What Is the FRIDA Fraud Alert Lifecycle?
Fraud information shared between institutions today is often a one-off message that is never updated.
Under the draft FRIDA Rulebook, a Fraud Alert works differently. It is a record held on a central platform. It is updated as PSPs investigate, and removed on a fixed timetable.
The FRIDA fraud alert lifecycle sets out who can change an alert, what each change means and how long the data is kept. If you are new to the scheme, start with what FRIDA is and how it works.
Who controls a FRIDA alert?
Mainly the PSP that raised it. Only the Sending PSP can cancel an alert or change its status. The PSP that holds the reported account can add its own verdict on that account. The platform removes alerts automatically when they expire.
What Are the Stages of a FRIDA Fraud Alert?
FRIDA fraud alert lifecycle: created, updated, cancelled, and removed after three months
Every alert moves through up to four stages.
The Sending PSP creates the alert after identifying a suspicious or fraudulent case. PSPs then update it, each within their own rights. The Sending PSP may cancel it, for example if it proves to be a false positive. Finally, the platform removes it once the retention period ends.
Two rules apply throughout. A cancelled or removed alert cannot be updated again. And every change is recorded in the alert’s audit trail.
Who Can Update a FRIDA Fraud Alert?
The rulebook gives each actor a defined set of rights. Our guide to FRIDA roles explains each actor in more detail.
The Sending PSP has the most control. It can create, update and cancel the alert. As its investigation develops, it can correct data, change the fraud type and move the status, for example from Suspicious to Confirmed Fraud Suspicion. It can also record the alert’s workflow status: investigation ongoing or investigation closed.
The ASPSP, which holds the reported account, cannot create or cancel the alert. It can update the account holder’s details and record its verdict on the account. Where the account belongs to a customer of a participating e-money institution or payment initiation provider, it can pass these rights to that firm.
The FRIDA administrator, meaning the EPC or the platform provider, has full access. The rulebook allows it to intervene at the request of PSPs or law enforcement.
Before any update is accepted, the platform checks it. The PSP must be a participant, its FIP must be authorised, and the change must still be possible at that point in the lifecycle.
What Is the Difference Between Alert Status and Stage?
The rulebook uses two separate terms for two separate views.
| Alert status | Stage | |
| Describes | The alert | The account |
| Set by | Sending PSP, administrator or system | ASPSP |
| Values | Suspicious, Confirmed Fraud Suspicion, Confirmed Fraud, Cancelled, Removed | Genuine, Suspicious, Confirmed Fraud Suspicion, Fraudulent, Blocked, Closed |
The two can differ. The Sending PSP may still suspect fraud while the ASPSP records the account as genuine. Every Receiving PSP sees both, and must decide how to weigh them in its own monitoring.
What Are the FRIDA Alert Cancellation Reasons?
Only the Sending PSP can cancel an alert. When it does, it must give one of four reasons: false positive, withdrawn by customer, error or not specified.
Is a PSP obliged to correct a false positive?
No. The Sending PSP is not obliged to cancel a false positive, but the rulebook “highly” recommends doing so as quickly as possible. The ASPSP is not obliged to respond either, but is “strongly” recommended to record its verdict, especially when the account is genuine. The quality of shared data will depend on updates PSPs are not strictly required to make.
For PSPs, this has a practical consequence. Alerts about your own customers may stay live unless you respond. Clear internal ownership for these responses protects genuine customers and limits complaints.
Can There Be More Than One Alert on the Same Account?
Yes. A PSP can raise a new alert on an account that already has one, whoever raised the first. The platform then links the alerts, so every Receiving PSP can see that several alerts concern the same account. Our article on FRIDA fraud alert data explains the linked alerts field.
How Long Do FRIDA Alerts Last?
| Data | Retention |
| Live alert on the platform | 3 months from creation, removed by a daily overnight purge |
| Audit trail and anonymous data, such as fraud type | 5 years from the execution date of the triggering payment |
| PSPs’ own local copies | Purged 5 years from the payment’s execution time stamp, in line with the PSR and local rules |
This is why the transaction date matters, even though it is an optional field in the alert. It also means your own systems need a retention and deletion process for every FRIDA alert you store. Data protection teams will expect to see one, as the GDPR requires data to be kept no longer than necessary.
What Does the Lifecycle Mean for PSPs?
For in-scope PSPs, taking part in FRIDA is mandatory. Our guide to who must join FRIDA covers the rules.
Each alert needs ongoing handling: updates, cancellations, account verdicts and timely deletion. In practice, that work sits in your fraud alerting and case management systems, and the information flows into your investigation processes.
Every alert you share must be updated, cancelled and purged on time. TechnoXander FRIDA Fraud Gateway keeps your side of the lifecycle in step, automatically. Book a demo to see it in action.
About Author:
