Overview
When phishing, perpetrators pose as a bank, parcel service, government agency or payment service. They use fake emails, SMS, messenger messages or calls to try to obtain access data, card details or approvals. The news and websites are often so well done that they can hardly be distinguished from the original. People of all ages and professional groups are affected.
From a legal perspective, the main thing that matters is whether you authorized the subsequent payments yourself or whether the perpetrators acted with the data obtained without your consent. The law in Section 675u of the German Civil Code (BGB) generally requires the bank to reimburse unauthorized payments. However, banks often refuse reimbursement on the grounds that you have acted with gross negligence.
There is no general answer to whether this objection is valid. The decisive factors are the specific process, the design of the deception, the approval procedure used and the question of what the bank can prove in the event of a dispute. This is exactly what we check based on your documents.
Immediate steps
These steps make sense in most cases – regardless of whether you instruct us.
Have online banking access and cards blocked immediately - directly at your bank or via the blocking emergency number 116 116. Note the date, time and person you spoke to.
Report the affected payments to your bank immediately and request reimbursement in writing. Describe the process objectively and truthfully and only sign pre-formulated statements once you have understood their content.
Retain emails, text messages, chat histories and call logs and take screenshots of the fake pages. Don't delete anything, even if the message makes you uncomfortable afterwards.
Change online banking and email account passwords from a secure device. Check your devices for malware and only remove programs that were installed at the request of the perpetrators after documentation.
Report it to the police, including online via your state's internet watchdog. The file number is often required by the bank and can be helpful for further clarification.
Unsure what to do first in your case?
Legal assessment
We check whether the payments were made with your consent. If the perpetrators have acted with intercepted data themselves, there is usually no authorization - then a claim for reimbursement in accordance with Section 675u of the German Civil Code (BGB) can be considered. If you have given a release yourself, you need to clarify exactly what it referred to.
According to Section 675v BGB, the bank can refuse reimbursement if you have grossly negligently breached your duty of care. Whether this is the case depends on the individual case - for example, how professional the deception was and what clues you could recognize.
We check whether the bank has required strong customer authentication for payments and for upstream steps such as registering a new device. If it is missing, the objection of gross negligence according to Section 675v Paragraph 4 BGB can be excluded.
In the event of a dispute, the bank must prove that the payment was authenticated and properly recorded. Mere recording is not necessarily sufficient to prove authorization or gross negligence.
Unauthorized payments must be reported to the bank immediately upon becoming aware of them. According to § 676b BGB, claims are generally excluded if notification is not made no later than 13 months after the charge.
Who may be liable
In the case of unauthorized payments, a claim for reimbursement against your own payment service provider should be considered. Whether it takes action depends in particular on the objection of gross negligence.
The money often flows into accounts of so-called financial agents. Claims for unjust enrichment or tortious acts may be possible against the account holder - provided that the account holder can be identified and is solvent.
Liability of the bank where the recipient account is held can only be considered under strict conditions, for example if there are recognizable and serious suspicions. We are checking whether there is any evidence for this.
In principle, there are claims for damages against the perpetrators. In practice, they can only be enforced if the investigation leads to an identifiable and tangible person.
Whether and against whom claims actually exist depends on the individual case and can only be assessed after reviewing the documents.
Preserve evidence
Do not delete anything – not even out of anger or shame. Your account of events is enough for the initial enquiry; documents can be submitted later.
Our approach
Using the form, you describe to us in a few minutes what happened. You can submit documents later.
We review your details, classify the facts and examine against whom claims may be available.
You receive an honest assessment of prospects, risks and costs – and decide for yourself whether to instruct us.
We implement the agreed strategy: towards banks, payment service providers and other parties involved, and in court if necessary.
FAQ
General guidance – it does not replace advice on your individual case.
That depends on the individual case. In the event of unauthorized payments, the law generally requires the bank to reimburse the payment, but the bank may be able to claim gross negligence under certain circumstances. We cannot and do not want to give a guarantee - we will check how the prospects should be assessed in your case.
A rejection is not the final word. Gross negligence involves more than a simple oversight, and the bank must explain and prove the circumstances from which it bases the allegation. We check whether the bank's reasons apply in your case.
Not necessarily. What matters is what was shown to you when it was approved and what you understand your confirmation referred to. This can only be assessed based on the actual process.
You should inform the bank immediately as soon as you notice the payments. The notification must be made no later than 13 months after the charge, otherwise claims according to § 676b BGB are generally excluded.
The initial assessment of your request is free of charge. We will inform you transparently about all other costs in advance, so that you can decide at your leisure whether you would like to commission us.
Knowledge centre
Phishing
· Manfred Kühn
If the bank refuses to reimburse you after a case of fraud, it is usually citing gross negligence. What the term means, who has to prove it and which circumstances count.
Phishing
· Manfred Kühn
After a phishing attack, the question arises as to whether the bank has to refund the debited amount. The decisive factors are the authorization of the payment and the accusation of gross negligence.
Banks
· Manfred Kühn
Negative entries at credit agencies can make loans, rental agreements and mobile phone contracts more difficult. An overview of how entries can be checked and when deletion is possible.
Case review
We will assess which claims may be available and which next steps may make sense.
Your details are treated in confidence. An enquiry does not yet establish a client relationship.
By telephone, by email or via the case review – in confidence and initially without obligation.