(1) On receipt of a payment instrument, the payment service user is obliged to immediately take all reasonable precautions to protect the personalised security features against unauthorised access. The payment service user is to notify the payment service provider or an agency named by the latter of the loss, theft, abusive use or other unauthorised use of a payment instrument without undue delay having become aware thereof. The payment service provider may agree on a charge with the payment service user that is to apply to the replacement of a payment instrument that has been lost, stolen, misappropriated or otherwise used without authorisation; at a maximum, such charge is to cover the costs entailed exclusively and directly by the replacement.
(2) An agreement by which the payment service user enters into obligation vis-à-vis the payment service provider to comply with conditions for the issuance and use of a payment instrument is effective only insofar as these conditions are objectively justified, proportionate, and non-discriminatory.