# EU Regulations Mandate Banks Refund Victims of Impersonation Fraud New PSR rules require banks to reimburse spoofing victims within 15 business days. - **Source:** [Bankier.pl](https://www.bankier.pl) - **Published:** 2026-11-09 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/ee6336ee-adb0-4faa-825f-b1768dd1f2d0 ## New EU Payment Rules The European Union is finalizing the Payment Services Regulation (PSR) and the PSD3 directive to overhaul financial security. Following the Council of the EU's initial approval on November 5, the legislation awaits a final plenary vote in the European Parliament. These rules aim to standardize consumer protection across all member states. ## Targeting Impersonation Fraud The regulation specifically addresses impersonation fraud, commonly known as spoofing. Banks will be held liable when criminals exploit official communication channels, such as domain names, email addresses, or mobile applications. This shift forces financial institutions to take greater responsibility for security failures that occur within their own digital service ecosystems. ## Mandatory Refund Timeline Under the new PSR framework, victims of authorized fraudulent transactions are entitled to a full refund from their payment provider. Banks must process these reimbursements within 15 business days. To qualify, consumers must report the incident to their provider without delay and file an official report with the local police authorities. ## Burden of Proof Financial providers can only deny refunds if they prove the consumer acted with fraudulent intent or gross negligence. The burden of proof rests entirely on the bank. Institutions cannot refuse a claim based on missing evidence that a customer could not reasonably be expected to provide, such as recordings of private calls. ## Four-Hour Cooling-Off Period To prevent immediate theft, the PSR introduces a mandatory four-hour waiting period for remote transaction limit changes. This cooling-off mechanism applies to mobile app activations and limit adjustments. Even if a user attempts to bypass this via strong authentication, the delay remains in effect to protect accounts from rapid unauthorized access. ## Standardizing Transaction Limits The regulation mandates equal treatment for instant transfers compared to standard payment orders. Banks are prohibited from imposing more restrictive limits on instant transfers than those applied to regular transactions. Furthermore, providers cannot unilaterally alter the transaction thresholds that customers have personally established within their mobile banking or internet banking platforms. ## Scope of Liability The new liability rules apply specifically to scenarios where attackers pose as payment service providers. This includes incidents involving fake mobile applications, fraudulent banking websites, or callers posing as bank consultants. By covering these specific digital vectors, the EU aims to close loopholes that previously left many victims without any financial recourse. ## Impact on Banking Operations These regulations represent a significant shift in the European financial landscape, moving liability from the consumer to the institution. Banks must now invest heavily in fraud detection and secure communication protocols. This legislative update, evolving since 2024, forces a higher standard of care for all digital payment services across Europe. ## Sources covering this story - https://www.bankier.pl/wiadomosc/Banki-zaplaca-za-podszywaczy-Wieksza-ochrona-platnosci-juz-blisko-9225493.html?utm_source=RSS&utm_medium=RSS&utm_campaign=Wiadomosci — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._