Cloned Websites Are Now in the EU’s Draft Payment Rules

The EU’s draft Payment Services Regulation goes further on impersonation fraud than many early read-throughs suggested. For PSPs, the useful bit is not the political theatre; it is the direction of liability, which is already visible in court decisions across Europe before the new rules even start applying.

1. In October 2024, France’s highest civil court upheld an order requiring a bank to refund €54,500 to a customer who had been talked into a series of transfers by a fraudster calling from what appeared to be the bank’s own phone number. In the court’s translation, a call arriving through the bank’s genuine displayed number “put the customer in confidence and diminished his vigilance”, so the loss stayed with the bank because the customer had not been grossly negligent.
2. The draft Payment Services Regulation was politically agreed in November 2025, with compromise texts finalised this spring and formal adoption still ahead. Article 59, the impersonation fraud provision, says that if a consumer is manipulated by a criminal posing as the consumer’s own payment service provider, the provider must refund the full amount within 15 business days of receiving the notification and the police report, unless it can prove the consumer acted fraudulently or with gross negligence. The burden of proof sits with the provider, and the draft sets no cap.
3. On the current timetable, application lands around 2028. That matters because Article 59 is already shaping the commercial risk picture well before the start date: it is not being drafted as a niche edge case, but as a broad reimbursement rule for impersonation fraud.
4. Many early analyses still describe Article 59 as the 2023 Commission proposal did, focusing on impersonation via the provider’s “name, e-mail address or telephone number”. The compromise text no longer uses that closed list. The operative wording is broader, which means cloned websites sit much closer to the centre of the rule than many firms initially assumed.

The thing for high-risk payment providers is straightforward: once cloned websites are inside the rule’s scope, the question is no longer whether a fraud was “technical” or “social-engineering adjacent”. The question becomes whether the provider can defend the customer loss under a reimbursement regime that already points toward tighter liability, not looser liability.