European Union

EU scam and impersonation rules, explained.

There's no single EU scams law. The Digital Services Act makes platforms act on notices of illegal content, and the new Payment Services Regulation adds impersonation refunds. Here's what they mean when fakes use your name, and how Unphish finds them, takes them down and keeps the evidence.

Book a demo Request a takedown

Legislation briefEU

Digital Services Act and the Payment Services Regulation

In forcePayment Services Regulation expected to apply around 2028

Applies to: Online platforms and search engines now. Banks, payment firms and telcos once the PSR applies
Regulators: European Commission for the biggest platforms, national Digital Services Coordinators for the rest
Platforms: Must act on notices of illegal content, including scam accounts and ads
Refunds: Agreed: banks refund customers tricked by scammers posing as the bank. Platforms that ignore fraud notices repay the bank
Max penalty: Up to 6% of global annual turnover (Digital Services Act)

The Payment Services Regulation is agreed but not yet formally adopted. Summary as of October 2026, not legal advice.

What the rules cover

Six ways EU rules reach impersonation.

What each one covers, in plain words, and what Unphish does for it.

Notice and action

Platforms must act on notices of illegal content, including fake accounts.

We send notices with evidence for fakes using your name, and track each response.

Biggest platforms

Very large platforms and search engines must assess and reduce risks like scams.

We report scam ads and accounts using your name and record what happens.

Impersonation refunds

Agreed: banks refund customers tricked by scammers posing as the bank.

We take down the fake sites, profiles and numbers posing as you.

Platform liability

Agreed: platforms that ignore fraud notices will repay the bank.

Our timestamped notices show exactly when each platform was told.

Verification of Payee

Euro payments check the payee’s name against the account before you pay.

We take down the scam sites that ask people to pay.

Trade marks and domains

EU trade mark law and domain dispute rules cover lookalike names.

We watch for lookalike domains and request suspension from registrars and hosts.

Based on the Digital Services Act, the agreed Payment Services Regulation and the Instant Payments Regulation. Summary as of October 2026.

Key dates

Where the EU rules are up to.

17 Feb 2024DSA applies to all platforms
Notice and action on illegal content
Done
9 Oct 2025Verification of Payee
Euro payments check the payee’s name
Done
27 Nov 2025PSR deal agreed
Impersonation refunds and platform liability
Done
21 May 2026Scam ad complaints
Consumer groups complain about big platforms
Done
Late 2026PSR formally adopted
Then published in the Official Journal
Next
Around 2028PSR applies
About 21 months after it comes into force
Coming

Dates from the European Parliament, the Council and BEUC. Later dates are estimates and may change.

Who it covers

Who the EU rules reach.

Platforms carry the duties today. Banks and telcos join them once the Payment Services Regulation applies.

PlatformsDSA

Social media, marketplaces and other platforms must act on notices of illegal content. The biggest must also reduce fraud risks.

SearchDSA

Very large search engines must assess and reduce risks such as scams. Once the PSR applies, they’ll also check financial advertisers.

BanksPSR

Once the PSR applies, banks refund customers tricked by scammers posing as the bank. Euro payments already check the payee’s name.

TelcosPSR

Once the PSR applies, phone companies must take steps against spoofed calls and messages that impersonate banks.

€4.2bnlost to payment fraud in the EEA in 2024

85%of credit transfer fraud losses fell on customers

52%of consumer groups’ scam ad reports were rejected or ignored by platforms

Sources: EBA and ECB 2025 Report on Payment Fraud (2024 data); BEUC, May 2026.

Check your business

What do the EU rules mean for you?

There’s no single EU scams law, so it depends on your business. Pick the one closest to yours.

What to do now

A general guide, not legal advice. Check your position with your legal team.

What’s at stake

Why getting this right matters.

Payment fraud€4.2bn

Lost to payment fraud in the EEA in 2024, up from €3.5bn in 2023, according to the EBA and ECB.

Scam ads52%

Of consumer groups’ reports of nearly 900 suspected scam ads were rejected or ignored by the platforms.

Max fine6%

Of global annual turnover, the most a platform can be fined under the Digital Services Act.

What we take down, across all clients

98%of scam websites 99%of phishing sites 99%of impersonation accounts 92%of fake apps

Figures from the EBA and ECB and BEUC; fine level from the Digital Services Act. Our results cover all Unphish clients, January to June 2026, rounded.

Who’s accountable

Who owns impersonation in your business.

Dealing with fakes spreads across teams. Here’s a typical split, and where Unphish fits.

TeamMonitorEvidenceTakedownReportLegalCustomers

Fraud and financial crimeMonitorEvidenceTakedownReportLegalCustomers

SecurityMonitorEvidenceTakedownReportLegalCustomers

Legal and complianceMonitorEvidenceTakedownReportLegalCustomers

Marketing and socialMonitorEvidenceTakedownReportLegalCustomers

Customer careMonitorEvidenceTakedownReportLegalCustomers

UnphishMonitorEvidenceTakedownReportLegalCustomers

LeadsSupportsA typical split. Yours may differ.

Around the world

How the EU compares.

WhereMain rulesWho it coversImpersonationPenalties

Australia Main rulesScams Prevention Framework (SPF)Duties from 31 Mar 2027 Who it coversBanks, telcos and digital platforms ImpersonationDraft codes: protect official channels, monitor, request removal PenaltiesUp to $50m, 3x the benefit or 30% of turnover View → United States Main rulesFTC Impersonation RuleIn force since Apr 2024 Who it coversAnyone impersonating a government agency or business ImpersonationImpersonating a business is unlawful. FTC asking about platform ad tools PenaltiesUp to $53,088 per violation, plus refunds to consumers View → United Kingdom Main rulesOnline Safety Act and APP fraud reimbursementScam ad codes in draft Who it coversOnline platforms, search services and payment firms ImpersonationPlatforms must tackle fraud. Draft codes add scam ad takedown PenaltiesUp to £18m or 10% of worldwide revenue View →

European Union Main rulesDigital Services Act and Payment Services RegulationPSR not yet applying Who it coversOnline platforms and payment service providers ImpersonationNotice and action on illegal content. PSR adds impersonation fraud refunds PenaltiesUp to 6% of global turnover (DSA) You’re here

Singapore Main rulesShared Responsibility FrameworkIn force since Dec 2024 Who it coversBanks and telcos ImpersonationCovers phishing scams impersonating legitimate businesses PenaltiesBanks and telcos that miss their duties cover losses View →

A simplified summary as of October 2026, not legal advice. Rules and dates change, so check the source for your obligations.

Get ready

Your EU impersonation checklist.

A starting point for dealing with fakes using your name in the EU. One list to get set up, and one for every month after that.

EU impersonation checklistBrand impersonation

Get set up

List your official channels: domains, accounts, apps, numbers and sender IDs.
Set up monitoring for lookalikes and impersonation.
Agree how fakes are reported and removed, and by whom.
Know where to report: each platform’s DSA notice form, and the police in each country.
Decide what you’ll record and who signs off.

A starting point, not legal advice.

Checklist

EU impersonation checklistBrand impersonation

Every month

Review the new impersonation found.
Check what was taken down and what’s still live.
Keep evidence and timestamps for every case.
Follow up notices platforms haven’t acted on.
Update your list of official channels.

Keep records for as long as your legal team advises.

Checklist

Read the source

EUR-LexDigital Services Act European ParliamentPayment services deal (November 2025) EBA and ECB2025 Report on Payment Fraud BEUCScam ad complaints (May 2026)

FAQ

EU scam rules questions, answered.

Is there one EU law for scams?

No. The Digital Services Act covers online platforms and search engines, payment rules cover banks and payment firms, and fraud itself is a crime under each country's own law.

What does the Digital Services Act mean for fake accounts?

Since 17 February 2024, every online platform in the EU has had to offer a way to report illegal content and act on those notices. Fake accounts, pages and ads posing as a business can be reported this way. The biggest platforms must also assess and reduce risks like scams.

What is the Payment Services Regulation?

A new EU law agreed in November 2025. Banks will refund customers tricked by scammers posing as the bank, platforms that ignore fraud notices will repay banks, and the biggest platforms must check financial advertisers. It still needs formal adoption, and is expected to apply around 2028.

What is Verification of Payee?

Since 9 October 2025, banks in the EU must check that the name of the person you're paying matches the account number for euro credit transfers, and warn you if it doesn't. It helps catch payments to scammers posing as someone else.

How does Unphish help?

We monitor for impersonation of your business 24/7, send platforms notices with evidence, and take down the fakes we find. Every case keeps its evidence, timeline and outcome, including when each platform was told.

What are the penalties?

Under the Digital Services Act, platforms can be fined up to 6% of their global annual turnover. Scammers themselves face criminal charges under each country's law.

Is this page legal advice?

No. This page is a general guide to EU scam and impersonation rules and how Unphish can help. Check your obligations with your legal team.

Solutions for EU impersonation

The tools behind your record.

01Threat MonitoringFind fakes using your name, 24/7.Learn more →02TakedownGet scam sites, accounts and ads removed.Learn more →03Threat IntelligenceLink campaigns and share what you find.Learn more →04Domain ProtectionCatch lookalike domains early.Learn more →

Industries most affected

Banking and Financial Services→Fintech→Retail and E-Commerce→Crypto→

See all solutions →

Try it

True or false?

Five quick statements about EU scam rules. Which are true?

Platforms have to act on notices, but someone still has to find the fakes and send them. We can help.

Talk to us →

See your impersonation record.

Book a demo and we'll show you how Unphish finds the fakes using your name, takes them down and keeps the evidence.

Book a demo Request a takedown