(1) Notwithstanding Regulation 97 and subject to paragraph (3), a payer shall bear the losses relating to any unauthorised payment transactions, up to a maximum of €50, resulting from the use of a lost or stolen payment instrument or from the misappropriation of a payment instrument.

(2) Paragraph (1) shall not apply where -

(a) the loss, theft or misappropriation of a payment instrument was not detectable to the payer prior to a payment, except where the payer has acted fraudulently, or

(b) the loss was caused by an act or omission of an employee, agent or branch of a payment service provider or of an entity to which its activities were outsourced.

(3) Notwithstanding Regulation 97, a payer shall bear all of the losses relating to an unauthorised payment transaction where the losses were incurred by the payer -

(a) acting fraudulently, or

(b) failing to comply with its obligations under Regulation 93 either intentionally or as a result of gross negligence on its part.

(4) Where a payer’s payment service provider does not require strong customer authentication, the payer shall not bear any financial losses relating to an unauthorised payment transaction unless the payer has acted fraudulently.