Michał Ziemiak: Who Will Pay for Online Fraud? Don’t Ask the Victim

A scam victim should not have to untangle a chain involving a fake advertisement, a spoofed message, a telecom network and a bank before recovering stolen money. That is the central argument of Michał Ziemiak’s commentary on who should pay for online fraud.

Polish payment-services law currently requires banks and other payment providers to return money lost by customers. But many scams begin well before a victim enters a banking app. They may start with spoofing, a fraudulent SMS, an investment advertisement on social media or a sponsored post designed to look like a legitimate offer.

That reality challenges a model in which financial responsibility ends with the banking sector. Telecom companies and online platforms often remain treated mainly as technical intermediaries, even though they control access to victims, advertising systems, sender verification, content filtering and the speed of their response to complaints.

The commentary presents online scams as a problem spanning the communications, advertising, hosting and payment industries. A fraud can succeed when a platform allows a deceptive advertisement, a telecom operator fails to block spoofing or a phishing message, and a bank does not identify a suspicious transaction. Asking the victim to identify the weak link in that chain is unrealistic, Ziemiak argues.

The proposed EU regulation on payment services, expected to be adopted at the end of 2026, would widen selected obligations to electronic communications providers, hosting providers, very large online platforms and very large search engines. It would establish cooperation and information-sharing rules, as well as specific duties involving fraud and advertising for regulated financial services. The proposal also includes compensation mechanisms between account-servicing and payment-initiation providers, alongside liability rules for technical service providers and scheme operators.