 

and 

-  Reduction  of  NCP  frauds  (in 
numbers and value) 

-  Reduction  of  OCGs  gains 
related to NCP frauds 

- ECB 
- LEAs 
- National statistics Bureau; 

-  Level  of  transposition  of  the 
common rules 
- Number of forms of NCP fraud 
not  covered  by  the  criminal 
framework 

- MS implementation reports 
- MS Monitoring reports; 
- Surveys at MS level. 

173 

Specific objective: Establishing common minimum rules for the criminalisation and investigation of non -cash payment fraud, addressing new forms and their p ossible evolution 

 
 
 
 
 
Evaluation of the existing policy and legislative framework and preparation of impact assessment 
regarding possible options for a future EU initiative in combatting fraud in and counterfeiting of non -
cash means of payment 

Main Objectives 
Specific objective: Enabling law 
enforcement investigations and 
judicial  prosecutions  against 
new forms of non-cash payment 
fraud,  as  well  as  a  stronger 
cooperation  between  MS  law 
enforcement 
and 
between  the  public  and  the 
private sector 

agencies 

Specific  objective:  Ensuring 
better protection for consumers 
and economic operators against 
non-cash payment fraud 

Source: Authors’ elaboration 

Sources of Information 
- LEAs 

- MS Monitoring reports; 

Ratio 

between 

Potential  Indicators 
- 
cases 
investigated/persecuted/sanctio
ned and cases reported (%) 
-  Ratio  between  cross-border 
cases  persecuted/sanctioned 
and cross-border cases reported 
(%) 
- Number of established public-
private partnerships and number 
of actors involved 

-  Costs  incurred  by  consumer 
and  economic  operator  (on  a 
sample basis) 
-  Level  of  satisfaction  among 
economic 
and 
consumer 
operator  about  their  level  of 
protection (on a sample basis) 

- Eurobarometer 
-  Ad  hoc  surveys  at  EU  and 
national level 

Taking into account the measures of the preferred policy option, the following operational objectives 
(and related monitoring indicators) can be identified: 

  Establishing minimum common definitions for NCP instruments and related crimes  (monitoring 
indicator: Number of MS that have adopted the established minimum common definitions) 
  Setting minimum levels of maximum sanctions for both NCP fraud and preparatory/supportive 
conduct  (monitoring  indicator:  Number  of  MS  that have adopted the established minimum 
levels) 

  Collecting  statistics on investigations and prosecutions of offences  (monitoring indicator: scope 

 

 

and nature of the statistics collected by MS)  
Facilitating  operational cooperation between LEAs across MS (monitoring indicator: number of 
investigation and prosecutions involving LEAs of different MS) 
Facilitating  the  reporting  of  NCP  related  information  to  LEA  (monitoring  indicator: number of 
dedicated reporting channels and tools activated by the MS) 

  Developing  additional  specific  protection  for  both  natural  and  legal persons that are victims of 
identity theft (monitoring indicators: number and types of support services and rights granted 
to the victims of identity theft, distinguishing between natural and legal persons). 

As  far  as  monitoring  and  evaluation  arrangements  are  concerned,  they  could  involve reporting 
activities pertaining to both the Commission and the MS.  

On one side, three years after the deadline for the transposition of the new legislation, the Commission 
could release a report focused on the status of implementation of the legislation at MS level and the 
overall evaluation of the measures adopted through the assessme nt of the above presented indicators. 

Following  this  report,  the  examination of the results achieved against objectives would allow the 
Commission  to  decide  whether  proposals  for  amendment  should be put forward in order to best 
respond to the defined objectives. 

On the other side, a reporting system at MS level could be set up by means of a specific provision 
included  in  the  legislation.  On  this  basis,  MS  could  be  obliged  to  communicate  correlation tables 
annually or bi-annually, in order to demonstrate the implementation of the provisions of the legislation 
in their national legislation.  

174 

 
 
 
 
 
HOW TO OBTAIN EU PUBLICATIONS 

Free publications: 

•  one copy: 

via EU  Bookshop  (http://bookshop.europa.eu); 

•  more  than one copy or  posters/maps: 

from  the European  Union’s  representations  (http://ec.europa.eu/represent_en.htm);   
from  the delegations in non-EU countries 
(http://eeas.europa.eu/delegations/index_en.htm);  
by contacting the Europe  Direct service (http://europa.eu/europedirect/index_en.ht m) 
or calling  00  800  6 7 8 9 10  11  (freephone  number  from  anywhere  in the EU)  (*).  

(*)  The information given is free, as are most calls (though some operators, phone boxes or hotels may 
charge you). 

Priced  publications: 

•  via EU  Bookshop  (http://bookshop.europa.eu). 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
D
R
-
0
2
-
1
8
-
2
3
4
-
E
N
-
N

[

C

a

t

a

l

o

g

u

e

n

u

m

b

e

r

]

doi: 10.2837/232849 
ISBN 978-92-79-80322-2