SEPA - who will step up to the challenge?

Your points are spot on - what SEPA seems to need is high order program management skills. Not sure if we can draw an exact parallel, but I remember that when UK's Payments Council (then known as APACS) faced turbulence of a similar nature with Faster Payments back in 2007, they brought in KPMG to manage the program, which helped a lot to right the course. 

Funny you mention Faster Payments; I sat in an APACS meeting a few years ago just before the introduction of Faster Payments, and the main concern was how to keep fraudsters away from this gold nugget of instant monetization of compromised accounts. Today's Trojans are capable of emptying an account in 10 seconds, and if you don't stop it in real time, the money is gone. 

SEPA is far worse in this perspective: you basically have to treat cross border trx as if they are domestic ones. This means that if you compromise an online banking account anywhere in the Euro zone, you no longer need to move the money to a bank in the same country. 

Let me give a specific example: say you have a victim's PC infected with the Zeus Trojan, a massively popular and particularly nasty piece of malware, on a German PC. Once the victim logs into their online banking, your Zeus will automatically send 5,000 euros to a 'mule' account - a destination bank account controlled by a collaborator to remove any traces leading to you.

If before SEPA you had to recruit the mule locally in Germany, now you have the entire EU to look for collaborators. You can recruit people in Latvia, Finland, and Romania; whatever control the German banks had on looking for suspicious in-country transfers goes away.

I'm not talking about a theoretical thing: in fact, RSA found a Zeus Mule database in May 2009 with a special SEPA MULE section, which included mules from the countries mentioned above. There were also 3 transfers of up to 12,000 euros from German bank accounts to mule accounts outside Germany, using the SEPA scheme.

If SEPA gets 'faster payment', the banks in Europe will have to make instant decisions. Is this a legitimate cross border payment, or an attempt to empty the account? Tough choice, which requires state-of-the-art fraud defense strategy.

Uri,

You have hit the nail on the head with this. SEPA not only increases the speed and reach of where fraudsters can funnel money, but it delivers the same ease at which domestic transfers can be done to countries who may not have the same strict banking, KYC and policing structures in place.

This effectively gives the fraudster that ability to hide in a country with little ramifications for fraud and siphon money from customers in all of the "plump" nations. I've personally been involved in talks with many of our customers about these potential problems and they are well aware, and well positioned with countermeasures. With a robust, real time solution in place, there are lots of strategies that can be done to mitigate the risks, but they certainly do exist!