Payments companies at both ends of fraudulent transactions must report them to the European Banking Authority (EBA), and must maintain separate security authentication for different processes they offer, the regulator has said in an answer to questions from regulated companies about the Payment Services Directive (PSD2).