Transaction approval

Signing in securely and approving the right transaction are different tasks. A strong sign-in control can reduce the use of stolen credentials, but it cannot decide whether the payment a person has been persuaded to make is legitimate. A World Bank review states that multifactor authentication can combat unauthorized fraud but does not prevent authorized-payment fraud.¹

Transaction approval is most useful when it identifies what is being authorized. European Union payment rules require a payer making a remote payment with strong customer authentication to be shown the amount and payee. The resulting authentication code must be specific to those details, and changing either detail invalidates the code.² This binds the approval to a particular transaction rather than to a vague instruction to confirm activity.

Broader payment evidence supports the distinction. In European Economic Area industry reports for 2024, transactions using strong customer authentication were generally less susceptible to fraud, especially card payments, while the effect was less clear for credit transfers.³ The European Banking Authority has also reported that fraudsters shifted toward social engineering as authentication reduced fraud based on stolen credentials.⁶

A recipient-name check supplies another transaction detail. The United Kingdom's Confirmation of Payee service compares the name entered by the payer with the account details held by the recipient's payment provider. Pay.UK states that a match does not guarantee detection of a fraudulent payment or reimbursement after one occurs.⁴ A match should therefore be read as a match, not as a verdict on the story behind the transfer.

Screen design can affect decisions in simulations. A UK behavioral experiment using high-fidelity payment journeys found that making cancellation or postponement prominent outperformed behavioral warnings and risk information. Warning effects weakened with repetition, while redesigned calls to action remained more effective.⁵ The experiment did not observe losses from live bank accounts.

The available warning experiment was simulated, and the supplied evidence does not establish how much transaction-approval design prevents consumer losses in the field. It also does not establish whether synthetic voice, video, or text changes the effectiveness of payee displays, name checks, or payment warnings.

Boundary. Transaction details help only when they are read and compared with the intended payment. Even accurate details cannot authenticate the person who requested the transfer or establish the request's legitimacy. Strong authentication may stop an unauthorized transaction while still permitting a payment that the account holder was deceived into approving. Name checks and warnings are therefore decision aids, not fraud guarantees.