In the UK, the bank is liable for any transactions on your account that you didn't approve. Doesn't matter that they thought you approved it because someone knew your pin, or compromised your device.

Unless the bank has reason to believe that you're either trying to defraud the bank, or where unduly careless with your banking credentials (and you have to be really careless to meet that bar in the eyes of the regulator and the courts), then they're expected to refund you.

I've seen banks refund £100ks to customers that were defrauded over many months via romance scams. There are cases ruling by the Financial Ombudsman forcing banks to refund customers to handed over their cards and PINs to carers that then stole money.

The general attitude of the law in the UK, the regulators, and the courts, is basically it's the banks responsibility to provide appropriate security, in a form that their customers can easily use and understand. If banks want to make it easy for customers to move and spend money, then the risks associated with that convenience accrue with the bank, not their customers.

Obviously banks work very hard to worm their way out of their responsibilities here. But if you use the consumer protection tools that exist in the UK, which are very easy to access, and which your bank is required to inform you of, then it's surprisingly easy to force a bank to refund you for any fraud you suffer.