Overview
In online banking fraud, perpetrators gain access to the account and initiate payments that the account holder has not agreed to. The ways to get there are different: calls from alleged bank employees, remote access to the computer, the secret registration of a new device for the pushTAN or app process or releases that are obtained by fraud under a pretext.
The law protects bank customers comparatively extensively in this situation. According to Section 675u of the German Civil Code (BGB), the bank must generally reimburse an unauthorized payment amount and restore the account to the level it would have been in without the debit. They may refuse this especially if the customer has intentionally or grossly negligently violated their duty of care (§ 675v BGB).
In practice, this is exactly what is being debated. Many of those affected receive a curt rejection letter accusing them of gross negligence. Whether this accusation is justified depends on the specific process, the security procedure used and the evidence provided by the bank. We'll look at this in detail.
Immediate steps
These steps make sense in most cases – regardless of whether you instruct us.
Have online banking, registered devices and cards blocked - via your bank or the blocking emergency number 116 116. Record the date and time of the blocking message; After notification, you are generally no longer liable for any further orders.
Report the unauthorized payments to your bank and request reimbursement in writing. At the same time, ask the recipient bank to try to recall the transfers.
Record the process promptly in a memory log. Back up call logs, messages, app screen screenshots and bank notifications.
Disconnect remotely and change passwords for online banking and email from a secure device. Document installed remote maintenance programs before removing them.
File a police report and note the file number. Describe the process as precisely as possible, because the information can later play a role in civil law.
Unsure what to do first in your case?
Legal assessment
We check whether the payments were initiated without your consent - for example by perpetrators who acted via a self-registered device or remotely. In this case, a claim for reimbursement in accordance with Section 675u of the German Civil Code (BGB) can be considered.
The bank can refuse reimbursement if you have grossly negligently violated obligations under Section 675l BGB or the conditions for online banking. We examine whether the accusation is valid in view of the specific deception and the circumstances that you can recognize.
If the bank does not require strong customer authentication for payment or for security-relevant processes such as registering a new device, it cannot invoke gross negligence according to Section 675v Paragraph 4 of the German Civil Code (BGB). This is often a key test point.
The bank bears the burden of proof that the payment was authenticated, properly recorded and not affected by a disruption. We check which protocols and documents the bank presents and what actually results from them.
In exceptional cases, it may play a role whether the bank should have reacted to clearly conspicuous events, such as unusual limit changes in connection with large foreign transfers. Whether anything can be derived from this is always a question of the individual case.
Who may be liable
In the case of unauthorized payments, the main consideration is a claim for reimbursement against your own payment service provider. Whether it takes action depends primarily on the objection of gross negligence.
Repayment claims may be possible against the account holder whose account the money was received. These are often financial agents whose solvency is open.
Claims against the recipient's bank can only be considered under strict conditions. We check whether there is evidence of this in the specific case.
Claims for damages against the perpetrators generally exist, but can only be realized if the investigation leads to a tangible person.
Whether and against whom claims actually exist depends on the individual case and can only be assessed after reviewing the documents.
Preserve evidence
Do not delete anything – not even out of anger or shame. Your account of events is enough for the initial enquiry; documents can be submitted later.
Our approach
Using the form, you describe to us in a few minutes what happened. You can submit documents later.
We review your details, classify the facts and examine against whom claims may be available.
You receive an honest assessment of prospects, risks and costs – and decide for yourself whether to instruct us.
We implement the agreed strategy: towards banks, payment service providers and other parties involved, and in court if necessary.
FAQ
General guidance – it does not replace advice on your individual case.
That depends on the individual case. In the case of unauthorized payments, there is generally a legal claim to reimbursement, but this can fail due to the objection of gross negligence. There is no guarantee - after reviewing your documents, we will assess what your prospects are.
Rejection letters are often general. Gross negligence requires conduct that breaches the standard of care to an unusual degree, and the bank must prove the relevant circumstances. We will check whether the accusation is valid in your case.
This cannot be said in general terms. It depends, among other things, on how the call was structured, what information the perpetrators already had, which phone number was displayed and what specifically you released. Courts evaluate such processes differently.
If perpetrators initiate the payment themselves via remote access, your authorization may be missing. Whether this is the case and what role the approvals you have given must be checked based on the exact process.
The initial assessment of your enquiry is free of charge. We inform you transparently in advance about all further costs before you decide whether to instruct us.
Knowledge centre
Phishing
· Manfred Kühn
If the bank refuses to reimburse you after a case of fraud, it is usually citing gross negligence. What the term means, who has to prove it and which circumstances count.
Phishing
· Manfred Kühn
After a phishing attack, the question arises as to whether the bank has to refund the debited amount. The decisive factors are the authorization of the payment and the accusation of gross negligence.
Court rulings
· Manfred Kühn
Headlines about rulings on phishing and bank liability raise hopes or worries. Why every decision depends on the individual case - and how reports about judgments can be soberly classified.
Case review
We will assess which claims may be available and which next steps may make sense.
Your details are treated in confidence. An enquiry does not yet establish a client relationship.
By telephone, by email or via the case review – in confidence and initially without obligation.