EFRI Case Note. Primary sources: European Commission (DG CNECT), “Support Contract on Financial Scams Study”, 2026 — Final Report DOI 10.2759/7359032, Executive Summary DOI 10.2759/6459186 1; MLex, 26 October 2026 2; AML Intelligence, 28 October 2026 3. Published 3 November 2026.
On 16 October the European Commission’s Directorate-General for Communications Networks, Content and Technology (DG CNECT) published a roughly 370-page commissioned study on financial scams on online platforms under the Digital Services Act (DSA). Around it, officials signalled that Brussels is exploring a voluntary code of conduct for very large platforms and banks. What neither step contains — and what the forthcoming DG HOME “Action Plan on Fighting Online Fraud” still does not confirm4 — is any mechanism to return money to those who have already lost it. The victim who wants it back is left exactly where the law already leaves them: obliged to sue for a refund, and to carry the burden of proof, against far better-resourced opponents. And the gap is not new: when the DSA was adopted in 2022, EFRI already called it a missed chance for leaving platform liability and victim redress out of an otherwise enforcement-focused regime.5
Read the posture precisely. The study is a commissioned evidence base that “does not assess or evaluate the compliance of any individual platforms with their DSA obligations” and proposes no legislation. The code is still being explored: the Commission has consulted banking, payments and civil-society representatives and “will meet very large platforms and search engines in early November before assessing whether to proceed”.
Background: the DSA track, assembled in stages
The October steps mature a line begun in 2025, when the Commission issued DSA information requests to Apple, Booking.com, Google and Microsoft over financial scams,6 and continued on 22 July 2026 when a coalition coordinated by BETTER FINANCE urged a multi-stakeholder DSA Code of Conduct on online fraud.7 The study now supplies the evidence base; the late-October statements signal the Commission is weighing such a code. The principal legal basis within the DSA’s co-regulatory architecture would be Article 45, while advertising-related transparency commitments may additionally engage Article 46.8
The study puts global scam losses at “up to EUR 0.9 trillion annually” (GASA 2025) and losses across Europe at “EUR 4 billion in 2024”, with crypto-scam losses around EUR 15 billion globally in 2025; it records that “nearly one in three advertisements on certain major platforms in the EU and UK” led toward scam, phishing or malware content, that “79% of scam victims report emotional harm”, and that stronger advertiser verification cut scam advertisements “by between 29% and 96%” in Singapore and Taiwan.
What the study is — and its single thread of “redress”
Prepared for DG CNECT by Spark Legal and Open Evidence (manuscript August 2026), the study is a catalogue of countermeasures in four categories: “access and gatekeeping” (identity verification, advertiser vetting, AI-content labelling); “detection and removal”; “user-facing protections”; and “structural governance”. Its closing recommendation is “a shift towards network-level and infrastructure-level disruption” and “stronger and more consistently applied verification at points of high risk”.
Nowhere does it propose anything that would move the loss off the victim: no strict liability in damages for the intermediaries whose services the fraud passed through, no duty to compensate or reimburse, no reversal of the burden of proof, and no victim compensation fund. The Commission’s own Executive Summary makes the boundary explicit: its single redress reference is “redress information”, one of three user-facing protections beside “reporting tools” and “friction tools”. The measure for a person who has already lost money is to tell them where to seek help, not to make them whole.
The legal shape of the proposed code — a voluntary code over a vague duty
An Article 45 DSA code is voluntary by design. It would be built on duties that are binding in form but strikingly open-textured in substance: the obligation on very large platforms and search engines to “assess” and “mitigate” systemic risks (Articles 34–35), alongside advertising transparency (Article 26), trader traceability and know-your-business-customer duties (Article 30) and the trusted-flagger regime (Article 22). The study itself frames online scams as a DSA matter “in particular Articles 34 and 35”, tied to Article 38 of the Charter. But a duty to “mitigate systemic risk” says almost nothing about what a platform must concretely do and that is why a code is now being drawn up: to give the vague duty content and to serve as the benchmark the Commission can hold up in its dialogue with the platforms. What is proposed is therefore a voluntary instrument stacked on a duty too indeterminate to bite on its own. On the Commission’s account the code would have platforms and banks cooperate on sharing scam alerts, verifying advertisers and working with trusted flaggers. Under Article 45 the Commission may invite platforms, search engines, authorities, civil-society organisations and “other relevant stakeholders” to draw up such a code; banks and payment service providers, not being providers of intermediary services, fall only within that last, open-ended category and take part voluntarily. Recital 104 DSA records that participating in a code “should not in itself presume compliance” with the Regulation, and nothing in Article 45 attaches a binding duty to any party.9
The choice is defensible on its own terms: Article 45 exists for exactly this cross-sector coordination, a code can give an open-textured duty the concrete content it lacks and move faster than legislation, and the study’s data suggest prevention reduces scam volume. But what it cannot do follows from what it is. A conduct code regulates how a platform must behave going forward; it is not what the problem really requires a strict-liability and/or restitution instrument. A liability tool would press the platforms into genuine action the alternative being to reimburse victims themselves — and a restitution tool would make whole those already defrauded. And that is also why a voluntary code is likely to move scam volume only marginally, if at all. The 29–96% falls in scam advertising the study cites came where verification was made mandatory; a platform that bears none of the downstream loss has little reason to impose that friction on itself voluntarily, against the advertising revenue the scams earn it. Prevention bites only when something compels it: liability, or binding and enforced rules and a code, by design, supplies neither.
Our Assessment
Judged by the only test that counts for a fraud victim — does money come back? — the Commission’s October initiative delivers nothing, and its own evidence base compels that conclusion.
The problem is not that the DSA lacks binding obligations Articles 34 and 35 already impose them but that prevention and enforcement, by themselves, restore nothing a victim has already lost.
What is genuinely useful is real: better advertiser verification and scam-alert sharing can stop some scams from reaching a user, and the study’s figures (scam ads down 29–96% where verification tightened) show prevention can work at scale. EFRI does not dispute that, and a well-built code on that front is worth having.
But measure it against the harm it answers. Against losses of up to EUR 0.9 trillion a year globally and EUR 4 billion in Europe in 2024, the Commission’s sole offering for someone who has already lost their savings is a sub-measure called “redress information” — in substance a leaflet pointing toward a destination that, for cross-border investment and payment fraud, scarcely exists. The study proves the vacuum: it records the “recovery scam” market that grew up precisely because there is no legitimate route back to one’s money. A report that identifies that void and signposts victims into it is not a redress policy.
The deeper objection is to the instrument itself. The Commission’s own study classifies online scams as a systemic risk under Articles 34 and 35 DSA, a classification that already imposes on the largest platforms a binding duty to assess and mitigate them. To meet a risk it has itself called systemic with a voluntary code is a category error: either the code is redundant, because the binding duty already exists, or it concedes that the binding duty is not being enforced. Voluntary co-regulation can complement enforcement; it cannot substitute for enforcement of already-binding Articles 34 and 35 obligations. And the premise that platforms will act voluntarily is precisely what the record contradicts, they have been under that binding duty, backed by fines of up to 6% of worldwide turnover, and one in three advertisements on certain major platforms still leads to scam, phishing or malware content. Actors who will not act under compulsion are not moved by an instrument that, in the DSA’s own words (Recital 104), cannot even be presumed to show compliance. The United Kingdom reached the same advertising not with a code but with binding tools a statutory financial-promotion restriction, a requirement that platforms verify financial advertisers as FCA-authorised, and the Online Safety Act’s duty to prevent fraudulent paid advertising; what moved the platforms there was compulsion, and even then only in part.10
Even at its best the code cannot reach the victim, and the Commission’s own framing concedes it: it grounds the exercise in the high consumer-protection standard of Article 38 of the Charter yet stays silent on the effective remedy owed under Article 47, invoking the right and ignoring the remedy.
Worse, a voluntary code compounds the very asymmetry it claims to address. It would create no autonomous right to compensation; at most its commitments might serve as evidence when a court assesses whether a platform discharged its binding DSA duties. The victim would still have to bring the Article 54 claim and prove infringement, damage and causation left, once again, as the party forced to litigate: the losing position the whole exercise was supposed to cure.
And the asymmetry is not only procedural. Liability for online fraud remains substantively unsettled. A victim must establish on its own with limited funds that one particular intermediary — a single node in a chain of advertiser, platform, acquiring bank, payment processor and crypto-asset service — is legally answerable for their loss, under rules the courts of the Union have barely begun to work out. Whether such an intermediary owes a duty to the end user at all, what standard of care binds it, on which legal basis it can be held to answer, and how its conduct is to be causally linked to a loss spread across the chain, these questions are contested, and they decide whether a cross-border fraud claim is won or lost. The code resolves none of them. It leaves every one to be litigated, case by case, by the people least able to litigate it.
The banks’ place in the code deserves its own scrutiny, because it runs against the grain of accountability. Payment institutions are drawn in not as entities the DSA can bind — it cannot — but as voluntary partners sharing scam alerts and verifying advertisers. For a victim that is the wrong posture twice over: it casts the payment intermediary through which the money actually moved as an anti-fraud ally rather than as a gatekeeper whose own controls may have failed, and it asks banks to share data, not to repay a cent — where the United Kingdom already requires payment providers to reimburse authorised-push-payment victims. Any binding duty on banks lives in the payment-services and anti-money-laundering frameworks, not in a voluntary DSA code.
The real risk for victims is not that the code does too little, but that it is presented as enough — a prevention package and an eventual Action Plan offered as the Union’s answer, quietly closing the political window on redress while the recovery side stays empty. By late 2026 that response is already crowded — the DSA code, a DG CONNECT “Task Force on Online Scams and Fraud”, enforcement task forces at home and abroad — yet none of it returns money to a victim; and the coalition that called for the code is organised around prevention, its victim interest carried by a support body, not an advocate for compensation.11 The window to change that — the early-November platform meeting and the still-unpublished Action Plan — is open now.
Nothing in the surrounding architecture fills the gap. A public fine goes to the EU budget, not to the victim; AML and supervisory sanctions on banks and payment institutions deter but do not reimburse; and the newer instruments reach only so far — Directive (EU) 2024/1260 on asset recovery (transposition due 23 November 2026) has victim claims considered and encourages social reuse of confiscated property, while the Representative Actions Directive (EU) 2020/1828 adds cross-border procedure through qualified entities, yet between them they create no Union claims administrator, no common fund for cross-border fraud victims and no litigation finance.1213
How to fill it is harder than this note can settle, and EFRI claims no finished answer. Its position paper sets out one direction worth serious consideration: an EU Financial and Digital Fraud Victim Redress Mechanism, supported by a Recovery Fund, that would pay eligible victims on a defined basis and recover by subrogation from confiscated proceeds, settlements, a defined share of penalties connected with consumer fraud, the advertising revenue platforms earn from the fraudulent ads themselves, and, possibly, an industry levy.14 The open questions are real — legal basis and competence, the causation threshold for eligibility, how the fund is capitalised before receipts arrive — and the paper itself calls for the competence, subsidiarity and budget assessment they demand. Nor is the idea without precedent: the Union has just accepted “advance-then-recover” for violent-crime victims. France’s SARVI provides a limited advance-and-recovery mechanism for certain crime victims, including victims of fraud, once a final criminal judgment has awarded damages and the offender fails to pay. And the UK’s mandatory APP-fraud reimbursement offers early evidence that such schemes need be neither unaffordable nor an invitation to moral hazard. These are starting points for debate, not a blueprint EFRI asks anyone to adopt unexamined.
None of this is new to EFRI. When the DSA was adopted in 2022, EFRI called it a missed chance — precisely because it was built as an enforcement instrument with no liability framework for the platforms that profit from the fraud and no redress for its victims: “it remains for the victims to care for justice and redress. No improvement at all for victims.” EFRI then asked that one of the new DSA authorities be empowered “to request compensation for the victims.” That ask was ignored. Four years on, a voluntary code is offered where that liability-and-redress pillar should stand, it shows the same gap, now confirmed.
What EFRI holds firmly is the distinction, not the design. Prevention may stop the next victim; it does nothing for the last one. Redress has to be built by design, it will not arrive as a by-product of enforcement, and in October 2026 it has not arrived at all.
Sources and notes
European Commission (DG CNECT, Unit D.3 – e-Commerce), Support Contract on Financial Scams Study, by Spark Legal and Policy Consulting and Open Evidence, Publications Office of the EU, 2026 — Final Report (DOI 10.2759/7359032, c. 370 pp.) and Executive Summary (DOI 10.2759/6459186). Quotations and figures are taken from the Executive Summary; its sole redress reference is “redress information”. ↩
MLex, “Online platforms face possible voluntary EU code of conduct to counter scams”, 26 October 2026 (Official Statement; subscription). ↩
AML Intelligence, “Commission drafts voluntary code of conduct to curb online scams”, 28 October 2026 (subscription); its “drafts” overstates the position; on the more cautious MLex account above, the Commission was still deciding whether to proceed. ↩
At the date of this note the DG HOME “Action Plan on Fighting Online Fraud” (Commissioner Brunner) was unpublished; the call for evidence closed 13 March 2026 and the “before summer 2026” target had lapsed (Digital Policy Alert #18024, “processing consultation”). ↩
EFRI, “The New Digital Services Act – a Missed Chance!”, 25 July 2022, https://efri.io/the-digital-services-act-a-missed-chance/. The article argued the DSA “does not at all include a clear and strong positive liability framework for online marketplaces” and that “it remains for the victims to care for justice and redress. No improvement at all for victims”, and asked that a new DSA authority be empowered “to request compensation for the victims”. ↩
European Commission, DSA information requests to Apple, Booking.com, Google and Microsoft on financial scams (autumn 2025). ↩
BETTER FINANCE and partners, open letter to DG HOME, “A multi-stakeholder DSA Code of Conduct on online fraud and scams is urgently needed”, 22 July 2026, betterfinance.eu. ↩
Regulation (EU) 2022/2065 (Digital Services Act), Articles 22, 26, 30, 34–35, 45–46 and 54, OJ L 277, 27.10.2022. ↩
DSA, Article 45(1)–(2) and Recital 104: the parties the Commission may invite are listed in Article 45(2); banks and payment service providers are not “providers of intermediary services” (Article 3(g)) and take part only as “other relevant stakeholders”. Recital 104: participation “should not in itself presume compliance”. ↩
United Kingdom: Financial Services and Markets Act 2000, s. 21 (financial-promotion restriction) and the FCA s. 21 approver gateway (from February 2024); platform requirements that financial advertisers be FCA-authorised (Google, 2021; Meta subsequently); Online Safety Act 2023 (duty on large platforms and search to prevent fraudulent paid advertising). The FCA reported that 19,766 financial promotions were amended or withdrawn following its intervention in 2024. Compliance remains imperfect, with reports of thousands of illegal ads still slipping through in 2026. ↩
On the advocacy’s composition, see the 22 July 2026 BETTER FINANCE coalition letter: its 20 signatories include Euroconsumers, AGE Platform Europe, Victim Support Europe, the Global Anti-Scam Alliance and the European FinTech Association, plus ad-integrity, cybersecurity and media bodies — but no bank or banking association. MLex reports the Commission consulted “banking, payments and civil-society representatives” without naming them. Parallel bodies: the EU “Task Force on Online Scams and Fraud” (DG CONNECT); internationally, INTERPOL’s Operation Shadow Storm (Vienna, 16–17 March 2026). ↩
Directive (EU) 2024/1260 on asset recovery and confiscation, in particular Articles 18–19, OJ L, 2024/1260, 2.5.2024; transposition deadline 23 November 2026. ↩
Directive (EU) 2020/1828 on representative actions, Articles 1, 2, 4, 7, 9–10 and Annex I, OJ L 409, 4.12.2020. ↩
EFRI, From Enforcement to Redress (position paper, first discussion draft, 7 August 2026), §§ 7.1–7.4. Comparative references: the “advance-then-recover” clause in the revised EU victims’-rights instrument (Council, Dec 2025; violent crime only); France’s SARVI, a limited advance-and-recovery mechanism for certain crime victims, including victims of fraud, once a final criminal judgment has awarded damages and the offender fails to pay; the UK PSR mandatory APP-fraud reimbursement (in force 7 October 2024). These comparative references are from EFRI’s own August 2026 research and should be re-checked before publication. ↩
