PSD2 — unauthorised transactions and direct-debit refunds (Directive (EU) 2015/2366)

The clocks it starts

• Notify the provider (without undue delay, and at the latest 13 months)Fatal if missedArticle 71(1) requires notification without undue delay on becoming aware, and in any event no later than 13 months after the debit date. The 13 months is generous by design and runs from the debit, not from when you noticed. Read Article 71(1) to the end, though: the time limit applies only where the provider actually gave you the transaction information required by Title III. If it never sent you statements, the bar does not run against you.PSD2, Article 71(1) — Art. 71(1) — the payer obtains rectification only if it notifies its provider without undue delay on becoming aware, and no later than 13 months after the debit dateNotice period
• Provider must refund by the end of the next business dayArticle 73(1): the provider must refund the amount "immediately, and in any event no later than by the end of the following business day" after noting or being notified of the transaction, and must restore the debited account to the state in which it would have been had the transaction not taken place — value date included. It may reverse the credit later if it establishes fraud, but it must pay first. (Period: 1 business day. We need the start date to work out your exact deadline.)PSD2, Article 73(1) — Art. 73(1) — refund immediately and in any event no later than by the end of the following business day, restoring the account to the state it would have been inResponse due

What it entitles you to, beyond money

• Refund first, investigate afterwardsArticle 73(1) is not conditional on the outcome of an investigation. If the provider suspects fraud by you it may, after refunding, investigate and reverse — but the sequence is fixed by the Directive and putting it the other way round is a breach.Art. 73(1) — refund immediately and in any event no later than by the end of the following business day, restoring the account to the state it would have been in
• No strong customer authentication means no liabilityArticle 97 makes strong customer authentication mandatory for remote electronic payments. Article 74(2) provides that where the provider does not require it, the payer bears no financial consequences unless the payer acted fraudulently. Ask the provider, in writing, to confirm whether SCA was applied to this transaction and to produce the authentication record. An evasive answer is usually the answer.Art. 74(1) — maximum payer liability of EUR 50 for unauthorised transactions from a lost, stolen or misappropriated instrument, with exceptions; Art. 74(2) — no liability at all where the provider does not require strong customer authentication
• The bank has to prove it, not youArticle 72(1) puts the burden on the provider to prove that the transaction was authenticated, accurately recorded and not affected by a technical breakdown. Article 72(2) adds that the mere fact the provider recorded use of the instrument "is not in itself necessarily sufficient" to prove authorisation, fraud, intent or gross negligence.Art. 72(1)-(2) — the burden is on the provider to prove authentication and authorisation; use of the instrument recorded by the provider is not in itself sufficient to prove authorisation, fraud, intent or gross negligence
• Interest and value dating restoredRestoring the account "to the state in which it would have been" includes the credit value date being no later than the date the amount was debited, so any overdraft interest or fees the debit triggered must come back too.Art. 73(1) — refund immediately and in any event no later than by the end of the following business day, restoring the account to the state it would have been in

What the other side will say

Each of these is a refusal this regime lets a counterparty attempt, paired with the answer to it. Reading them before you write is worth more than any amount of polish on the letter itself.

Where to take it next

1. 01Written notification to your payment service providerState the transaction date, amount and payee, say that you did not authorise it (or that you are exercising the Article 76 refund right), and require the refund under Article 73(1) by the end of the next business day. Ask expressly whether strong customer authentication was applied and for a copy of the authentication record.Claim direct·typically 2 days
2. 02Formal complaint under the provider's Article 101 procedureArticle 101 requires providers to have a complaints procedure and to reply in a durable medium, addressing every point raised, within 15 business days (extendable to 35 in exceptional cases). Insist on a written reply that engages with Articles 73 and 74 by name — it is the document the ADR body will read first.Internal appeal·typically 15 days
3. 03National alternative dispute resolution bodyArticle 102 obliges Member States to provide ADR for payment-service disputes. Ireland has the Financial Services and Pensions Ombudsman, Italy the Arbitro Bancario Finanziario, Germany the Bundesbank and the private banking ombudsmen, France the Médiateur de l'AMF or the bank's own médiateur, Spain the Banco de España. Almost all are free to consumers.Alternative dispute resolution·typically 90 days
4. 04FIN-NET for a cross-border disputeIf your provider is established in a different EEA state from the one you live in, FIN-NET will route the complaint to the right national scheme. It is a Commission-run network and costs nothing.Alternative dispute resolution·typically 120 days·official page
5. 05National competent authorityEach Member State designates an authority to supervise PSD2 compliance — BaFin, the ACPR, the Central Bank of Ireland, De Nederlandsche Bank, the Banca d'Italia. They do not award you compensation, but a supervisory complaint about a provider that systematically ignores Article 73(1) has weight.Regulator·typically 120 days
6. 06National court or the European Small Claims ProcedureFor a cross-border claim up to EUR 5,000, Regulation (EC) No 861/2007 provides a written, form-based procedure in your own courts with a judgment enforceable across the Union. Domestic small-claims routes are usually cheaper still.Small claims·typically 180 days