Payments Fraud in Malta 2026: A Cross-Border Market Confronts the Impersonation Economy
Malta's fraud problem is not well described by a single incidence rate. A country with an unusually international mix of banks, card issuers, e-money firms and payment providers must manage two kinds of failure: unauthorized access to payment credentials and authorized money sent to someone posing as a legitimate recipient.
Malta's Payments Market Is Much More International Than Its Size Suggests
The core institutions serving Maltese households are only part of the story. E-money and payment firms operating across borders make payment volumes, customer location and destination of funds difficult to collapse into a single domestic market narrative.
In the Central Bank of Malta's 2025 Interim Financial Stability Report, credit transfers accounted for approximately 61% of all funds moved across the institution types and payment instruments it examined between January 2022 and June 2025. E-money represented another 25%, cards 6%, cheques 5%, remittances 2% and direct debits 1%. These are shares of payment value in a defined reporting universe, not shares of retail purchases or the number of transactions.
By the first half of 2025, credit-transfer value had reached approximately €56 billion per half-year, up from €36 billion in the first half of 2022. The bank's report attributes much of the expansion to cross-border transfers, particularly towards euro-area countries. Over the same endpoints, the number of credit transfers rose from 17.9 million to 26.3 million. The mix of providers changed: e-money institutions' share of transfer value rose from 7.3% to 23.7%, while banks' combined share declined.
Cards were expanding too. Card-payment value rose from roughly €3.1 billion in H1 2022 to €5.9 billion in H1 2025. Of card-payment value over the longer period, only 37% was domestic; around half related to the euro area, with much of the remainder connected to the UK. Ireland appears prominently because major digital platforms process payments through Irish hubs, not necessarily because the customer or ultimate merchant is Irish.
The smaller retail lens is also revealing. Malta's National Statistics Office reports that cards covered 60% of supermarket sales in 2024 but only 30% of fuel-station sales value. The difference is a reminder that payment mix varies substantially by purchase category, and that a national card-growth figure cannot substitute for a merchant's channel-level fraud assessment.
Instant euro transfers add another layer. Euro-area banks came under the requirement to receive instant euro payments in January 2025 and send them in October 2025. Under this faster model, erroneous or socially engineered payments can leave less time for a human to intervene. The operational consequence is not to distrust speed itself, but to shift checks ahead of execution.
Two Payment Rails, Two Distinct Fraud Exposures
Malta's official multi-year payment-rail data place a larger absolute value of recorded fraud in credit transfers than cards. The broader fraud typology evidence, meanwhile, identifies invoice and executive impersonation as a particularly severe source of reported losses.
The Central Bank reports nearly €19 million in fraudulent credit transfers between January 2022 and June 2025. Over the same study window, fraudulent card transactions represented €8.4 million. Among these two reported instruments, transfers therefore made up roughly 69% of the value and cards 31%. The figures are cumulative over three and a half years, not a 2025 or 2026 annual total, and they must not be merged with police crime losses or suspicious-transaction reports.
Over the card-payment base, the central bank describes the fraudulent amount as approximately 0.03% of card-payment value in the multi-year period. The transfer figure is small relative to the vastly larger value of legitimate transfers. A lower transaction-value fraud ratio does not mean a fraudulent transfer is inexpensive once it occurs, nor does it indicate the share of attempted scams that a bank prevents.
Malta also stands out in an EU-wide frequency comparison. The December 2025 joint ECB–EBA payment-fraud report (Table 2), whose data also underpin the EBA's December 2025 Risk Assessment Report, places fraudulent credit transfers at 0.009% of Malta's transfer count in 2024, versus 0.002% across the EU/EEA. That is about 4.5 times the area-wide rate, a contrast that requires attention to the difference between reported transactions, the mix of providers and data completeness. The EBA separately warns that the quality of certain end-user loss measures needs improvement.
The same report’s single-year 2024 figures sharpen the picture. Credit transfers: 1,950 fraudulent transactions worth €3.17 million, a value rate of 0.003%—three times the EU/EEA’s 0.001%. Cards: 20,817 fraudulent transactions worth €2.29 million, a value rate of 0.030% against an EU/EEA total of 0.033%, but a count rate of 0.017%, above the EU/EEA’s 0.015%. The average fraudulent card payment was about €110, against an EU/EEA average of €76—Malta’s card frauds tend to be larger than usual. The average fraudulent transfer, about €1,630, was below the EU/EEA’s €2,155.
Who absorbs those losses also differs. Across the EU/EEA, payment-service users bore around 85% of credit-transfer fraud losses in 2024. Malta is one of only six countries where the users’ share was below 80%; the report’s country chart puts it at roughly 72%, with the remainder attributed to parties other than the user or the user’s provider.
The most revealing merchant-specific distinction comes from Bank of Valletta's published summary of a March 2026 FIAU report. It attributes €10.4 million in reported losses to 137 victims of business email compromise, compared with €3.8 million associated with 505 consumer-fraud victims. The latter category affected more people in that source; the former produced much greater value. These typology figures come from a separate reporting process and are not additional payment-rail totals.
Fewer Police Fraud Reports, Stronger Institutional Focus
The latest criminal statistics show a decline from 2024 to 2025. Meanwhile, the 2026 regulatory and policing agenda is shifting toward impersonation, real-time detection and the liabilities created by induced payments.
The CrimeMalta Observatory's 2025 Annual Crime Review, based on police-recorded offences, reports 1,907 fraud cases in 2025, versus 2,394 in 2024—a decline of 487 cases, or approximately 20%. Fraud nevertheless accounted for 12.2% of all recorded crimes in 2025. The long historical view is sobering: 179 such offences were recorded in 2005. These are offence counts under a criminal classification, not a complete measure of all attempted online scams, payment-system fraud events, or recoverable losses.
A high-profile February 2026 investigation illustrated the threat profile. According to police statements reported by The Malta Independent, an international bank-impersonation operation under investigation involved roughly 200 identified victims and €1 million in losses, with cross-border links to Ireland and the United Kingdom. The criminal case is an individual investigation, not a representative estimate of national banking-scam frequency.
The Malta Financial Services Authority created a public-private anti-fraud partnership in April 2026, with police, the central bank, the FIAU, the Financial Arbiter and retail banking participants. Its first focus is consumer payment fraud, including both unauthorized payments and transfers the consumer is tricked into sending. In August, the authorities launched ScamAlert.mt as a national information and reporting resource.
Also in 2026, the MFSA warned of crypto-asset impersonation schemes exploiting the MiCA transition and, on 26 October, flagged an unlicensed entity posing as a bank. These notices document identified fraud-risk channels; they do not establish the monetary value of completed losses.
Malta's Own Survey Disrupts the 'Only Older People Fall for Scams' Narrative
The national survey captures actual losses, exposure and response. Adults aged 36–45 were identified as the group most likely to report losing money, while younger adults were more likely to recognise financial-scam terminology.
In May 2025, research commissioned by the Office of the Arbiter for Financial Services and conducted by Sagalytics surveyed 600 Maltese residents aged 16 and over. Some 58.5% reported having been targeted by a financial scam. The newsletter says 15.8% suffered financial losses, although a nearby summary uses the wording '16% of those targeted'. Because the stated denominators are not fully consistent, this briefing does not calculate a conditional loss rate from these figures.
The Arbiter's survey places ages 36–45 as most likely to lose money. Contemporaneous reporting on the study cites 33.3% reporting financial losses in that age group. This is a survey response within an age cohort, not the fraction of all national fraud losses paid by 36–45-year-olds. A full comparable age-by-age loss table was not established in the material reviewed; it would be misleading to draw fictitious bars for the missing groups.
Awareness follows a different pattern. Familiarity with the term 'financial scams' was 87.1% among ages 26–35 and 58.3% among respondents aged 66 and above. That difference is a literacy measure, not a victimization-rate comparison. Higher reported awareness does not guarantee protection from social engineering.
Among respondents who lost money, 83.6% reported losses below €1,000. Phone calls and SMS were common approach channels, reported by 54% and 53.3%, respectively, in the survey's scam-contact findings. Of those reporting financial loss, 69.6% contacted their bank, but only 36.2% filed a police report and 10.1% contacted the Arbiter. This gap explains why police crime counts cannot be used as a denominator for population victimization.
The separately reported March 2026 FIAU typologies, summarized by Bank of Valletta, likewise distinguish age and channel: reported victims were often 20–49, with younger adults represented more in consumer, employment and phishing fraud, and people over 60 more represented in investment and romance schemes. It is a source-specific victim profile, not a census-adjusted risk comparison.
The Five Scams That Best Explain Malta's Current Threat
Customer-facing fraud creates the incident volume. Business and relationship deception can create outsized severity. Malta's banking guidance and supervisory notices give merchants a more precise playbook than the generic instruction to 'be careful online'.
Bank of Valletta's March 2026 FIAU-based summary lists five common fraud categories with corresponding victims and reported losses. These figures offer an illustration of severity differences across fraud mechanisms, but the original FIAU dataset was not independently retrieved for this briefing and the figures should not be interpreted as all Maltese fraud cases or added to the central bank's payment-rail series.
Business email compromise involves an impostor supplier, executive or genuine mailbox takeover that results in new payment instructions. A short, authentic-looking email can do more damage than thousands of low-value consumer purchase scams. The national ScamAlert effort makes clear that consumers and businesses both need to identify and report these types of deception.
Bank impersonation and phishing aim to make customers disclose information, approve transactions or hand over access. In 2026, alleged use of familiar local banking identities and spoofed calls showed that neither a convincing caller nor a familiar displayed number is sufficient verification. The problem is not limited to technical account takeover; the user may be persuaded to perform the authorization personally.
Investment and relationship fraud operate on a longer timeline. The victim may see fictional gains, build an emotional relationship, or pay supposed withdrawal and tax fees. The Financial Arbiter has highlighted the particular challenge of 'pig-butchering' scams and cryptocurrency transfers, where payments can move through multiple providers and recovery is uncertain.
Supplier-detail substitution
A compromised inbox announces a new bank account; invoice approval proceeds because the sender appears familiar and the goods are genuinely expected.
Bank identity and security pretexts
The scammer claims suspicious account activity, then instructs the victim to authorize a transfer or disclose one-time credentials.
False storefronts, jobs and purchases
Victims are asked to leave a platform's protected checkout, pay an advance deposit or send funds to an unrelated account.
Investment, romance and crypto withdrawal fees
A manufactured relationship or promising portfolio becomes the pretext for repeated transfers, often to entities presented as licensed intermediaries.
Instant Payments Change Where the Fraud Check Must Happen
Malta's regulators are moving beyond the idea that authentication alone establishes payment legitimacy. Verification of payee, monitoring, limits and institutional coordination all focus on preventing the wrong payment before it settles.
The EU Instant Payments Regulation (Regulation (EU) 2024/886) requires eligible euro-area credit institutions to receive instant euro transfers from January 2025 and send them from October 2025, with a payee-name verification service designed to alert payers when a beneficiary's name and account identifier do not match. The Central Bank of Malta discussed these milestones in its 2025 Annual Report. For euro-area payment and e-money institutions, the instant-payment obligations apply from 9 April 2027—a date that matters in Malta, where e-money institutions handled 23.7% of credit-transfer value by H1 2025. A merchant should confirm the applicable provider class instead of assuming every participant shared an identical date.
On 23 June 2026, the Central Bank issued supervisory expectations specifically for instant-payment fraud. The notice covers transaction monitoring, authentication, payee verification, spending limits, device registration, customer education, information sharing, staff training and governance. Payment service providers are expected to align their fraud prevention frameworks by 1 July 2027. This is the stated alignment date in the bank's notice.
Fraud victims also have a more accessible dispute avenue. The Office of the Arbiter for Financial Services explains that, for qualifying payment transactions processed on or after 1 October 2025 through a Malta-licensed provider, its remit extends to individuals and companies of any size, even where the complainant did not directly contract with that provider. Outcomes remain case-specific: an expanded right to complain is not an entitlement to automatic reimbursement.
The supervisory shift is consistent with the ECB–EBA's December 2025 joint fraud assessment: strong customer authentication helps against the attacks it was designed to prevent, particularly unauthorized card use, but manipulated-payer fraud needs additional controls. The destination bank's name-match warning may reveal a substituted IBAN; it will not necessarily reveal that a fraudster created a convincing but false commercial request.
Six Decisions That Matter for Malta-Exposed Merchants
The fraud controls for a cross-border ecommerce seller, a B2B invoicing business and a regulated payment institution will not be identical. Each needs to identify the payment step at which deception can still be interrupted.
Business-to-Business Invoicing
Protect the beneficiary: Treat a bank-detail change as a security-sensitive event. Call a trusted number already held in the supplier master record, require dual approval for changes or unusually large payments, and retain the confirmation evidence.
Online Card Commerce
Protect the transaction: Apply risk-based 3-D Secure challenges where appropriate. Monitor device, account and order velocity, verify suspicious customer changes, preserve fulfillment records and review chargebacks by issuer geography and product.
Hotels, Tours and Rentals
Protect the booking: Keep deposit requests within authenticated booking channels. Verify changes to guest payment instructions, do not issue refunds to unrelated accounts without appropriate review, and confirm settlement before releasing high-value inventory.
Instant Transfers and Deposits
Protect the handoff: Verify actual receipt through the bank or PSP, not a screenshot. Make beneficiary-name mismatches and unusual payment sequences actionable exceptions. Train staff to escalate suspicious requests while funds may still be recoverable.
Fintech, E-money and PSP Operations
Protect the rails: Align monitoring, transaction limits, device registration and escalation with the June 2026 Central Bank notice. Distinguish the fraud obligations applicable to banks, payment institutions and e-money institutions and document control effectiveness.
Higher-Risk and Recurring Sales
Protect account approval: Prepare defensible evidence on sales model, fulfillment, refund handling, monthly volume, chargeback levels, billing consent and previous processor treatment before seeking a high-risk merchant account. Clear underwriting documentation is complementary to—not a substitute for—fraud prevention.
A sophisticated fraudster may have the right-looking email address, the right time of day and a payment request that passes customer authentication. Malta's emerging response places greater weight on what the money is for and who actually receives it.
Secure Processing for Complex, Cross-Border Sales Models
Payment acceptance, billing terms, fulfillment and chargeback exposure all affect account approval. Durango Merchant Services helps merchants identify underwriting concerns, prepare supporting information and pursue payment processing arrangements appropriate to their sales and risk profile.