Payment Services Directive (PSD2)
The Payment Services Directive 2 (PSD2) is the EU directive governing payment services and payment service providers. Applicable since January 2018, PSD2 establishes the rights and obligations of payment service users and payment service providers, including rules on authorisation of payment transactions, liability for unauthorised payments, and access to payment systems. For victims of financial fraud who made payments via bank transfer or card, PSD2 defines many of the rights and procedures that are central to fund recovery efforts.
Key Provisions of PSD2
PSD2 governs all payment services provided within the EU, including credit transfers, direct debits, card payments, and electronic money transactions. It requires payment service providers to be authorised or registered and subjects them to conduct and organisational requirements.
The directive also introduced Strong Customer Authentication (SCA), requiring two-factor authentication for electronic payments to reduce the risk of fraud. It established the framework for open banking, allowing authorised third-party providers to access payment account information with the customer's consent.
Liability for Unauthorised Transactions
Under Article 73 of PSD2, when an unauthorised payment transaction occurs, the payment service provider must refund the amount of the unauthorised transaction immediately, and in any event no later than the end of the following business day. The payer's liability is limited to EUR 50 for unauthorised transactions resulting from a lost or stolen payment instrument, unless the payer acted fraudulently or with gross negligence.
This provision is particularly relevant in cases where the victim's payment instrument was compromised, or where the victim authorised a payment based on false pretences created by the fraudster. The interpretation of "authorisation" in the context of socially engineered fraud is an evolving area of law and regulation.
Rights Regarding Credit Transfers
- Right to information: Payment service providers must provide clear information about the execution of payment transactions, including charges, exchange rates, and the execution timeline.
- Execution timelines: Credit transfers within the EU must be executed by the end of the next business day after the payment order is received.
- IBAN-only rule: Under SEPA credit transfer rules, the payment service provider executes the payment based solely on the IBAN. If the IBAN and the payee name do not match, the provider is not liable for executing to the wrong recipient unless confirmation of payee services are in place.
- Recall rights: While PSD2 does not explicitly mandate a recall right for authorised payments, the SEPA Credit Transfer Rulebook (which operates within the PSD2 framework) provides a recall procedure for payments where the payer's bank identifies grounds for recall.
Strong Customer Authentication (SCA)
PSD2 requires Strong Customer Authentication for electronic payments, meaning that the payer must authenticate using at least two of three elements: something they know (password, PIN), something they have (phone, token), and something they are (biometric). The aim is to reduce the incidence of payment fraud.
In fraud cases where the victim authenticated the payment themselves (albeit under manipulation by the fraudster), the question of whether SCA was properly applied and whether the payment service provider met its obligations under PSD2 can be relevant to liability assessments.
Relevance to Fraud Victims
- If your payment was truly unauthorised (you did not initiate or consent to the transaction), PSD2 requires your bank to refund you immediately.
- For authorised push payment fraud (where you were tricked into making the payment), the PSD2 framework is less clear, and outcomes depend on the specific circumstances and national implementation.
- PSD2 obligations require your bank to have adequate fraud prevention systems in place. If the bank failed to detect an obviously suspicious transaction, this may support a complaint.
- The SCA requirements mean your bank should have required proper authentication. Failures in this process can shift liability.
- EFPG references PSD2 in preparing banking correspondence and regulatory complaints related to payment fraud.
Official Source
European Commission PSD2 Overview
Need Advisory Support?
If you have been affected by financial fraud and require structured advisory support, submit your case for a free preliminary assessment.
Request Case Assessment