--- title: "EBA Q&A 2018_4042 — Q&A — Liability for fraud when SCA exemption used [Final Q&A]" shortTitle: "EBA Q&A 2018_4042 — Q&A — Liability for fraud when SCA exemption used [Final Q&A]" answer_id: EBA_QA_2018_4042 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 74 PSD2" date: 19 July 2019 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4042 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 19 July 2019" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4042" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "European Commission" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the European Commission because it is a matter of interpretation of Union law." locator: "EBA Q&A register entry 2018_4042, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2019-07-19" question_submitted_on: "2018-06-28" locators: published_on: "EBA Q&A register entry 2018_4042, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4042, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer prepared by the European Commission, published in the EBA Q&A tool · not legislation · published 19 Jul 2019 [Final Q&A]** *Final Q&A · EBA Q&A register, 19 July 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4042)* | | | |---|---| | **Full title** | EBA Q&A 2018_4042 — Q&A — Liability for fraud when SCA exemption used \[Final Q&A\] | | **Prepared by** | European Commission | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4042 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 19 July 2019; question submitted 28 June 2018 | | **Legal basis** | Article 74 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Liability for fraud when SCA exemption used** ### Question Who is liable for fraud on Strong Customer Authentication (SCA) exempted transactions? Which payment service provider (PSP) is liable (payer’s or payee’s) when both PSPs choose to trigger an exemption to SCA? ### Background The current legal text in the Directive and the Commission Delegated Regulation (EU) 2018/389 do not provide clarity on the impact (if any) on liability for fraudulent transactions in instances where an SCA exemption has been triggered. In particular, both payer and payee PSPs are able to trigger certain SCA exemptions and it is not clear if there is any impact on liability based on which PSP triggers an exemption. A lack of clarity on liability on SCA-exempted transactions that turn out to be fraudulent could lead to difficulties resolving consumer complaints around fraudulent transactions and undermine efforts to manage processes and solutions for reducing fraud. *** ### Answer Article 73(1) of PSD2 states that in the case of an unauthorised payment transaction the payer's payment service provider (PSP) refunds the payer the amount of that transaction. In accordance with Article 74(2) of PSD2, “Where the payer’s payment service provider does not require strong customer authentication \[SCA\], the payer shall not bear any financial losses unless the payer has acted fraudulently. Where the payee or the PSP of the payee fails to accept strong customer authentication, it shall refund the financial damage caused to the payer’s payment service provider.” Article 74(2) PSD2 may be dis-applied if the payment service user is not a consumer (Article 61(1) PSD2). It follows from the above that unless the payer acted fraudulently, the payer’s PSP is liable towards that payer for transactions carried out without SCA. If the PSP of the payee triggers an SCA exemption and the transaction is carried out without an SCA, the payee's PSP will be liable towards the payer's PSP for the financial damage caused. This is without prejudice to the obligations of the payer's PSP towards the payer as referred to above. Disclaimer: This question goes beyond matters of consistent and effective application of the regulatory framework. A Directorate General of the Commission (Directorate General for Financial Stability, Financial services and Capital Markets Union) has prepared the answer, albeit that only the Court of Justice of the European Union can provide definitive interpretations of EU legislation. This is an unofficial opinion of that Directorate General, which the European Banking Authority publishes on its behalf. The answers are not binding on the European Commission as an institution. You should be aware that the European Commission could adopt a position different from the one expressed in such Q&As, for instance in infringement proceedings or after a detailed examination of a specific case or on the basis of any new legal or factual elements that may have been brought to its attention. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4042) ## Related Level 1 articles - [Article 74 — Payer’s liability for unauthorised payment transactions](../../../articles/74.md)