In case of fraudulent use of an electronic payment instrument the question arises who bears the financial consequences of such losses. Since in most cases it is impossible to determine who committed fraud, the loss will have to be allocated between the payment service user and the payment service provider. The first part of this article will focus on the rules (incorporated in the new Payment Services Directive) (Kierkegaard, 2007; Vanden Bosch and Mathey, 2007) determining who is liable in case of fraudulent use of a traditional electronic payment instrument, such as a debit card, a credit card or an e-banking system. In doing so, we will especially focus on the concept of extreme negligence and the problems concerning the burden of proof. In the second part of this article we will discuss the applicability of these rules allocating liability to mobile payment instruments, using the new Belgian payment system 'pingping' as an example.