Germany’s Biggest Banks Move to Share Fraud Data Against Scams
Commerzbank, Deutsche Bank and the German Savings Banks Association (DSGV) are forming a joint venture to let banks share fraud data across institutional lines, a move built to catch phishing, investment scams and romance fraud before the money is gone. The three are setting up a shared company whose first product flags accounts being used fraudulently, so that other participating banks can factor the warning into their own checks. The plan has reportedly been filed with Germany’s Federal Cartel Office and still faces review by financial regulator BaFin and data-protection authorities before it can run.
Commerzbank, Deutsche Bank and the Sparkassen association have registered the anti-fraud platform with the cartel office.
What exactly are the three banks building?
A shared platform for exchanging fraud signals that no single bank can see on its own. When one institution identifies an account being misused, it can make that finding available to the others, who then decide independently what protective action to take. The venture uses Multi-Party Computation, a cryptographic method that lets banks compare specific data points without handing over their underlying customer records, with data minimisation and controlled disclosures built into the design.
The first use case targets phishing, investment fraud, merchandise fraud and romance scams, and the partners say it is already at an advanced stage of development. The intention is to widen the platform over time into broader fraud prevention and compliance-related tools, and to sell access to other obliged entities, so the shared intelligence base grows with each new member. The founders frame the tie-up as cooperation on payment security rather than competition, a point made by Joachim Schmalzl of the DSGV.
Why can’t individual banks catch this fraud alone?
Because fraud rarely stays inside one bank. Criminals open accounts at several institutions and move stolen funds between them within minutes, so a mule account can receive a transfer and pass it on before anyone connects the two. Each bank sees only its own slice of the chain. A shared warning layer lets a receiving bank act on another’s intelligence rather than discovering the pattern after the fact.
The scale explains the urgency. Germany’s Federal Criminal Police Office put the economic damage from cybercrime at roughly €202bn in 2025, about 4.5% of GDP, across some 335,000 recorded cases. Payment scams are a growing share of that: one industry estimate put scam losses in Germany at around €12bn in 2026. Under current rules, victims of authorised push payment fraud in Germany have no automatic right to reimbursement, which is one reason banks are now investing in earlier detection rather than after-the-event recovery.
How does this fit the EU’s new fraud rules?
The venture is timed to a legal framework that is about to make this kind of sharing mandatory. A political deal on PSD3 and the accompanying Payment Services Regulation was reached in late 2025, and the regime will require payment service providers to share fraud-related information between themselves. The regulation’s text envisions this exchange happening on a multilateral basis, potentially through a dedicated IT platform, which is close to what the three banks are proposing to build. A bank-owned utility positions them to meet the obligation on their own terms rather than wait for a regulator’s system.
Has anyone tried this before?
Yes, with mixed results, which is the context that matters most. The same three-bank cluster is already piloting cross-institution matching: since June 2025, Commerzbank, Deutsche Bank and N26 have run safeAML in the German state of Hesse through state-owned data trustee EuroDaT, an approach that processes data in pseudonymised form so that only the requesting bank can reattribute it. The new joint venture reads as the commercial scaling of that experiment.
The cautionary comparison sits across the border. Five Dutch banks, including ING, ABN AMRO and Rabobank, set up Transaction Monitoring Netherlands (TMNL) in July 2020 to monitor payments collectively. That project is now being scaled back because it conflicts with new European legislation taking effect in 2027. The German design leans heavily on cryptographic data minimisation precisely to avoid the legal footing that undermined TMNL.
What stands between the plan and launch?
Approval. The venture needs antitrust clearance and will draw scrutiny from BaFin and data-protection regulators, with GDPR compliance the central question. The plan was first reported by trade outlet FinanzBusiness in early October 2026, and the partners stress the platform is meant to complement state and supervisory measures, not replace them. There is also a corporate backdrop at one founder: Commerzbank is defending itself against a takeover approach from UniCredit, which sharpens its interest in cost-efficient, shared infrastructure. It is not the bank’s only fraud bet either, having partnered with financial-crime technology firm Hawk on AI-based anti-money-laundering tools in March 2026.
Why This Matters to FinanceX Readers
For finance professionals and investors, this is a signal of where compliance spend is heading. Fraud prevention is shifting from an in-house cost centre to shared, standardised infrastructure, and the institutions that co-own that infrastructure will shape the rules the rest of the market pays to use. Watch two things: whether the cartel and data-protection reviews clear cleanly, and whether a bank-owned utility can hold together under EU law where the Dutch model could not. If it works, expect similar consortia across other European markets as PSD3 obligations bite.
