> This thread is rapidly losing value to readers now, since you seem to be dishonestly representing what you’ve previously said, at best guess because you don’t like to be wrong.

No, you are simply concentrating on the ultimately irrelevant details. I was not talking about any particular jurisdiction and their banking regulation, but about the fundamental problem that no banking regulation could possibly solve. Possibly I expressed that badly when I phrased things in terms of specific criteria that, of course, can lead to different assignment of liability depending on jurisdiction, but then, I would think that it should be clear from the context that that is not what I particularly care about here.

The fundamental problem is that you are trying to determine someone's intent. Ideally, you would want to be able to distinguish exactly when the bank customer intends to effect the execution of whatever order they formally have given you, and when they don't, either because they weren't actually involved in authorizing the order, or because they are somehow mistaken as to what the order they have given actually entails. If we could do that, the bank could refund all fraudulent charges without being at risk of being defrauded itself (or, ideally, prevent the fraudulent transaction in the first place).

It's just that we don't have access to someone's intent. All we have is someone who claims to have had a different intent than what the bank believes (or claims to believe), and who has a motivation to lie about that claim. But there is nothing that would be externally accessible that necessarily distinguishes someone who ordered some transaction fully understanding what that order entails and someone who gave the same order but was mistaken about what it entails. In some (maybe many) cases, you can have strong evidence that supports or contradicts the fraud claim, and those then generally can be resolved correctly. But there is absolutely no guarantee that you have any reliable evidence in either direction. And if you don't, there is no easy and reliable solution. You can not just say "if you can't know for sure, you have to refund", because you never can know for sure, so the bank would always have to refund, thus resulting in a massive fraud risk for the bank. Or you could say that, but it's just not gonna happen. The bank will always be able to avoid refunds without demonstrating beyond a doubt that the cutomer was trying to defraud them, or else they could not defend at all against people trying to defraud them. And as a result of that, there is always, unavoidably, the risk that you, as a customer, will be defrauded by a third party, and, no matter what the regulation, you will not get a refund because the bank can show sufficient evidence to convince a court that it was likely your fault according to whatever the specific rules are.

And all of that is relevant in this context because TFA suggested refunds as a supposed solution to the problem of weak passwords, and that is bullshit. While shifting much of the liability to the bank via regulation certainly helps in many cases, it can not, in principle, ever be a complete replacement for strong passwords. As far as guessing credentials is concerned, only strong, high-entropy, credentials actually solve the problem, solve it trivially (assuming the customer cooperates, of course), and solve it without exception.