Does PSD3 make banks refund fraud victims?

Yes, in certain cases. Under the PSR, a customer tricked by someone impersonating their bank gets a full refund, provided the fraud is reported to the police and the bank. PSPs that lack adequate fraud prevention, such as payee name checks, must also cover losses.

Why the change

PSD2 protected customers against unauthorized payments, but not against authorized push payment fraud, where the victim is manipulated into sending money themselves. Impersonation scams, by phone, text or fake websites, grew quickly and left many victims without recourse.

What the new rules cover

• Bank impersonation fraud: refund when the customer was deceived by someone posing as their bank, under the stated conditions.
• Payee name mismatch: liability when the PSP failed to run or act on a payee name check.
• Shared responsibility: provisions involving electronic communication services and online platforms in the fight against fraud.

What is not covered

Gross negligence by the customer can limit the refund. Not every scam qualifies: the impersonation rule targets fraudsters posing as the customer's own PSP.

Timing

These rules apply once the PSR is in force and its application date has passed.

What it means for payment operators

If you operate accounts or initiate payments, refund liability raises the stakes on fraud monitoring and payee checks. Configurable fraud rules, monitoring and clear audit trails help you show that adequate prevention was in place.