Scammed or fraudulent bank charge

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Austria yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Belgium yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Bulgaria yet, so only the rules that apply bloc-wide are shown above.

Your money comes back through the bank, not the police. Notifying the issuer without delay is what caps your liability, and federally regulated institutions must fully investigate any transaction you dispute.

Tell your bank or card issuer immediately, then change passwords and PINs.
Write down what happened, how you noticed, and who you spoke to and when.
Report to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca or 1-888-495-8501, and to your local police, who are the ones who actually investigate.
Ask Equifax and TransUnion to place a fraud alert and send you your report.
Keep watching your statements, and use the institution's complaint process if the outcome is poor. Every federally regulated institution must have one.

Bring

Card and account numbers, and the dates, amounts, and merchants of the disputed transactions
Your written timeline and the names of the representatives you spoke to
Your card or account agreement, which is where your actual reporting deadline lives

Cost

Statutory maximum liability for unauthorised use of a bank credit card is $50, unless you were grossly negligent
Deposit accounts: usually 30 days from the statement date to dispute, though it varies by institution
Visa, Mastercard, Amex, and Interac all have zero-liability commitments on top of that

Easy to get wrong. Reporting to the Anti-Fraud Centre feels like the official decisive act, and it is not the one that gets your money back. It is an intelligence repository that supports law enforcement; only notifying your issuer stops the liability clock. People also lose otherwise valid claims through their own conduct rather than the fraudster's, since using your birthday as a PIN, sharing it with family, writing it near the card, or not cooperating with the investigation are all listed grounds for holding you liable. And note that zero-liability is a voluntary card-network promise rather than law, separate from the $50 statutory cap.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Croatia yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Cyprus yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Czechia yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Denmark yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Estonia yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Finland yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

In France

Block the card (faire opposition) and keep the registration number you are given, then dispute with the bank. France adds Perceval, a reporting channel that only fits one specific situation.

Faire opposition at once, through your bank or the interbank server 0 892 705 705, open 24/7. You are given a numéro d'enregistrement, which is your dated proof. Opposition is irreversible even if the card turns up.
Use Perceval only if you still physically hold the card and the details were used online. If the card itself was taken, Perceval is the wrong door and you need a plainte.
Claim the refund from the bank, including any overdraft charges (agios) the fraud caused.
If refused, escalate to the médiateur bancaire, then the courts.

Bring

Your opposition registration number and card number
Statements showing the fraudulent transactions
A FranceConnect account for Perceval

Cost

Perceval is free; the cost of opposition itself varies by bank
Deductible capped at €50 for a lost or stolen card, and not applicable at all where the card was copied or used without its security data

Easy to get wrong. Perceval is only for people still holding their card. If it was physically stolen you need a theft report instead, and filing on Perceval wastes the trip. Visitors hit a harder wall: Perceval works only through FranceConnect, which needs a French tax, health, or La Poste digital identity, so a foreigner generally cannot use it and must go to a commissariat. Note too that the deadline runs from the debit date, and drops from 13 months to 70 days where the payment was made outside the EEA.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Germany yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Greece yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Hungary yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Iceland yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Ireland yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Italy yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Latvia yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Liechtenstein yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Lithuania yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Luxembourg yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Malta yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Netherlands yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Norway yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Poland yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Portugal yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Romania yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Slovakia yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Slovenia yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Spain yet, so only the rules that apply bloc-wide are shown above.

Everywhere in the EU and EEA

PSD2 gives you the same rights in every EEA country. The headline one surprises most people: your bank has to put the money back first and investigate afterwards, not the other way round.

Report it the moment you notice, through any channel the bank offers, and write down the date, time, and reference number. That timestamp is what drops your liability to zero.
Ask for a refund under Article 73(1) by name, and say you expect it by the end of the next business day. Do not accept being told the refund follows the investigation.
If you are told that a correct PIN or password proves you authorised it, push back. Article 72 puts the burden of proof on the bank, and says use of the instrument is not in itself enough to prove you authorised the payment or were grossly negligent.
Ask whether strong customer authentication was applied. If it was not, Article 74(2) removes your liability entirely unless you acted fraudulently.
If they refuse, get the refusal in writing and take it to your national regulator or ombudsman.

Refund: by the end of the following business day after you report it (Article 73(1)). A bank may hold back only if it suspects fraud and has said so in writing to the national authority.
Your maximum loss: €50 (Article 74(1)), and zero once you have reported the card or credentials lost or stolen (Article 74(3)). Some countries set a lower figure.
Outer limit to claim: 13 months from the debit date (Article 71(1)). This is a longstop, not a grace period.

Easy to get wrong. Accepting "we will refund you once our investigation is complete" reverses the law. The refund comes first, by the end of the next business day, and the investigation happens after. The only lawful exception is suspected fraud that the bank has reported in writing to the national authority — an internal review does not count. Separately, if the account is a business rather than a consumer one, Article 61(1) lets the bank contract out of nearly all of this, so check the terms.

We have not checked the local mechanics for Sweden yet, so only the rules that apply bloc-wide are shown above.

Two legally different situations. If you did not consent to the payment, the bank must refund you by the end of the next business day. If you were tricked into sending it yourself, that is APP fraud, and since October 2024 reimbursement is mandatory rather than discretionary.

Contact your bank first, before the police. The bank is the body that owes you money.
Work out which regime applies. Unauthorised, meaning you did not consent, falls under regulation 76 of the Payment Services Regulations 2017. If you were deceived into making a UK transfer over Faster Payments or CHAPS, that is APP fraud.
Report to the police, or give the bank consent to do it for you, which the reimbursement rules list as a claimant obligation.
Answer the bank's information requests promptly, after checking the request is genuine. Firms can pause the clock while gathering information but must reach an outcome within 35 business days.
If refused, escalate free to the Financial Ombudsman Service.

Bring

Transaction dates and amounts, and all correspondence with the scammer
Your police or Report Fraud reference
The bank's final response letter and its date, which starts the Ombudsman clock

Cost

APP fraud: reimbursement within 5 business days, capped at £85,000, with an optional excess of up to £100 that cannot be applied to vulnerable consumers
Unauthorised transactions: your maximum liability is £35 under regulation 77, and nil once you have notified the bank or where the bank failed to apply strong customer authentication
The Financial Ombudsman is free to consumers

Easy to get wrong. Filing with Report Fraud feels decisive and recovers nothing. It gathers intelligence, the police do not investigate every report, and the regulator cannot look at individual cases either. Only your bank can reimburse you and only the Ombudsman can overrule your bank. Two deadlines quietly kill claims: the right to redress for an unauthorised transaction expires 13 months after the debit date, which is how an unnoticed small recurring charge becomes unrecoverable, and the six-month window to escalate runs from the date on the bank's final response letter. Note also that APP protection covers UK bank transfers only, not card, cash, or cheque payments.

Debit and credit are governed by two different federal regimes with different caps and different clocks. On a debit card your liability escalates purely with how fast you report. On a credit card it is capped low, but the dispute has to be in writing.

Tell the bank immediately, by phone or app. Notice counts once you have taken reasonable steps to convey it, even through a different number than the one specified.
For a debit card, report within two business days of learning it is gone to cap your liability at $50.
For a credit card, follow up in writing. A phone call protects your liability cap but does not preserve the dispute right.
If the bank asks you to confirm an oral debit-card notice in writing, send it within 10 business days or you lose the right to provisional credit.
Report to ReportFraud.ftc.gov, file a CFPB complaint, and add IC3 if the fraud was internet-enabled.

Bring

Account number and statements showing the disputed charges
The date you noticed the card was gone and the date you reported it
Notes of your calls and copies of correspondence

Cost

Debit: $50 if reported within 2 business days, $500 within 60 days of the statement, unlimited after that
Credit: $50 maximum for unauthorised use under Regulation Z
No filing fee for FTC, CFPB, or IC3 reports

Easy to get wrong. Two clocks catch people out. The debit-card two-day clock starts when you learn the card is gone, not when a fraudulent charge posts and not when you spot it on a statement, so a card stolen Monday and missed Wednesday must be reported by Friday even if nothing has been charged. And on the credit side, the billing error notice must be written and received within 60 days of the statement — people who call, are told it is handled, and never write are the ones who lose. An issuer may not deny an unauthorised-use claim just because you declined to file a police report.

Scammed or fraudulent bank charge

What this means

Warning signs

Recover now

First 15 minutes

Today

Reporting fraud and getting money back

Verify recovery

Prepare now

Making fraud harder

Making a scam harder to fall for

Making recovery easier

Common mistakes

Sources