Online Payments and VAT: When to Worry

There's a precise moment in every online payment when you lose control of your money. It's not when you enter your card details, nor when you confirm with your bank. It's a few seconds later, when the order reaches the international circuit and becomes an irreversible operation. Understanding where that boundary lies is the first step to avoiding problems.

One detail almost no one mentions is that online payments in euros between European parties are now almost all instant, and the cost for the bank is close to zero. When someone asks you for a small extra fee because "instant payment costs," they're telling you something that hasn't been true for years. It's not dramatic, but it's a good sign to understand who you're dealing with.

If a website asks you to save your card "for convenience," think twice. It's not necessarily a bad idea, but it means you're delegating that responsibility to the party in front of you. When in doubt, I always prefer to manually enter the data every time: I lose ten seconds and I don't have to worry about how and where they will be stored.

Not all "protected payments" you see online are true protected payments. Many are simply promises: the platform collects the card payment, holds it for a few days, and then forwards it. A true, regulated protected payment requires an authorized electronic money institution, segregated accounts, and written dispute rules. It's not a nuance; it's a completely different thing.

Credit cards, paradoxically, are still among the most protective tools we have for an online purchase. Chargeback, which is the ability to request a refund in case of a problem, has existed for decades and almost always works. The limitation is that it can take weeks between opening the case and receiving the refund, and not all banks handle it with the same seriousness.

New European regulations, which have progressively come into force in recent years, have significantly raised the bar. Today, any online payment above a certain threshold must go through strong customer authentication, meaning at least two different factors. The practical consequence is that classic "copy-paste" card theft works much less than before, and fraudsters have shifted towards social engineering.

Of course, something unexpected will still happen sometimes. It's part of the game. But when it does, if you've done your groundwork well, the problem will be resolved with a few emails rather than a complaint. That's already a huge victory, even if it doesn't seem like it.