For as long as EU payments law has existed, one distinction has done most of the work: was the transaction authorised or not? If the customer never approved it, they got their money back. If they approved it, they generally did not.
The Payment Services Regulation breaks that distinction. For the first time, a transaction the customer themselves authorised can be refundable in full, and the PSP, not the customer, must prove why it should not be.
This is the change most likely to reach the board, because it moves money.
This is what the industry calls APP fraud reimbursement, and the Regulation opens the door to it deliberately narrowly.
Article 59: a narrow door, opened deliberately
The centrepiece of the new authorised-fraud liability framework combines two elements. It imposes a preventive obligation on PSPs to maintain adequate prevention measures and robust technical safeguards capable of stopping fraudsters from replicating or misusing communication channels attributed to the PSP. And it creates a reimbursement right where that safeguard fails.
The right is framed through cumulative conditions, and the word cumulative is doing real work.
Figure 1. The four conditions for reimbursement under Article 59, and what follows once they are met.
It is not sufficient that the fraudster merely claimed to represent the PSP. The deception must be carried out through a communication channel attributed to the PSP itself: a spoofed caller identification, an existing bank SMS conversation, an email appearing to originate from the PSP domain. The victim must qualify as a consumer, meaning a natural person acting outside their trade, business or profession. And the consumer must have notified the PSP without undue delay after becoming aware of the fraud, and reported it to the police.
Miss one condition and the harmonised right under Article 59 does not arise. A business customer defrauded by a convincing impersonation of their bank is outside it. So is a consumer scammed by someone impersonating a supplier rather than the bank, however sophisticated the deception.
Fifteen business days, and who has to prove what
The clock starts only once both statutory preconditions are met: notification to the PSP and submission of a police report. Within fifteen business days, the PSP must either reimburse in full or provide a reasoned refusal.
Refusal is permitted only where the PSP has objectively justified grounds to suspect that the consumer acted fraudulently or with gross negligence. The burden of establishing those circumstances rests with the PSP.
That reversal is the operationally significant part. Under a burden-of-proof regime, the quality of your evidence trail determines your loss rate. A PSP that cannot reconstruct what its systems saw, what warnings the customer received, and what the customer did next will find gross negligence very difficult to establish inside fifteen business days.
Why APP fraud reimbursement stops where it does
The scope of Article 59 reflects a deliberate legislative choice, and it is worth understanding because it explains what will and will not change.
During preparation of the PSR, the Commission examined extending reimbursement to all authorised fraudulent transactions and concluded that it would be disproportionate. A general reversal of liability would have transferred a substantial proportion of APP fraud losses to PSPs, potentially conflicted with the principle of payment irrevocability, and created moral-hazard concerns by reducing the incentive for users to exercise caution.
The numbers behind that judgement are instructive. Four major Dutch banks had already introduced voluntary reimbursement schemes for victims of impersonation fraud, reimbursing approximately EUR 51 million during 2022, around 89% of reported losses. Extrapolating to Union level suggested that similar mechanisms could involve costs approaching EUR 1 billion annually.
Member State consultations showed broad support for strengthening preventive measures, including Verification of Payee, transaction monitoring and fraud-information sharing, and considerably more caution about a comprehensive reversal of liability. Article 59 is the negotiated balance: stronger consumer protection, without turning PSPs into universal insurers against every authorised scam.
Article 59 is not the only route to a refund
This is where reading Article 59 in isolation becomes misleading. The PSR simultaneously links liability to compliance with a wider range of mandatory prevention obligations, each with its own refund consequence.
Figure 2. Five routes to a refund under the PSR, and the articles that carry them.
Article 57 attaches a refund to a Verification of Payee failure that results in a defectively executed transaction. Article 83 goes further in a way that deserves attention: where the payer PSP does not provide evidence to the payer that transaction monitoring was carried out by both providers, it must refund the amount of the transaction.
Note the wording. The obligation is not simply to monitor. It is to be able to evidence that monitoring happened, on both sides. A control you cannot prove you operated is, for these purposes, a control you did not operate.
Liability under the PSR is therefore no longer determined solely by the traditional distinction between authorised and unauthorised transactions. It is increasingly allocated according to whether PSPs complied with their statutory fraud-prevention duties throughout the payment lifecycle.
Recourse, and why the customer never sees it
Article 78 establishes a right of recourse: a PSP that has reimbursed a payer may recover its losses from another PSP or intermediary whose failure contributed to the liability. The mechanism extends to certain hosting service providers whose failure to comply with their obligations under the Digital Services Act facilitated the fraudulent transaction.
The allocation of responsibility between institutions becomes largely invisible to the customer, who receives reimbursement from their own PSP while responsibility is redistributed afterwards within the payment ecosystem.
For a PSP, that cuts both ways. You may be the institution that pays first and recovers later, or the institution another PSP comes to. Either position rewards the same thing: a defensible record of which controls ran, what they returned, and what was done about it.
This is part 3 of a four-part series on the PSR and payment fraud.
Next: Fraud and AML can no longer be run as strangers
The full analysis is in our white paper Fraud, redrawn – 23 pages on how the PSR turns fraud prevention from a control into a lifecycle, by Eglė Kontautaitė, former Head of the Money Laundering Prevention Division at the Bank of Lithuania.
→ Download the full white paper here
