#
Consumer protection in Italian payments runs through Banca d'Italia's transparency/fairness supervisory mandate and the ABF ombudsman scheme. PSD2 (as transposed by D.Lgs. 11/2010) caps consumer liability for unauthorised payments at EUR50 and requires bank refunds for unauthorised transactions, but there is no automatic reimbursement scheme for authorised push-payment (APP) fraud/scams -- victims must rely on bank goodwill, fund recall, ABF escalation, or criminal reporting via Polizia Postale.
Outlook
This remains an under-indexed area: recovery-rate data for Italian APP-fraud victims was not surfaced this cycle, and the comparative gap with UK-style mandatory reimbursement is worth deeper sourcing of Polizia Postale recovery statistics next cycle.
Consumer Protection & APP Fraud
The PSD3/PSR compromise text, carried in the Council of the EU's 23 April 2026 'I' Item Note, introduces two consumer-protection-relevant obligations bearing directly on Italy's future payment-service landscape once the regime is formally adopted. The first is mandatory IBAN-and-name verification: payment transfers would require verification that the account name matches the IBAN provided, a mechanism intended to catch a common vector in authorised-push-payment fraud where victims are induced to transfer funds to an account under a different name than the one they believe they are paying.
The second is an expanded PSP liability regime for authorised-push-payment fraud: under the compromise text, payment service providers face expanded liability to reimburse fraud victims specifically where the PSP did not meet expected detection standards. This shifts a portion of APP-fraud loss exposure onto PSPs in circumstances where their own detection systems fell short of the expected standard, rather than leaving the loss entirely with the defrauded consumer.
Both obligations remain pre-adoption. The compromise text has reached an advanced legislative stage, with COREPER approval invited following the 23 April 2026 'I' Item Note, but formal adoption of PSD3/PSR has not yet occurred, and neither the IBAN/name-verification requirement nor the expanded APP-fraud liability standard is yet binding on Italian PSPs. Once adopted, both provisions would apply within the same single-licensing PSD3/PSR framework covering Italy's EMI/PI authorisation landscape.
Outlook
Formal adoption of PSD3/PSR, expected as scheduled toward Q4 2026, is the trigger event that would bring the IBAN/name-verification and expanded APP-fraud-liability obligations into force for Italian PSPs. Until adoption occurs, Italian consumers' practical protection against authorised-push-payment fraud continues to operate under the existing pre-PSD3 framework, and PSPs should treat the compromise text's provisions as a forward compliance requirement to prepare for rather than a currently binding obligation.
Sources and findings (4)
- T3https://ministryofcyberaffairs.com/news/how-to-report-cybercrime-in-italy-and-get-your-money-back-879fad32-91b5-4d61-9dd7-979570edf33bretrieved
- T1https://www.arbitrobancariofinanziario.it/abf/index.html
- T1https://economiapertutti.bancaditalia.it/aree-tematiche/diritti-e-tutele/arbitro-bancario-finanziario/index.html
- T4https://veritas-advisory-group.com/litigation-by-country/italy/retrieved