Online banking services are no longer just about checking a balance or scheduling a delayed transfer. Since the implementation of the European regulation on instant payments, interfaces have changed profoundly, and the gaps between institutions are widening on points that classic comparisons overlook: beneficiary verification, multi-bank aggregation, transactional security.
Verification of Payee and instant transfer: what changes in the interface
The European regulation requires payment service providers in the SEPA zone to receive instant transfers in less than ten seconds, available continuously. The obligation to receive is effective from January 9, 2025, while the obligation for issuance and IBAN-name verification (Verification of Payee, or VoP) is effective from October 9, 2025.
Specifically, during an online transfer, the screen now displays an alert in case of a mismatch between the entered IBAN and the beneficiary’s name. This mechanism directly targets Authorised Push Payment fraud, where the payer validates a transfer to an account controlled by a third party.
We observe that the quality of VoP implementation varies greatly from one institution to another. Some online banks display a simple text warning, while others block the transaction and require enhanced confirmation. This level of friction directly impacts account security on a daily basis. Comparing banking services with Mon Portail Finance allows for quick identification of institutions that integrate VoP in a genuinely protective manner.
Bank account aggregation and DSP3: current limitations
The DSP2 directive paved the way for multi-bank aggregation via open banking APIs. In practice, the reliability of connections between aggregators and banks remains uneven. Some APIs regularly fail, synchronizations can take several hours, and automatically categorized data contains classification errors.
The upcoming DSP3, currently under negotiation at the European level, aims to strengthen banks’ obligations regarding the availability and performance of their access interfaces. It also introduces a framework for payment services initiated by third parties, with stricter liability requirements in case of unauthorized transactions.
What DSP3 should change for users
- Guaranteed access to banking data with SLA (service level agreements) imposed on banks, reducing connection interruptions between aggregators and accounts
- Clarified liability in case of fraud on a payment initiated via a third-party provider, with defined reimbursement timelines
- Extension of the regulatory scope to electronic money institutions and neobanks, which partially escaped the current framework
For a user who centralizes multiple accounts (current account, savings account, securities account) in a single application, these developments should reduce technical frictions. In the meantime, we recommend manually checking the balances displayed by the aggregator at least once a week.
Automatic expense categorization: real reliability and pitfalls
Most online banks and budget management applications offer automatic categorization of transactions. The principle relies on analyzing the operation’s label and, sometimes, the MCC (Merchant Category Code) provided by the payment terminal.
The error rate of this categorization is rarely documented by institutions. The most poorly classified items concern multi-product online purchases (an Amazon cart containing groceries and electronics will be classified in a single category), card payments abroad (truncated or transliterated labels), and direct debits whose labels change from month to month.
Adjusting categorization without spending an hour
Manually correcting the five most significant expense items is enough to ensure the overall budget view is reliable. There’s no need to reclassify every transaction of a few euros. Applications that allow creating custom rules (by keyword in the label) offer a notable time-saving on recurring operations.
Some aggregators also offer a CSV export or a connection to spreadsheets. For profiles managing a tight budget, this option remains more reliable than unchecked automatic categorization.
Security of online banking services: beyond the password
Strong customer authentication (SCA) mandated by DSP2 has generalized two-factor verification for online connections and payments. In practice, the most common method remains the push notification on the mobile app, combined with a PIN code or biometric fingerprint.
Online banks differentiate themselves on a point rarely highlighted: the granularity of security controls left to the customer. Some allow disabling contactless payments, setting an ATM withdrawal limit, blocking transactions outside the euro zone, or limiting online payments to a specified amount per transaction, all in real-time from the app.
- Geographical blocking of card payments (euro zone only, or country by country)
- Instantly modifiable payment and withdrawal limits, without calling customer service
- Single-use virtual card for online purchases, limiting exposure in case of data breaches at a merchant
- Real-time notifications for each movement, with the possibility to immediately dispute a suspicious transaction
These features exist in most neobanks and several first-generation online banks, but their accessibility in the interface varies. A control buried in a sub-menu of settings does not protect as well as a visible toggle on the home screen.
Actively managing these parameters significantly reduces the risk of fraud, especially for customers who use their bank card on multiple merchant sites. A well-configured online account offers a higher level of control than a traditional branch, where changing a limit often requires an appointment or a call.
