Under a derogation from Article 73, the payer may be liable for losses from unauthorised payment transactions up to EUR 50 where a payment instrument is lost, stolen or misappropriated. That cap does not apply if the loss was not detectable to the payer prior to payment (except where the payer acted fraudulently) or where the loss resulted from acts or omissions of a payment service provider’s employee, agent, branch or an outsourced entity. The payer bears all losses where the payer acted fraudulently or failed to fulfil Article 69 obligations with intent or gross negligence; Member States may reduce liability where the payer neither acted fraudulently nor intentionally breached Article 69, taking into account personalised security credentials and circumstances.

If the payer’s payment service provider does not require strong customer authentication (SCA), the payer does not bear financial losses unless fraudulent; where the payee or its provider fails to accept SCA, it must refund the damage to the payer’s provider. The payer is not liable for use of the instrument after notification under Article 69(1)(b), except in cases of fraud. If the provider does not provide appropriate means for notification at all times under Article 70(1)(c), the payer is not liable for resulting financial consequences, except where fraudulent.