Identity Theft in Consumer Finance: Consent, Contract and Liability

2.1 Strong Customer Authentication and Electronic Signatures

The use of eID as referred to in this article encompasses both what is typically referred to as authentication and the production of electronic signatures. Authentication in the context of electronic commerce is the verification of the identities of the parties.¹⁵ The bank wants to know that only person A can log in to a bank account and therefore asks person A for authentication during login. Authentication can take the form of a simple login with a username and password. Modern online services, including financial service providers, typically demand that payment service providers use ʻstrong customer authentication’ (SCA). Under PSD II, SCA requires authentication to be ʻbased on the use of two or more elements categorised as knowledge …, possession … and inherence’.¹⁶ This generally involves the consumer having to use a particular object (eg their mobile phone, a code generator or an identity card) in conjunction with passwords or biometrics. The consumer is typically obligated to protect access to their eID from third parties through standard terms and legislation.¹⁷

An electronic signature ties such an authentication procedure to other data, usually a document.¹⁸ Businesses can use electronic signatures to indicate that a consumer has not only confirmed their identity but also accepted a particular course of action, such as their agreement to a contract. Electronic identity systems and electronic signatures are subject to regulatory rules in the current eIDAS regulation, which distinguishes between different levels of security. Under Article 26, an electronic signature is ʻadvanced’ if it satisfies certain requirements for technical and operational security.¹⁹ Systems for ʻqualified’ signature certificates – the highest level of security – must also comply with a list of regulatory requirements and receive certification from national competent authorities.²⁰

2.2 Relevant eID Systems and How They Are Misused

In Norway and Estonia, public or de facto public eID systems are widely used for private transactions. In Estonia, for example, consumers can choose between using the digital operability of their national ID card, their mobile ID (SIM card-based eID carrier) and their Smart ID (smart device-based eID carrier) for authentication.²¹ For all these carriers, the consumers enter their social security number, a private 4-digit code to authenticate themselves and, if applicable, an additional 5-digit code to provide an electronic signature. Estonians use eID widely for everyday transactions and operations. In a country of roughly 1.4 million people, 12.5 million ID card transactions are made annually, and 3 million electronic signatures are given monthly.²² The electronic signatures used in Estonia are all ʻqualified’ electronic signatures under the eIDAS scheme.²³

In Norway, consumers mostly use BankID, an eID system developed by the Norwegian financial industry. BankID serves as a de facto public eID used for tax reporting, applying for higher education and booking healthcare appointments.²⁴ BankID is used both for authentication of payments and for electronic signatures on credit agreements.²⁵ The authentication process is largely similar to the Estonian one, although an additional code is not required for electronic signatures.²⁶ A consumer can choose between using their mobile phone as a carrier or using a code generator.²⁷ BankID is not a qualified signature under the eIDAS regulation.²⁸

Introducing secure two-factor authentication systems has been a major focus of European lawmakers in the area of digital finance.²⁹ Unfortunately, experiences from Norway and Estonia show that the adoption of technically sound eID systems for strong customer authentication does not eliminate fraud. Fraudsters are highly adaptable. They target the weakest links – the consumers themselves – and misappropriate eIDs by gaining security credentials in a myriad of deceitful ways. One common type of eID fraud is to steal or misappropriate the relevant physical object, such as a code chip, mobile phone or ID card, and somehow learn the passwords or codes. A reading of Norwegian case law reveals many examples of fraudsters gaining access to physical carriers and passwords.³⁰ In many cases, the fraudster is someone close to the victim, such as a spouse or a child.³¹ In Estonia, there are several court cases in which fraudsters have gained access to the ID card and the two PIN codes necessary for authentication or producing a signature.³²

It is also possible to defraud someone without gaining physical control of a mobile phone, card or a similar physical carrier. Many cases involve phone calls in which professional fraudsters impersonate police officers or bank employees and ask for PIN codes and other relevant data under the pretence that they require such information to stop an ongoing cyberattack towards the consumer – a technique often called ʻvishing’.³³ Such social manipulation might convince consumers to reveal their passwords or one-time codes from the carrier so the fraudsters can use them.³⁴ These methods may also be used to trick the consumer into authenticating a payment or credit contract directly. The fraudster might present themselves as calling from the authorities and explain that the victim needs to verify their identity to protect themselves from an ongoing cyberattack. While on the phone, the fraudster can send authentication requests, which the consumer is manipulated into answering, by scanning their face or entering a password on their device. As they speak, the fraudster logs into the consumer’s online bank account.³⁵ Fraudsters also still rely on phishing, in which the victim enters valid codes and passwords into fake websites with the mistaken belief that they are logging on to their online bank or a government website.³⁶ A particularly hazardous situation can arise if a fraudster circumvents the security measures in an application process and orders a fraudulent eID in the victim’s name.³⁷

These techniques can allow fraudsters to both access the consumer’s online bank and accept credit contracts. In one case, the fraudster gains authentication to log into the victim’s online bank and then authenticates/provides an electronic signature to a bank transfer,³⁸ and in the other case, they apply for and then consent to a credit agreement (typically by providing an electronic signature). In both cases, the basic trick is getting between the bank and the consumer by using eID and relying on smooth and quick payment and credit systems to obtain funds quickly. Both types of fraud can be perpetrated by professional fraudsters or by persons close to the victim – such as a friend, spouse or family member – who have exploited the victim’s trust.

3.1 Contract Formation and Evidentiary Rules

In this section, we examine how Norwegian and Estonian law treat cases in which a consumer alleges that a fraudster has entered a credit agreement through the appropriation of their digital identity. In both countries, a statement made in another’s name without their permission generally does not bind the latter contractually.³⁹ The use of eID does not, on its own, alter that fundamental starting point. However, a consumer who is not able to prove that they did not perform (or consent to) the action in question remains bound by the contested contract. A question arises: How should we assess evidence when a consumer claims that a fraudster acted in their name without their permission?

In Estonia, the bar for courts to believe consumers in such cases is high. In 2019, the Estonian Supreme Court considered a case in which a consumer claimed that a credit purchase was the result of a third person using their electronic identity. The Court concluded that if a contract is signed digitally using the owner’s ID card and PIN codes, it should be assumed that the owner of the ID card has signed the contract.⁴⁰ The court also indicated that the burden of proof lies with the consumer to show that someone else signed the contract and that the alleged third party acted against their will.⁴¹ It is insufficient for the consumer to prove that the contract was concluded by a third party. Lower courts have followed this reasoning and found there to be a contract between the owner of the eID and the creditor in similar cases.⁴²

Moreover, Estonian civil procedures contain rules on the presumed authenticity of documents signed electronically, which further emphasise the burden of proof for the consumer. A special rule on contesting the authenticity of an electronic document with a digital signature can be found in § 277 (3) of the Code of Civil Procedure.⁴³ The consumer can only contest an electronic document’s authenticity if the alleged signatory can provide sufficient facts to substantiate their claim of fraud. This provision thereby constitutes a presumption of the digital signature’s authenticity based on its recognised security and the ability to verify its authenticity through national electronic certification procedures.⁴⁴ This is a clear deviation from the main rule for physical signatures on documents, where a mere contestation of the authenticity of the document is sufficient to bring a case.⁴⁵

There are no similar rules in Norwegian civil procedure regarding electronically signed documents; general evidentiary principles apply.⁴⁶ A sceptical line towards consumer claims of fraudulent eID use was nonetheless cemented by the Supreme Court in a case from 2017 that concerned unauthorised payments and was understood by lower courts to provide guidance in cases concerning credit agreements.⁴⁷ The reasoning in these cases was that it fell on the consumer to prove that the eID was used without their consent, as long as the technical aspects of the authentication procedure were without fault.⁴⁸

Through the new Financial Contracts Act, which entered into force in 2023, the Norwegian legislator adjusted the framing of the evidentiary question in the consumer’s favour. Building on the rule found in PSD II Article 72 (2), the law now states that the mere use of the relevant eID should not, on its own, be taken as conclusive evidence of the consumer’s knowledge of the transaction.⁴⁹ Further, the statute demands that the credit institution show to a ʻqualified’ degree that the consumer knew of the transaction for this fact to be considered established.⁵⁰ In theory, this should mean that a 50/50 situation should fall in the consumer’s favour, but to date, there is no case law referring to this provision. The use of an eID may still carry significant weight as evidence that the consumer entered the contract or that they gave their consent for a third person to enter the contract in their name, as it is not trivial for a third party to access someone’s eID. The bank must, however, actively make a case against the consumer’s own explanation of the facts.⁵¹

3.2 Liability Under Contract or Tort Law

If the consumer successfully shows that a fraudster made the commitment in their name, the focus will turn to whether they are legally responsible for the consequences of the fraudster’s actions. One possible argument for holding the consumer accountable is the concept of apparent authority.⁵² In eID fraud cases, the credit provider often argues that the fraudster had apparent authority because they failed to act in accordance with the terms and conditions of the electronic identity certificate (acting negligently), for example, by allowing a family member to use the eID or being tricked into providing passwords in a ʻvishing’ scheme.

In the above-mentioned case from 2019, the Estonian Supreme Court indicated that the misuse of an eID by a fraudster may lead to a binding credit contract between the creditor and the consumer through rules on apparent authority.⁵³ Although this observation was only made in passing, the Court indicated that such an application of apparent authority is probable under Estonian law. The Estonian Act on the General Part of Civil Code⁵⁴ (GPCC) recognises two different cases of apparent representation. One case arises when the principal knew of transactions made in their name and tolerated them (talumisvolitus), and the other occurs when the principal did not know of the transaction but should have known (näivusvolitus). According to § 15 (4) of the Law of Obligation Act⁵⁵ (LOA), the person should have been aware of the circumstances if they were unaware of them due to gross negligence. This means that the owner of the eID failed to exercise necessary care to a material extent.⁵⁶ The Supreme Court has stated that the owner of the eID must practise a high level of care while handling and safekeeping their card and PINs. Taken together, the statements made by the Supreme Court indicate that failure to protect electronic identity from fraud could conceivably be used as a basis for a contractual claim based on apparent authority, although there is no case law to this effect yet.⁵⁷ In both Sweden and Denmark, doctrines of apparent authority have been used to hold consumers accountable in supreme court cases, although one can hardly speak of a general rule to this effect, as both supreme courts seem to reserve room for factors specific to the case on the sides of both the lender and the consumer.⁵⁸

In Norway, the view has been that third-party identity fraud does not give rise to apparent authority. However, credit providers have – often successfully – argued that the consumer’s negligence gives rise to a claim based on tort law. The basis of the tort claim is typically as follows: having lent to what turned out to be a fraudster, the bank has suffered a loss. The bank sues to shift this loss to the BankID owner because they failed to show the necessary care in using and storing the code chip or password, thereby acting negligently.⁵⁹ Many such cases appeared in Norwegian courts during the 2010s.⁶⁰ When judging the degree of diligence required by the consumer, Norwegian courts typically looked to the rules in the then-existing Financial Contracts Act transposing PSD I Article 56 (now PSD II Article 69), which required a customer to take ʻall reasonable steps’ to protect personalised security credentials and to adhere to the terms and conditions of the payment instrument.⁶¹ These terms typically forbid sharing passwords or objects and require a high degree of diligence.⁶² At the same time, the courts, by and large, rejected any analogy from the liability limits in PSD II and insisted that ʻmere negligence’ regarding the protection of security credentials and the BankID code chip would be sufficient to establish a claim.⁶³ The possibility of suing allegedly negligent consumers for damages served as a replacement for a valid contract. In many cases, this approach left consumers responsible in situations where they had not willingly provided the fraudster with the means to use the eID. The claims were often for significant amounts of money.⁶⁴

Partly because of significant academic and political debate, two developments have subsequently limited the ability of credit providers to succeed with these claims. First, in such a tort case in 2020, the Supreme Court issued a judgment regarding eID misuse.⁶⁵ The case concerned an eID owner who had kept his code chip in a purse in a closet in his workplace, where it was misused by people who had access to the location.⁶⁶ The Supreme Court accepted that it was unwise to leave the code chip in his work closet over the holidays,⁶⁷ but found this lack of care insufficient to establish a claim on the bank’s behalf.⁶⁸ The lack of additional mechanisms of control, such as a text message to the supposed loan applicant or a letter to his digital mailbox, as well as the fact that the loan had been paid to an account registered to a third person, meant that the bank could not invoke the consumer’s lack of care as negligence.⁶⁹ The decision was widely regarded as corrective to the lower courts on the issue of consumer liability in eID fraud credit contracts.

A new Financial Contracts Act was also passed by Parliament in 2020 and entered into force in 2023. In this reform, the PSD II limitations on consumer liability in payment transactions were applied to misused electronic signatures.⁷⁰ In the area of financial services, misuse of electronic signatures now leads to a 12 000 NOK (approximately 1000 euros) liability if the consumer is grossly negligent, and full liability if there has been an intentional violation of the consumer’s duties to protect and safeguard their electronic identity.⁷¹ The requirement regarding intent means that the consumer must have understood that they acted in violation of the terms and conditions and the risk they generated by their negligent action.⁷² The bar is intentionally set high, and falling for professional fraud like ʻvishing’ is unlikely to lead to full liability.⁷³

3.3 Assessment

The liability question for fraudulent credit contracts clearly raises difficult problems of both fact and law in both countries. Rules for assessing evidence seem to play an important role. The sides of the dilemma are clear. Credit providers may argue that courts should presume electronic identities to be genuine so that businesses feel secure in relying on them and thereby fully realise the efficiency gains of digitisation. Further, there is fear that bad actors could use fraudulent claims of third-party misuse to defraud banks. On the other hand, consumers are generally at a disadvantage in terms of knowledge and resources when battling a professional creditor in court, and this also applies to the gathering of evidence. In Norway and Estonia, the eID systems in question are, de jure or de facto, public systems relied upon for crucial public services. As a result, citizens cannot realistically choose to live without such a digital identity. If we operate from strong presumptions about the authenticity of electronic signatures, we are likely to see many cases solved based on evidentiary rules alone, which is worrisome when the misuse of digital identity is widespread and acquiring an eID can hardly be considered a choice.⁷⁴

From these reviews of national law, it seems that Estonian and Norwegian law currently strike the balance in different ways. The rule operating in Estonia is significantly harsher on consumers than the one in the Norwegian Financial Contracts Act. The Estonian civil courts, as a rule, find there to be a valid contract between the consumer and the creditor, and it is complicated for the consumer to prove that they were not the person signing the contract. Even if they can prove that a third person has used their eID to sign a consumer credit contract, it is very difficult to prove, as the Estonian Supreme Court wants, that possession of the eID was lost against their will. In general, one would think scepticism was warranted towards evidentiary presumptions for the genuineness of electronic signatures, given the high propensity of fraud. However, much can also depend on how strong such a presumption is.⁷⁵ If it can be overturned by presenting a police report and a somewhat coherent story, a presumptive rule is not necessarily particularly burdensome. For example, the Swedish Supreme Court has advanced an evidentiary presumption in credit providers’ favour, but one which is seemingly more cautious and thereby easier to overturn.⁷⁶

As for liability in the case of proven third-party misuse, both contractual and tort approaches are possible. National private law can be used for holding consumers accountable for third-party use, but the risk placed on the consumer can vary considerably between national systems.The particular differences between Norwegian and Estonian law can best be summarised by three different types of cases.

In both countries, the positions outlined above indicate a significant probability that the consumer will be held liable to the credit provider if they knew about the third person using the eID to access credit and did not attempt to stop it. In Estonia, this conclusion would be beyond doubt. In Norway, it is likely that such a situation would meet the definition of ʻintent’ under § 3-20 of the Financial Contracts Act. This is in line with the concept of ʻauthority of acquiescence’ or ʻduldungsvollmacht’ known in many European jurisdictions.⁷⁷ The consumer has made a conscious choice to tolerate a third party acting in their name for a particular purpose, and the interests of a counterparty in good faith are deemed worthy of protection even if the fraudster acted contrary to the interests of the consumer.

Conclusions would, however, diverge in a situation in which the intention was for the fraudster to use the eID for purposes other than acquiring credit. A typical example is a family member or spouse who is given access to the eID to help the consumer with bills or appointments. As eIDs are usually strictly personal, this would be a breach by the consumer of the terms and conditions of the eID. In Estonia, this consumer would likely be seen as having granted authority to the fraudster, which would cover credit contracts, as the control of the eID was not lost against the will of the consumer. In Norway, courts are unlikely to deem the breach ʻintentional’ under the Financial Contracts Act and would therefore limit the liability to 12 000 NOK (approximately 1000 euros).

In some cases, the consumer never intends to provide a third party with access to their eID but is manipulated into providing codes and passwords through phishing or vishing, or a person close to the victim can use the carrier and learns the password without the victim’s knowledge. Again, such a situation would not lead to liability beyond 12 000 NOK (approximately 1000 euros) in Norway, as the threshold for ʻintent’ would not be met. In Estonia, rules on apparent authority (in the form of näivusvolitus) could be applicable in such a situation, and the consumer risks liability even if fraud is proven, although there is no case law to this effect yet.

These divergent approaches call for some reflection. Considering the aims of the EU for strong consumer protection in the area of finance and cybercrime, we would consider limiting consumer liability – as the Norwegian legislator has done – a reasonable approach as a matter of policy, particularly in cases of professional fraud. Consumers do not choose to participate in a certain economic sphere by acquiring an eID. It is a requirement for participating in a digital society. Many are likely unaware of the degree to which some businesses trust the eID as a basis for providing considerable amounts of credit. Credit providers have greater financial resources and accrue significant benefits through digitisation. They are also obligated to have safeguards and routines in place against fraud and should arguably not rely solely on eID systems for larger unsecured credit contracts.⁷⁸ The worry with leniency might be that consumers become careless or put forth fraudulent claims of identity theft in the absence of a strong liability regime. In this regard, it should be mentioned that the introduction of liability limits in Norway does not seem to have led to such a result. Credit providers seem to have been incentivised to invest in security mechanisms and sounder practices.⁷⁹ There are indications that eID-based credit fraud in Norway has in fact been reduced, although more empirical work is needed to understand by how much, or precisely why.⁸⁰ It is at least not obvious that consumer protection in this area will always conflict with the aim of better security.

4.1 The PSD II System and the Function of ʻConsent’

Often, the identity of the consumer is not misused to make a contract but to order a payment. Here, national private law is supposed to play a subordinate role, as PSD II provides a common liability framework for all states in the EU/EEA. The protection consumers enjoy under PSD II serves the general aim of achieving a high level of consumer protection in payment services.⁸¹ It also serves the larger goal of protecting consumers from identity-based cybercrime.⁸² As mentioned, a proposal for a new regulation of payment services, replacing PSD II, has passed the European Parliament on first reading.⁸³ We discuss some of the innovations in the current proposal in Section 4.4.

On the surface, PSD II is based on a simple and coherent system. A payment transaction is authorised if the consumer ʻhas given consent to execute the payment transaction … in the form agreed between the payer and the payment service provider’, as per Articles 64 (1) and (2). If consent is not present, the transaction is ʻunauthorised’, and the consumer – as a starting point – is not responsible for any loss generated by the transaction. According to the main rule in Article 73 (1), the payment service provider must refund the customer immediately, or at the latest, by the end of the next working day. According to Article 74 (1), the consumer may be charged 50 euros unless the misappropriation of a payment instrument⁸⁴ was ʻnot detectable prior to a payment’ or caused by ʻacts or lack of action’ on the side of the payment service provider.⁸⁵ Further, a consumer who with gross negligence or intent breached obligations to protect the payment instrument shall bear all losses.⁸⁶ The degree of negligence is determined in accordance with national law.⁸⁷ Countries may restrict the liability of a consumer who has been grossly negligent but not one who intentionally violates their obligation, as Norway and others have done.⁸⁸ One would therefore expect that the main question is what constitutes intent or ʻgross negligence’ under Article 74 (1). In fraud cases involving digital banking and SCA, however, the arguably most pressing issue has turned out to be a different one: What does it mean to ʻconsent’ to a payment transaction?

4.2 Does the Use of eID as Strong Customer Authentication Prove ʻConsent’?

According to the Court of Justice of the European Union, formulations and concepts in EU legislation must be interpreted autonomously unless otherwise indicated.⁸⁹ Member states are therefore not at liberty to use national private law without regard for the purpose and system of the directive. It is the ʻpayer’ who must give consent, which in this instance means the consumer.⁹⁰ Consent to a payment transaction implies that the consumer themselves approves a payment, not merely that strong customer authentication has been applied or that the payment instrument has been used.⁹¹ There is, however, a similar discussion here as for credit contracts with regard to evidentiary rules. Questions arise regarding the degree to which electronic identity systems based on SCA can be relied upon to prove that the consumer has consented, even when they deny it. While PSD II states that evidence should be judged in accordance with national law,⁹² it specifies in Article 72 (2) that the mere use of the payment instrument cannot, on its own, prove that the consumer consented to the transaction.

Given the wide array of attacks against SCA mechanisms, it is clearly sensible that SCA is not considered sufficient on its own to establish that the consumer consented to the payment. However, the fact that an SCA method was used must play a role in the assessment. In Germany, for example, courts and scholarship have seemingly, to some extent, assumed ʻprima facie evidence’ of consent established if SCA was used.⁹³ This is reminiscent of the Estonian approach to credit contracts and burdens the consumer with the task of proving that their electronic identity was misappropriated.⁹⁴ Some might argue that this approach is in tension with Article 72 (2) of the directive. As is the case for evidentiary presumptions in credit fraud cases, the key is likely how hard it is for the consumer to overturn it.⁹⁵ It is relevant that the person who consented to the payment knew the passwords or had access to the relevant devices. However, SCA should not become so dominant in the assessment that other arguments and facts fade into the background. The judge or panel hearing the case must also consider other relevant evidence, such as the credibility of the consumer’s account of the fraud and technical evidence (eg which IP address or what kind of eID device was used), which the service provider is clearly better equipped to produce.⁹⁶

4.3 ʻConsent’ and Contract Law

A payment service provider might also argue that consent is established or proven by the mere use of SCA because of pre-existing contract terms. Unlike what is often the case with credit providers, payment service providers have an underlying contractual relationship with that consumer. Some banks include provisions in their terms and conditions to the effect that the consumer is presumed to have consented if ʻconsent has been provided with the help of a payment instrument (e.g. via online banking)’.⁹⁷ This could – if taken at face value – mean that the payment service provider can rely on the authority of any person, including a fraudster, ordering a payment from the consumer’s online bank. As the notion of consent is dependent on what is ʻagreed between the payer and the payment service provider’, as per Article 64 (2), one might argue that consumers are free to accept such an arrangement within the confines of PSD II. However, it is necessary to consider Directive 93/13 on unfair terms in consumer contracts (UCTD) in conjunction with the system and purpose of PSD II itself.⁹⁸ If the terms have the effect of making any use of a certain payment instrument attributable to the consumer, a strong argument can be made that this is unfair, as it establishes a ʻsignificant imbalance’ under Article 3 (1) of UCTD, leaving the consumer with all the risk for what would otherwise be considered unauthorised use.⁹⁹ This clearly places the consumer in a disadvantaged legal position compared to otherwise applicable laws.¹⁰⁰ As such, the national court should examine and, if relevant, decline to apply such terms.¹⁰¹

A payment service provider can also argue that the ʻconsent’ – although given by the fraudster – is covered by rules on apparent authority. As mentioned, the Estonian Supreme Court has ruled that rules on representation should be considered when the eID is used.¹⁰² Payment service providers could argue that the electronic identity of the consumer can be relied upon as apparent authority in a situation of payment fraud, so that consent given by the fraudster is attributed to the consumer.¹⁰³ However, this seems problematic. Article 64 (1) must be understood in its context, notably the system of liability allocation in Articles 73 and 74. In our view, PSD II does not permit the use of national concepts in a way that circumvents the system of the directive, which indicates that the payment service provider should cover payments ordered fraudulently by third parties, absent the consumer’s gross negligence. The construction of consent by way of national agency law will have the potential effect of allocating responsibility in a different way than the PSD II system suggests. The effectiveness of the liability rules in Articles 73 and 74 is a strong argument for viewing consumer negligence in third-party fraud as a question of liability for an unauthorised payment transaction rather than as a reason for attributing the ʻconsent’ given by the fraudster through rules on apparent authority. Such national doctrines are therefore probably not applicable to the question of consent under Article 64 (1).¹⁰⁴

4.4 Subsequent Authentication by the Consumer of a Transaction Initiated by the Fraudster

As explained in Section 2, third-party fraud can also occur when a fraudster relies on the consumer’s own authentication actions. The fraudster might call the consumer posing as a bank employee and claim that the consumer’s accounts are under attack from hackers or scammers, so they must follow instructions sent to their phone to verify their identity. The consumer is deceived regarding the purpose of the authentication and does not understand that they are actually authenticating a payment to the fraudster.¹⁰⁵ The consumer performs a procedure (eg entering a PIN code and ʻconfirming’ the transaction on their mobile phone), which gives the payment service provider the impression that the consumer has given ʻconsent’.¹⁰⁶

Are these cases ʻunauthorised’ under PSD II? A complicating factor here is variance in the functionality of different SCA systems. Some mechanisms display the payment information quite clearly on the phone screen as the consumer authenticates the payment, which strengthens the case for viewing the consumer’s performance of the authentication procedure as consent to the transaction.¹⁰⁷ In cases observed in Norway, however, successful fraudsters manipulate the consumer even where the relevant information is displayed on the device. This is achieved in different ways: for example by convincing the consumer that they are confirming the reversal of a fraudulent payment instead of the payment itself, or by relying on the consumer, in a position of stress, clicking on the phone screen without reading its content.¹⁰⁸

Finansklagenemnda, the Norwegian Alternative Dispute Resolution (ADR) procedure for consumers and payment service providers, has reasoned that ʻconsent’ in these instances requires the consumer to perform the authentication procedure in the knowledge that they were approving a payment.¹⁰⁹ These transactions are therefore unauthorised.¹¹⁰ The reasoning is that ʻconsent’ refers not to the mere performance of a particular authentication procedure but to the expression of a will to make a payment.¹¹¹ Consumers may invoke their state of mind in situations where the payment information was technically visible to them, as long as they were genuinely confused as to whether the effect of their action was to authenticate a payment.¹¹² Unsurprisingly, some payment providers view this case law as overly lenient and unjustifiable under the current rules.¹¹³

This question illustrates the difficulty in applying a coherent notion of consent under the current legal and technical frameworks, as well as the close connection with the core questions of contract law.¹¹⁴ In our view, the demand for the subjective intention to order a payment for ʻconsent’ to apply, can reasonably be defended with reference to the system and purpose of the liability rules. The payment order is actually being issued by the fraudster from the online bank, deceitfully, in the consumer’s name. Of course, under the usual principles of contract law, parties bear the risk of their own mistaken communications with innocent third parties. There is also a danger that the consumer feigns ignorance and claims that they did not understand the purpose of the authentication. Under Article 74 (1), however, a consumer must still pay if they showed a high enough degree of negligence in falling for the fraud, and refunds can always be withheld under Article 73 (1) if there is reasonable suspicion of ʻfriendly fraud’. Therefore, an effective application of the PSD II’s system of loss allocation would favour allowing the consumer to invoke their lack of understanding as to whether they authenticated a payment, in the case that the payment is initiated by a fraudulent third party.¹¹⁵ The answer is, however, far from obvious, especially in cases where payment information is communicated to the consumer through the SCA mechanism.¹¹⁶

In the review processes leading up to the proposal for a new payment service regulation, the Commission acknowledged the difficulty of ascertaining whether a consumer has given their consent in social manipulation schemes.¹¹⁷ The initial proposal nonetheless failed to clarify or expand the meaning of consent, opting instead for two new reimbursement requirements for particular fraud situations, including one for situations in which the fraudster pretended to be a representative of the payment service provider.¹¹⁸ The European Parliament, however, made substantial additions in its first reading of the proposal in April 2024. The Parliament added in the preamble that authorisation must ʻexpress the intention of the payer on the basis of full knowledge of relevant facts including the amount, recipient and purpose of the transaction’.¹¹⁹ Whether such intention is present is to be judged pursuant to national law.¹²⁰ There will certainly be continued discussion over what such a formulation of consent means in specific fraud situations. The reference to national law is particularly ambiguous. It seems clear, however, that the proposal leaves room for considerations of how the consumer themselves understood the situation at the time of authentication.

In addition, the Parliament has suggested expanding the Commission’s proposed reimbursement scheme for impersonation fraud to cover the impersonation of not only the payment service provider but ʻany other relevant entity of a public or private nature’.¹²¹ The combination of an expanded notion of unauthorised payment transactions and broad protection from impersonation fraud could lead to substantially stronger consumer protection.¹²² Under the proposal, consumer liability will depend less on the technique chosen by the fraudster and more on the degree of negligence shown by the consumer. This aligns with recent developments in the United Kingdom, where a similar scheme has been adapted to encompass fraudulently induced transactions more generally.¹²³ At the time of writing, the European proposal is merely a proposal and subject to trialogues between the European lawmakers.

4.5 Assessment

When digital identity is misused for the purpose of a payment transaction, PSD II provides a common framework for questions of loss allocation. The starting point is the same as for credit contracts under national private law: if the identity was misused by a third party, the consumer is not liable. This is supplemented with liability rules for grossly negligent consumers. A problem, however, is that the arrangement seems to depend on a coherent notion of ʻconsent’ being available to national courts. It is difficult to apply this notion in the context of modern online payment systems, and many of the same questions discussed in Section 3 reappear. As shown in Sections 4.2–4.4, we believe that some basic answers can nonetheless be found through a dogmatic analysis of PSD II. The application of national private law on apparent authority to the question of ʻconsent’ seems contrary to the system and purpose of the directive, and therefore not appropriate. The same goes for reliance on standard terms and conditions as a basis for attributing fraudulent third-party use to the consumer. In the case of social engineering scams in which the consumer is manipulated into providing SCA while the fraudster orders the payment, ʻconsent’ – in our view – requires the consumer to be have been aware that they were authenticating themselves for the purpose of ordering a payment.