Chargebacks and EU Law: What Shopify Merchants Need to Know (PSD2, SCA, PSD3)

If you sell to customers in the EU, European payment law quietly decides who wins many of your disputes, in ways that US-focused chargeback advice completely misses. Strong authentication rules can move fraud liability off your shoulders; a consumer's 14-day cancellation right can turn into a chargeback if you mishandle it; and a major reform (PSD3 and the PSR) is landing in 2026.

This is a practical guide, not legal advice: how each rule can help or hurt you when a European customer disputes a charge, and what to actually do about it.

SCA and the fraud liability shift — your strongest shield

The revised Payment Services Directive, PSD2, requires Strong Customer Authentication (SCA) for most online card payments in the European Economic Area. In practice, SCA is delivered through 3-D Secure 2 (3DS2).

Here's why it matters for disputes: when a payment is authenticated with 3DS2 and the cardholder later claims it was fraudulent ("I didn't authorize this," Visa reason code 10.4), liability for that fraud shifts from you to the card issuer. An SCA-authenticated transaction is very hard to charge back as fraud, because the bank, not you, absorbs it.

The catch is real, though: if you skipped SCA using a merchant-requested exemption (for example a low-value or transaction-risk-analysis exemption you initiated), the liability generally stays with you. So in a fraud dispute you need to be ready to show either that SCA was performed, or that a valid exemption applied.

One more caveat: even when you're not financially liable, fraud disputes still count toward your fraud ratio, and a high ratio can pull you into card-network monitoring programs.

What to do: turn on 3DS2, and keep the authentication result (and any exemption reason) as evidence you can attach to your response. This is the single most powerful tool against friendly fraud claims in Europe.

The 14-day right of withdrawal (Directive 2011/83/EU)

Under the EU Consumer Rights Directive (2011/83/EU), consumers can withdraw from most distance (online) purchases within 14 days, without giving any reason. The clock starts when the customer receives the goods (or when the contract is concluded, for services). You then have to refund all payments, including standard delivery, within 14 days of being told, using the same payment method.

Two details that catch merchants out:

• If you never informed the customer of this right, the withdrawal window is extended by up to 12 months.
• Exceptions apply, including custom or personalized items, perishable goods, sealed goods opened for hygiene reasons, and downloaded digital content.

Why this belongs in a chargeback guide: the withdrawal right is a claim against you, not a chargeback. But if you refuse a valid withdrawal refund, the customer can, and often does, go to their bank instead. On a "credit not processed" (13.6) or related dispute, you will lose, because the refund was legally owed. A lawful refund is cheaper than a chargeback plus its fee.

What to do: publish a clear returns/withdrawal policy, and process valid withdrawals quickly, before they escalate into disputes. See our Shopify chargeback guide for how those disputes play out.

SEPA direct debit: the 8-week "no-questions-asked" refund

If you accept SEPA Direct Debit (not card payments), PSD2 gives the payer the right to a refund of an authorized direct debit within 8 weeks of the debit date, with no justification required. This is separate from card chargebacks, and it does not apply to the SEPA business-to-business scheme.

What to do: if you use SEPA Direct Debit, factor in this 8-week window, keep signed mandates on file, and reconcile early so a refund request doesn't surprise you.

The surcharging ban (PSD2 Article 62)

Since 13 January 2018, PSD2 has prohibited surcharges for paying with most EEA consumer debit and credit cards, online or in store. It covers roughly 95% of EU card payments. (Payment methods like PayPal or Klarna aren't covered by the card ban.)

Why it matters: an unlawful card surcharge is both a compliance risk and a trigger for complaints and disputes, and it can weaken your standing if a case escalates.

What to do: don't surcharge EEA consumer cards. If you need to recover payment costs, build them into your pricing instead.

What's changing: PSD3 and the PSR (2026)

The EU is modernizing its payment rules. PSD2 is being replaced by PSD3 (a directive) and, crucially, the Payment Services Regulation (PSR), a directly applicable regulation that will apply uniformly across all member states without national transposition.

Where things stand in 2026: the EU reached provisional political agreement in late 2025, the final compromise texts were published in April 2026, and publication in the EU Official Journal is expected around mid-2026, after which the rules enter into force (with some provisions phased in later). See the European Commission's payments package and this legal analysis of PSD3/PSR.

For merchants, the direction of travel is a stronger anti-fraud regime, including:

• Payee name / IBAN verification for credit transfers, with the payer warned before authorizing if the name and account don't match.
• Impersonation ("spoofing") fraud treated as unauthorized, with reimbursement by the payment provider under set conditions.
• SCA made more accessible, so authentication can't lock out customers without smartphones or with disabilities.

The net effect: clearer, more uniform rules across the EU, and more fraud-prevention duties spread across the payment chain.

What to do: watch the timeline and expect tighter authentication and verification expectations. Keeping your SCA and evidence practices sharp now is the best preparation.

How to use EU law to win (or avoid) a dispute

Put together, the European rules give you a concrete playbook:

• Authenticate with 3DS2 and keep the SCA result — it shifts fraud liability to the issuer and is your best defense on fraud claims.
• Honor the 14-day withdrawal right promptly — a lawful refund beats a chargeback and its fee.
• Respect the 8-week SEPA refund window if you take direct debits, and keep your mandates.
• Don't surcharge EEA consumer cards.
• Document everything, so when you respond, your evidence lines up with the reason code. Our chargeback response template shows the format banks accept.

None of this replaces legal advice for your specific situation, but knowing where EU law puts the burden of proof is often the difference between a dispute you win and one you don't.

Build my EU-ready response →

That's exactly what Chargeback Reply does: it matches your reason code to the evidence that wins, including the SCA and authentication proof that European disputes turn on, and generates a bank-ready response in minutes.

Start my response →