title: European Economic Area — Consumer Protection & APP Fraud | World Payments Monitor canonical: https://payments.gi/jurisdictions/european-economic-area/w10/ publisher: Asymmetric Intelligence ### W10 Consumer Protection & APP Fraud Confirmed confirmed 2026-06-20 EEA consumer protection rests on PSD2 (unauthorised/incorrectly executed transaction refunds) and is being expanded by the PSR. The November 2025 PSD3/PSR political agreement introduces mandatory reimbursement for impersonation ('spoofing') fraud, obliging PSPs and electronic communications providers to fully reimburse consumer victims (Article 59 PSR), plus mandatory IBAN-name verification (live via the IPR since October 2025) and online-platform liability building on the DSA. This contrasts with the UK PSR's broader Faster-Payments APP reimbursement model. Standing sub-brief · as of 20 June 2026 232 words · last cycle 2026-10-06 #### Consumer Protection & APP Fraud EEA consumer-fraud liability is converging on an impersonation-focused model. Article 59 of the PSR introduces a compensation model obliging PSPs and electronic communications service providers to fully reimburse a consumer victim of impersonation ('spoofing') fraud for the full fraudulent amount; online platforms become liable to reimbursing PSPs if informed of fraudulent content and failing to remove it, building on the Digital Services Act. The analytically important point is that this regime is narrower than the UK PSR's Faster-Payments APP model — it targets impersonation specifically rather than the broader authorised push payment category — a divergence relevant to operators working across both jurisdictions. The obligation falls on both bank and non-bank PSPs and is subject to the PSD3/PSR timeline. The live anti-fraud control complementing this regime is Verification of Payee. All PSPs offering SCT or SCT Inst were required to implement VoP by 9 October 2025 under the Instant Payments Regulation, checking payee name against IBAN before transfer. Unlike the forward-dated PSR reimbursement regime, VoP is already in force, giving the EEA a preventive control already operating ahead of the reimbursement liability framework. #### Outlook The trajectory is escalating. VoP is live; the Article 59 reimbursement regime follows the PSD3/PSR timeline and will sharpen the EEA–UK divergence in fraud-liability scope. The narrower EEA impersonation model versus the broader UK APP scheme is the cross-jurisdiction point operators should track. Periodic update · new data 2026-10-06 #### Consumer Protection & APP Fraud The current EEA legal framework for authorised push payment fraud gives consumers no general right to reimbursement. PSD2 Articles 64, 73 and 74 establish the existing liability allocation for unauthorised transactions and for payment service provider errors, but they do not create a general reimbursement obligation for a consumer who was deceived into authorising a fraudulent payment themselves, which is the defining feature of authorised push payment fraud as distinct from unauthorised transaction fraud. This is the operative legal position as at this cycle, independent of any future reform. The agreed, though not yet adopted, Payment Services Regulation would change this materially. The Council's compromise text of 17 April 2026 includes an Article 59 provision that would require payment service providers to provide full reimbursement for impersonation-scam losses where the fraud is reported promptly, introducing a general APP-fraud refund obligation that does not exist under the current PSD2 framework. The same agreed text sets a specific procedural mechanism: within 15 business days of being notified and provided with a police report by the consumer, the payment service provider must take one of a defined set of response actions. This represents a structural shift from the current position, where no general refund right exists, to an agreed future position where prompt, police-reported impersonation-scam claims would trigger a mandatory and time-bound response obligation on the payment service provider. Because PSD3 and the Payment Services Regulation remain agreed but unadopted as at 1 October 2026, this reimbursement obligation and its 15-business-day response window are not yet binding. Consumers reporting authorised push payment fraud today remain subject to the existing PSD2 liability framework, which does not provide the general refund right the agreed text would introduce. This is a significant gap between the consumer-protection outcome widely expected once PSD3/PSR takes effect and the consumer-protection outcome actually available under current law, and it is a gap that secondary-source commentary describing the agreed reforms does not always make clear. #### Outlook The APP-fraud reimbursement question is entirely dependent on the still-outstanding formal adoption of PSD3/PSR, tracked toward an indicative plenary vote of 14 December 2026 and application roughly 21 months after subsequent entry into force. Until that adoption occurs, the absence of a general reimbursement right under PSD2 remains the operative consumer-protection position across the EEA, and firms and consumer advocates alike should treat the Article 59 refund mechanism and its 15-business-day response window as a prospective rather than current obligation. 1 further periodic run re-emitted the standing brief unchanged and is not shown. **Sources and findings (4)** 1. T3 A&O Shearman (citing Article 59 PSR) 2. T1 European Parliament (Tier-1) 3. T3 Moodys (citing IPR/EPC) 4. T3 Flagright / PSP Lab