Compliance as Evidence: Conditioning the Consumer-Fault Defence Under DORA and the Payment Services Framework

Payment fraud losses in the European Economic Area rose to EUR 4.2 billion in 2024, and consumers bore some eighty-five per cent of the loss arising from fraudulent credit transfers. This article concerns unauthorised payment transactions, that is, those the fraudster executes after obtaining the authentication credentials by deception. Whether that loss remains with the consumer depends on a single legal standard—gross negligence—which is nowhere defined and whose assessment the second Payment Services Directive reserves to national law. This article argues that Regulation (EU) 2022/2554 on digital operational resilience (DORA) alters that standard indirectly: it creates no private-law claim, but it obliges financial entities to generate continuous documentation of their own defensive systems, and that documentation becomes an instrument of proof in disputes in which the burden lies on the provider. Using doctrinal analysis, with Hungary as a critical case, the article reconstructs this mechanism and derives a construction termed compliance-conditioned liability: a regime in which the provider may invoke the consumer’s fault only after demonstrating the performance of its own obligations. The construction is shown not to be novel but to generalise a rule already in force for two compliance obligations. The article proposes a two-pillar model of loss allocation and argues that it supplies the substantive content that the forthcoming Payment Services Regulation leaves undefined in the concept of objectively justified reasons.