Online scams: the EU brings banks and platforms together — what it means for a small business

One person in four in the European Union has already been the victim of an online scam, according to the European Commission. On 26 October the Commission started a round of consultations to find out whether a code of conduct is needed that puts banks and platforms at the same table. Let's see what is certain, what is still open, and what a business should do now.

What happened, without embroidery

The fact, as the official source reports it: the Commission is consulting stakeholders on a possible voluntary code of conduct against online fraud and scams under the Digital Services Act. No text exists yet, and the Commission itself says it will assess "whether to proceed" with drafting. The known steps:

• 23 October: roundtable with the banking and payments sector.
• 26 October: workshop with trusted flaggers, civil society and consumer organizations.
• Early November: a planned meeting with providers of the very large platforms and search engines.

Possible areas of cooperation: exchanging signals on scam content between banks and platforms (building on the forthcoming Payment Services Regulation), verifying advertisers, especially those offering financial services, and closer work with trusted flaggers.

Why it matters to a small business

A week earlier, on 20 October, the Commission published a study on financial scams on online platforms. It identifies six categories: investment, romance, e-commerce, employment and collaboration, unexpected gain, and disaster relief. Investment and romance scams are the most common and the fastest growing. Scammers exploit advertising, recommender systems, private messaging, fake identities and generative AI.

For a company this means two concrete things:

1. Your brand can be used against your customers: fake profiles and ads pretending to be you.
2. Your employees are targets: fake job offers, fake collaborations or fake suppliers are among the categories listed.

The code, if it comes, will be voluntary and will mostly concern platforms and banks. It does not change your company's obligations on its own. But it shows where the pressure is moving, and where to look.

The medieval case: the Guards of the Fair

And you will say: what does the Middle Ages have to do with this? Quite a lot. The Champagne fairs of the twelfth and thirteenth centuries were Europe's great marketplace: Lagny, Bar-sur-Aube, Provins, Troyes, in rotation almost all year. A calendar curiosity: by tradition, the "cold" fair of Troyes opened the day after All Saints' Day. That is, tomorrow.

In a market where strangers from half of Europe met, how do you keep it from becoming a free-for-all? The Counts of Champagne gave the fairs a police force, the Guards of the Fair, who heard complaints and enforced contracts. Weights and measures were strictly regulated. Merchants who defaulted were barred from later fairs, the worst penalty for a trader. And in 1209 Philip Augustus granted safe conduct to merchants traveling to and from the fairs.

Note the method: whoever runs the market answers for its safety, and whoever cheats loses access. Yet no prudent merchant left everything to the Guards: they checked the goods, the weights, and who they were dealing with. Well, your company today is in that same fair. The platforms are the market, the Commission is thinking about the Guards. But the stall is yours.

What you can do now, whatever happens to the code

For more on AI-powered phishing, read Phishing and AI.