Digital finance and security

🧔 Adult The law (PSD2, Article 4) defines two services provided by third-party providers ✔: a payment initiation service — "a service to initiate a payment order at the request of the payment service user with respect to a payment account held at another payment service provider" (point 15), and an account information service — "an online service to provide consolidated information on one or more payment accounts" held with other providers (point 16). Before you trust them, check that the provider is licensed or registered (competences 406, 409). In every EU country the national supervisor keeps a public register, and the European Banking Authority (EBA) keeps a central register under Article 15 of PSD2, freely accessible ✔ (eba.europa.eu). The framework also expects you to know that some digital products are riskier because they are less regulated (370) ✔.

Example: Bulgaria — The BNB keeps public registers of payment institutions, electronic money institutions and account information service providers under Article 19 of the Payment Services and Payment Systems Act ✔ (bnb.bg, "Registers under the Payment Services and Payment Systems Act", opened 21.10.2026).

Check in your country — Which authority keeps the register of payment and electronic money institutions (usually the central bank or the financial supervisor)? Search it, or the EBA central register, for the provider's name before you connect an app to your account.

Myth → truth

• Myth: "Digital is less safe than a purse."
• Truth: it is different. You notice a stolen purse at once; a stolen password — not. That is why digital money needs habits (Chapter 9) and has extra protections.

Who profits? The one who knows where their keys are.

→ Continue at the source

• Directive (EU) 2015/2366: http://data.europa.eu/eli/dir/2015/2366/oj ✔
• BNB — Registers under the Payment Services and Payment Systems Act: https://www.bnb.bg/RegistersAndServices/RSPIPublicRegisters/index.htm ✔ (opened 21.10.2026)

🧔 Adult The three kinds of proof on which all digital security rests: knowledge (password, PIN), possession (phone, card, physical key), inherence (fingerprint, face). Weak points:

• An SMS code is "possession" of the number, not of the phone — the number can be moved (SIM swap, Chapter 5). ENISA advises: if you have the choice, use a passkey, a physical key or an authenticator app — they are in principle safer than an SMS code ✔ (ENISA, "Cyber Hygiene", opened 21.10.2026).
• Biometrics are not secret and cannot be changed like a password; they unlock the device, and the PIN stays as the backup way in.
• Backup recovery codes are kept on paper — they are "the key to the key".

🏗 Business/Organisation A shared password leaves no trace and cannot be taken back when a person leaves. Personal access, roles and a second factor for everyone who can reach the company's bank account.

Myth → truth

• Myth: "I'm not important — nobody will hack my account."
• Truth: automated programs try millions of leaked passwords. What makes you vulnerable is not your importance but a reused password.

Who profits? The one who has at least two different locks.

→ Continue at the source

• ENISA — Cyber Hygiene (long unique passwords, password manager, passkeys, authenticator app): https://www.enisa.europa.eu/topics/cyber-hygiene ✔ (opened 21.10.2026)

🧔 Adult Definition (PSD2, Article 4, point 30) ✔: "strong customer authentication" means "an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data".

When it is required (Article 97(1)) ✔: when the payer "(a) accesses its payment account online; (b) initiates an electronic payment transaction; (c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses". For remote payments, authentication includes elements which "dynamically link the transaction to a specific amount and a specific payee" (Article 97(2)) ✔. That is why the code is valid only for this payment — read the amount and the payee before you confirm.

Example: Bulgaria — The Payment Services and Payment Systems Act, Article 100(1), obliges providers to apply strong customer authentication of the payer in the same three cases ✔ (current text on lex.bg, opened 21.10.2026).

Check in your country — PSD2 is transposed into a national payment services law in every EU country; the rule is the same. Your bank's terms of use explain which methods (app, card reader, SMS) it accepts.

Technical requirements (Delegated Regulation (EU) 2018/389) ✔: the code is accepted only once (Article 4(1)); no other element can be derived from it (Article 4(2)). The bank may (it is not obliged to) use exemptions: contactless payments up to €50 per transaction and up to €150 cumulatively or up to five consecutive payments (Article 11); viewing the balance or transactions of the last 90 days (Article 10); "trusted beneficiaries", whose list is created with strong authentication (Article 13). (✔ checked against the consolidated text as of 25.07.2023: Article 11 — €50, €150, five payments; Article 10 — 90 days and re-authentication after 180 days; later amendments were not searched.)

What it means for you: if the bank does not require strong authentication where the law requires it, the payer bears no losses unless they acted fraudulently (PSD2, Article 74(2)) ✔.

Myth → truth

• Myth: "The second step is a needless nuisance."
• Truth: the nuisance is the price of making sure one stolen secret is not enough. The code is your "yes" to a specific payment — never share it.

Who profits? You — when a stolen password alone cannot take the money.

→ Continue at the source

• PSD2: http://data.europa.eu/eli/dir/2015/2366/oj ✔ · Regulation 2018/389: http://data.europa.eu/eli/reg_del/2018/389/oj ✔ · Bulgarian Payment Services and Payment Systems Act: https://lex.bg/laws/ldoc/2137182267 ✔ (opened 21.10.2026; in Bulgarian)

🧔 Adult Regulation (EU) 2024/886 amends Regulation (EU) No 260/2012 and inserts new Articles 5a, 5b, 5c and 5d ✔.

• Definition (Article 2, point 1a): an instant credit transfer is "a credit transfer which is executed immediately, 24 hours a day and on any calendar day".
• Offer (Article 5a(1)): providers that offer credit transfers must offer all their users both sending and receiving instant credit transfers.
• 10 seconds (Article 5a(4)(c) and (5)): the amount must be available to the payee within 10 seconds; if no confirmation arrives, the payer's provider immediately restores the account.
• A limit of your choice (Article 5a(6)): on request, the bank must offer you a maximum amount for instant transfers — per day or per transaction; an order above it is not executed. An effective protection against quick draining of an account.
• Price (Article 5b): charges for an instant transfer cannot be higher than for an ordinary one; Verification of Payee is free.
• Verification of Payee (Article 5c(1)(a)): the service is performed "immediately after the payer provides relevant information about the payee and before the payer is offered the possibility of authorising that credit transfer". If there is no match, the bank informs the payer that authorising "might lead to transferring the funds to a payment account not held by the payee indicated by the payer"; if there is an almost-match, it shows the name linked to the IBAN. For companies, verification by tax number, European unique identifier or LEI is also possible (point (b)).
• Consequences (paragraphs 7–8): the bank informs you of the consequences of ignoring the warning. If it did not perform the verification and the transfer went to the wrong account, the payer gets the amount back without delay; if it did perform it and you confirmed despite the warning, the bank is not liable for the transfer to the wrong payee.

From when: for providers in euro-area countries — receiving instant transfers from 9.01.2025, sending and Verification of Payee from 9.10.2025; for countries outside the euro area — 9.01.2027 (receiving) and 9.07.2027 (sending, verification); payment institutions and electronic money institutions in the euro area — 9.04.2027 ✔ (Articles 5a, 5b, 5c of the amended Regulation 260/2012). For a country that joins the euro later, the new Article 16(9) of Regulation 260/2012 (added by 2024/886, Article 1, point 5) applies: providers there comply with Articles 5a–5c "within one year" of adopting the euro, but not later than the dates for non-euro countries and not earlier than the dates for the euro area. Many banks may have introduced the services earlier; check with yours.

Example: Bulgaria — Bulgaria has been in the euro area since 01.01.2026, i.e. after the euro-area dates, so Article 16(9) applies. The BNB confirms that payment service providers in Bulgaria must offer sending and receiving instant transfers in euro and Verification of Payee from 1 January 2027 ✔ (BNB, "Single Euro Payments Area (SEPA)" — frequently asked questions, opened 21.10.2026).

Check in your country — Is your country in the euro area, and since when? Your central bank's SEPA page states the dates. Ask your bank where in the app you can set the limit for instant transfers.

🏗 Business/Organisation "IBAN change" by e-mail (a letter "from a supplier" with a new account) is a scheme aimed at the staff who make payments. Verification of Payee and a call-back to a known number at every change of account are the cheapest protection. Companies may opt out of the verification for bulk payments (Article 5c(6)) ✔ — by a clear decision, not by default.

Myth → truth

• Myth: "If the bank didn't warn me, the payee is honest."
• Truth: the verification compares a name and an IBAN, not intentions. Check both whom and why you are paying (Module 17).

Who profits? The one who pauses for a second at the warning.

→ Continue at the source

• Regulation (EU) 2024/886: http://data.europa.eu/eli/reg/2024/886/oj ✔
• BNB — questions and answers on SEPA: https://www.bnb.bg/aboutus/aufaq/CONTR_SEPA_FAQ ✔ (opened 21.10.2026)

🧔 Adult Module 17 describes scams as stories; here are their technical points of entry:

The framework's formula ✔: talk only to verified representatives of the institution (519), examine the message (518), be confident enough to question it (520).

What the data show ✔: ENISA, report on the finance sector (January 2023 – June 2024) — in social engineering attacks (phishing, smishing, vishing) the most frequent targets are individuals (38 % of cases), and fraudsters most often pose as banks (36 %); among new threats the report also lists malware that creates deepfake videos from stolen facial recognition data (ENISA, "Threat Landscape: Finance Sector", opened 21.10.2026). Europol, IOCTA 2025 ("Steal, deal and repeat", 12.06.2025) — notes growing use of generative AI, including large language models, to strengthen social engineering attacks (Europol, consolidated annual activity report 2025, opened 21.10.2026).

Myth → truth

• Myth: "You can spot a scam by its language mistakes."
• Truth: today messages can be flawless. The sign is the pressure — hurry, secrecy, money, a code.

Who profits? The one who checks through an independent channel.

→ Continue at the source

• ENISA, Threat Landscape: Finance Sector (January 2023 – June 2024): https://www.enisa.europa.eu/sites/default/files/2025-02/Finance%20TL%202024_Final.pdf ✔ (read, 21.10.2026)
• Europol — IOCTA 2025: https://www.europol.europa.eu/publication-events/main-reports/steal-deal-and-repeat-how-cybercriminals-trade-and-exploit-your-data ✔ (the report's page; the summary was checked against Europol's annual report for 2025)

🧔 Adult Your obligation (PSD2, Article 69) ✔: to notify the provider "without undue delay" on becoming aware of the loss, theft, misappropriation or unauthorised use of the payment instrument, and to "take all reasonable steps to keep its personalised security credentials safe".

The bank's obligations (Article 70(1)) ✔: to provide a means of notification at all times, free of charge, and to prevent all use of the instrument once notified. If it does not provide such means, the payer bears no losses except in case of fraud (Article 74(3)); after notification, the payer bears no consequences of further use unless they acted fraudulently.

Deadline for notification (PSD2, Article 71(1)) ✔: you obtain correction of an unauthorised or incorrectly executed transaction only if you notify "without undue delay" and no later than 13 months after the debit date.

Getting your money back (PSD2, Article 73(1)) ✔: for an unauthorised transaction the bank refunds you the amount "immediately, and in any event no later than by the end of the following business day, after noting or being notified of the transaction" — unless it has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority.

How much you may have to bear (PSD2, Article 74(1)) ✔: for a lost, stolen or misappropriated instrument — no more than €50. The limit does not apply if the payer acted fraudulently or failed to meet their obligations with intent or gross negligence — then they bear the whole loss. The burden of proof is on the bank: the recorded use of the instrument "shall in itself not necessarily be sufficient" to prove authorisation or gross negligence (PSD2, Article 72(2)) ✔.

The limit of these rules: they are about unauthorised transactions. If you yourself, persuaded by a fraudster, confirmed the transfer, whether it was "unauthorised" is disputed and depends on the circumstances. So: act at once, ask for a written position, file a complaint, cooperate with the authorities. The rules are changing — the Payment Services Regulation (PSR) and Directive PSD3 were politically agreed between Parliament and the Council on 27.11.2025; under the agreement, if a fraudster poses as an employee of the provider and tricks you into approving a payment, the provider must refund the full amount, provided you have reported it to the police and informed the provider. The text still has to be formally adopted by Parliament and the Council before it enters into force ✔ (European Parliament, press release of 27.11.2025 and "Legislative Train", update of 20.09.2026, opened 21.10.2026). Until it enters into force, this rule does not apply.

Where (complements Module 17, Chapter 8): first the bank; for a crime — a report to the police; for a dispute with the provider — a complaint to the provider, then an out-of-court body for payment disputes; a complaint can also go to the supervisor of payment service providers; for personal data — the data protection authority (Chapter 7). Report even when you are not the victim (535).

Example: Bulgaria — The Payment Services and Payment Systems Act repeats these rules ✔ (lex.bg, opened 21.10.2026): notification without undue delay — Article 75; 13 months — Article 77(1); refund by the end of the following business day — Article 79(1); a maximum of €50 — Article 80(1) (in euro since 01.01.2026). Where to turn: cybercrime falls within the remit of the General Directorate for Combating Organised Crime, cybercrime department (https://www.cybercrime.bg ✔, site opened 21.10.2026); the Conciliation Commission for Payment Disputes at the Consumer Protection Commission (CPC) is free, written and non-binding, and requires a prior attempt to settle with the provider ✔ (European Commission, consumer-redress.ec.europa.eu); the BNB supervises payment service providers and takes measures "on its own initiative or on the basis of a complaint or report from a user" ✔ (Article 167(1)–(2)); personal data — the CPDP.

Check in your country — Find: the cybercrime unit of your police; the out-of-court body for payment disputes (the European Commission's consumer redress pages list them by country); the supervisor of payment service providers (usually the central bank or the financial supervisor); and your data protection authority.

Myth → truth

• Myth: "I confirmed it myself — there's nothing I can do."
• Truth: that is why time and documents matter; sometimes the money is blocked at the receiving end and the scheme stops.

Who profits? The one who acts within the first hour.

→ Continue at the source

• Bulgarian Payment Services and Payment Systems Act: https://lex.bg/laws/ldoc/2137182267 ✔ (opened 21.10.2026; in Bulgarian) · CPC: https://kzp.bg ✔ (Module 17)

🧔 Adult Regulation (EU) 2016/679 (GDPR) ✔:

• Article 4, point 1: personal data is "any information relating to an identified or identifiable natural person", including "an online identifier".
• Article 5(1)(c) — data minimisation: data is "adequate, relevant and limited to what is necessary" for the purposes.
• Article 15 — access: the right to confirmation of whether data about you is processed, and to access it.
• Article 17 — erasure: "without undue delay", when the data is no longer necessary for the purposes for which it was collected, and on the other grounds.
• Article 20 — portability: the data you provided, "in a structured, commonly used and machine-readable format", and the right to transmit it to another controller.
• Article 21 — objection: on grounds relating to your particular situation; against direct marketing — at any time.
• Article 7(3) — withdrawal of consent: "at any time"; "it shall be as easy to withdraw as to give consent".
• Article 12(3) — deadline: a reply "without undue delay and in any event within one month" (extendable by two further months for complexity).
• Article 77(1) — complaint: "every data subject shall have the right to lodge a complaint with a supervisory authority"; Article 82 — the right to compensation for damage.
• Articles 33–34 — personal data breach: the controller notifies the supervisory authority "without undue delay and, where feasible, not later than 72 hours", and the data subject — when the risk is high.

Example: Bulgaria — The supervisory authority is the Commission for Personal Data Protection (CPDP), Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.; complaints and reports — https://cpdp.bg ✔.

Check in your country — Every EU country has a data protection authority; the European Data Protection Board (edpb.europa.eu) lists them all. A complaint can also be lodged in the country where you live or work.

Open banking and consents (PSD2, Articles 66–67) ✔: an account information service provider shall "provide services only where based on the payment service user's explicit consent" (Article 67(2)(a)); for payment initiation the payer gives explicit consent (Article 66(2)). In practice: (1) know which apps have access; (2) withdraw the permissions you don't use (430); (3) never give your banking password to a third-party app — access goes through the bank's own channels. Where to see and withdraw them — ask your bank; the method differs from bank to bank. The framework adds: providers may keep a profile to personalise offers (424), and storing financial documents online has security implications (423) ✔.

Myth → truth

• Myth: "Consent is a button nobody reads."
• Truth: it is a contract about your data. You can withdraw it, and that must be as easy as it was to give it.

Who profits? The one who knows which doors they have opened — and closes the unused ones.

→ Continue at the source

• CPDP: https://cpdp.bg ✔ · GDPR: http://data.europa.eu/eli/reg/2016/679/oj ✔

🧔 Adult

🧔 Adult — checklist Every day: I don't enter data from a link · I don't share codes · I read the amount and the payee before confirming (Ch. 3) · a "name does not match" warning stops the transfer (Ch. 4). Every month: I review my transactions; anything unknown → the bank the same day · I update my phone · I review which apps have access to my data (Ch. 7) · I check the limits on my card and on instant transfers. Every year: I change the password of my bank account and e-mail · backup codes are on paper in a safe place · the contact phone number at the bank is up to date · I delete unused accounts · I have a backup of important documents. If something happens: Stop · Block · Tell · Keep (Ch. 6).

🏗 Business/Organisation Personal access and roles · a second factor for everyone · two signatures above a set threshold · call-back when an account changes · annual training · a written "what we do in an incident" plan.

Myth → truth

• Myth: "Security is the bank's job."
• Truth: the bank carries big obligations (Ch. 3, 6), but the key is with you. The cheapest part of security is yours.

Who profits? The one who does the small check every month instead of the big repair once.

→ Continue at the source

• ENISA — Cyber Hygiene: https://www.enisa.europa.eu/topics/cyber-hygiene ✔ · ECB — the digital euro: https://www.ecb.europa.eu/euro/digital_euro/html/index.en.html ✔ (opened 21.10.2026)

🧔 Adult What the law says (in brief):

• A direct appeal to children is banned. Unfair Commercial Practices Directive 2005/29/EC, Annex I, point 28 — always unfair is "including in an advertisement a direct exhortation to children to buy advertised products or persuade their parents or other adults to buy advertised products for them" ✔. A "Buy now!" button aimed at a child in a game falls within this logic.
• Dark patterns. The Digital Services Act (Regulation (EU) 2022/2065, Article 25) prohibits online platforms from designing their interfaces in a way that deceives or manipulates users; examples include repeatedly asking for a choice already made, and making it harder to cancel a service than to sign up ✔.
• In-game virtual currencies. The network of national consumer protection authorities in the EU (the CPC network) adopted "Key Principles on In-Game Virtual Currencies" in March 2025. The European Commission summarises them as: clear prices and pre-contract information; no practices that hide the cost of content; no forcing consumers to buy virtual currency; respect for the right of withdrawal; taking account of consumers' vulnerabilities, especially those of children ✔ (European Commission page, 3.06.2025, re-opened 21.10.2026). The principles are not a new law: the CPC network describes them as non-exhaustive principles for traders to comply with existing EU consumer law — the legal basis it names is the Unfair Commercial Practices Directive and the Consumer Rights Directive ✔. Principle 1 requires the price of the virtual currency and of the content bought with it to be shown clearly also in real money ✔ (CPC, "Key Principles on In-game Virtual Currencies", 21.03.2025, opened 21.10.2026).
• Gambling is for adults. Across the EU, gambling is regulated nationally, and access for minors is restricted.

Example: Bulgaria — The National Revenue Agency (NRA) has a "Parental control" page to keep children away from gambling ✔ (nra.bg). The law does not admit persons under 18 to gaming halls and casinos and prohibits the sale of lottery tickets to under-18s ✔ (Gambling Act, Article 45(2) and Article 9(11), lex.bg, opened 21.10.2026).

Check in your country — Which authority regulates gambling (often a gambling commission or the tax authority), and what does it say about minors and parental control?

Paid reward boxes — you pay without knowing what you will get — rest on the same randomness; at home the simplest rule is: not with a child's money.

How to sort it out at home, without a war:

1. Turn off the saved card on the device and in the game. A purchase that needs confirmation is the simplest brake.
2. Use a prepaid amount — a voucher, a children's account or a prepaid card with a limit (Module 26, Module 21 Chapter 8). When it runs out, it runs out.
3. Review the statement — in-game purchases are small and many; together they make the month.
4. Talk about the feeling, not just the amount: "What did you want to get with this? Did you get it?"

If a child has bought something without permission: stay calm. Collect the dates and amounts, contact the game provider or the app store and ask for a refund; if it was paid by card — the bank too (Module 21 Chapter 5). In a dispute with a trader — the consumer protection authority (in Bulgaria, the CPC: kzp.bg). A refund is not guaranteed and depends on the provider's terms.

Myth → truth

• Myth: "A free game is free."
• Truth: you pay with time, with attention and sometimes with many small purchases. It is free when you decide how much you give.
• Myth: "I'll get it from this box — I'm close now."
• Truth: every draw is new. The previous ones don't bring you "closer", unless the rules explicitly say so.

Who profits? The producer — from your time, your attention and the many small purchases. You — when you know in advance how much time and how many euro you give to the game, and enjoy every minute.

Example (fictional): Mira, 12, wants an outfit for her character. It costs 450 tokens, and the smallest pack is 500 tokens for €4.99. With the "euro glasses" she sees: the outfit costs her €4.99, and 50 tokens are left over that are not enough for anything on their own. She decides to buy it from her pocket money in a week — if she still wants it. She doesn't.

Your step in Pecuvo: in the wallet, create a "Games and apps" basket with a monthly limit (it can be €0). Every purchase goes there. Once a month — five minutes together: what we bought and whether we still enjoy it.

→ Continue at the source

• Directive 2005/29/EC (unfair commercial practices), Annex I: http://data.europa.eu/eli/dir/2005/29/oj ✔
• Regulation (EU) 2022/2065 (digital services), Articles 25 and 28: http://data.europa.eu/eli/reg/2022/2065/oj ✔
• European Commission — the CPC network's key principles on in-game virtual currencies: https://commission.europa.eu/news-and-media/news/european-commission-hosts-stakeholders-talks-application-cpc-networks-key-principles-games-virtual-2025-06-03_en ✔
• NRA — "Parental control": https://nra.bg/wps/portal/nra/gambling/responsible.gambling/Roditelski-kontrol ✔ (the page was found by search; the text was not read in full; in Bulgarian)

EU/OECD-INFE framework for children and youth (2023): competences no. 62 · 63 · 115 · 117 · 225 · 228 · 232