A payment transaction can only be considered to be authorised if you have given your consent to execute such a transaction. The way such consent is to be given has to be agreed in the contract between you and the payment provider (such as a bank). You may withdraw such consent but only in specific and limited circumstances.
It is always for the payment provider to prove how the transaction had been processed. If you deny having authorised an executed payment transaction, the use of a payment instrument recorded by the bank is not sufficient to prove that that transaction was authorised by you or that you acted fraudulently or negligently.
Payment Services Directive 2
According to general safeguards and corrective measures under the Payment Services Directive 2:
you have the right to obtain correction from your payment service provider if you notify it on becoming aware of any unauthorised or incorrectly executed payment transactions no later than 13 months after the debit date (i.e. the date on which the transaction appeared on your statement);
in order to safeguard your interests, the payment service provider reserves the right to block a payment instrument – typically for objectively justified reasons related to the security of the payment instrument or the suspicion of unauthorised or fraudulent use of the payment instrument;
if the payment service provider proposes changes to the conditions of the framework contract you are deemed to have accepted those changes if you do not notify the payment service provider before the proposed date of their entry into force that you do not accept the changes. In the event that you reject those changes, you have the right to terminate the framework contract free of charge and with effect at any time until the date when the changes become operative.