Payment Service Deal: What Europe’s New Online Security Rules Mean for Users

Published: 28 Nov 2025

Author: Precedence Research

Share :

The European Union, well known for its stringent data protection rules, has once again rolled out new rules to address online fraud and data hacking, which are expected to protect the confidentiality of sensitive user information and make the digital landscape safer for everyone.

The deal happens between the EU member states and the EU parliament. This deal unveils new rules to force banks and payment service providers to improve visibility and detection of online fraud, eliminate hidden costs, and enhance privacy against data leaks by third parties or anonymous members. This new legislation works to shift liability to financial providers and online platforms.

As per a statement by the European Commission, “on Thursday morning, parliament and council negotiators agreed on the payment services regulations and third payment service directive.” They further added, “The regulation aims to harmonize payment services and strengthen fraud prevention across the EU. It applies to payment services provided by banks, post-office and payment institutions, as well as technical service providers supporting payment services and, in some cases, electronic communications providers and online platforms. The directive seeks to ensure fair competition among payment service providers by addressing authorization and supervisory powers and to improve access to cash, particularly in remote areas.”

The major goal of these rules is to ensure that consumers are not solely responsible or left alone without backup when fraud occurs due to failures in security measures. According to these rules, to mitigate fraudulent activities, a service provider must set rules on spending limits and blocking measures. This means that if anyone attempts to initiate fraud intent changes on a transaction, it will be treated as a rule violation and an unauthorized transaction, and the PSP will be responsible for the fraudulent intent and the full amount of the refund. Suppose the scammer pretends to be an employee of any organization and tricks a consumer into approving a payment. In that case, service providers should refund the full amount if the customer reports the fraud to the police and informs their PSP.

By extending this, the commission stated, “In addition, advertisers of financial services must show very large online platforms and search engines that they are legally allowed in the relevant country to offer those services, or that they are advertising on behalf of someone who is.”