Money back after fraud: how to proceed now

A debit you never authorised. A transfer to fraudsters, a credit card emptied out, a trading platform that will no longer pay out your deposit. The shock is considerable – but your money is not automatically lost. In many cases the law obliges banks to reimburse you, and for almost every payment method there is a regulated route to recovery. Two things matter now: taking the right steps quickly and not letting any deadlines pass.

Immediate measures: the first 24 hours

1. Block. Have your card, online banking access or account blocked at once – the central blocking emergency number in Germany is 116 116, around the clock.
2. Inform your bank without delay. Report the unauthorised payment to your bank as soon as you notice it (§ 675l BGB obliges you to give notice without delay). Do so in writing as well, with a date – this secures evidence and sets the reimbursement obligation in motion.
3. For bank transfers: try a recall. Ask your bank on the same day to contact the recipient bank. An executed transfer cannot be reclaimed unilaterally – but if the money has not yet left the recipient's account, the recipient bank can freeze it.
4. File a criminal complaint – online or at any police station – and note down the file reference. The bank will ask for it afterwards.
5. Document everything. Screenshots, e-mails, text messages, chat histories, bank statements – delete nothing, not even the embarrassing parts. What counts is decided later.

Put your case in order: the fraud check

Which deadlines are running in your case, which obligations have you already met, which legal questions are open? The fraud check asks you six to eight questions about the incident and then sorts what you have told it: deadlines that are running, obligations and open legal questions – free, anonymous and without any assessment of the outcome.

Why the bank is the right point of contact – not the perpetrator

The perpetrators are usually based abroad and the money has been moved through intermediary accounts. A criminal complaint is important – as a rule it does not bring the money back. The legally regulated route runs via your bank:

• In the case of an unauthorised payment, the bank must reimburse the amount – without delay, at the latest by the end of the business day following your notification (§ 675u BGB). The account is to be restored as if the debit had never happened.
• The burden of proof lies with the bank (§ 675w BGB): it must show that the payment was authorised – or that you acted fraudulently or with gross negligence. The mere fact that a PIN or TAN was used correctly is, according to the case law of the Federal Court of Justice, generally not enough for that (BGH XI ZR 107/22).
• Only where the bank can prove gross negligence may it refuse reimbursement (§ 675v BGB) – more on this below.

Who is liable when, in detail: liability in online banking fraud and credit card fraud: who is liable?.

Which payment method, which deadline, which route to recovery?

This overview reflects the routes provided for by law and is deliberately simplified. Which route is actually open, and how promising it is, always depends on the specific individual case – and that is precisely where the dispute begins in practice.

"Grossly negligent"? The most common point of dispute with the bank

Almost every refusal rests on the same allegation: that you acted with gross negligence because you released the TAN yourself or clicked on a link. Two things generally speak against that – although the assessment always depends on the individual case:

First, the yardstick. According to the Federal Court of Justice, gross negligence is an "objectively serious and subjectively quite simply inexcusable" breach of the duties of care (BGH XI ZR 91/14). Falling for professionally executed phishing – a deceptively genuine bank page, a supposed employee on the telephone, manufactured time pressure – does not automatically meet that threshold. It depends on the precise circumstances of the individual case, and in many cases those affected are nevertheless held partly at fault.

Second, the burden of proof. It is not for you to prove that you took care – the bank must prove your gross negligence (§ 675w BGB). Blanket assertions ("the PIN was used, so it must have been you") are generally not enough for that.

How the scams work in detail and what each of them means legally: phishing · pushTAN fraud · hacked account · all scams at a glance.

The bank refuses – what now?

A refusal is not the end of the road, but it is also not unusual – banks frequently rely on contributory fault or gross negligence on the customer's part, and that assessment is not always wrong from the outset.

1. Object in writing and demand reimbursement under § 675u BGB, setting a deadline. Point to the bank's burden of proof.
2. Call on the ombudsman or conciliation body of the bank – free of charge and without registration.
3. Legal review. At this point at the latest it is worth looking at the documents: in some cases the refusal does not stand up to legal scrutiny, for instance because the bank could itself have recognised the conspicuous features of the transactions (night-time hours, rapid succession, a new device).
4. Fend off the consequences. If the bank reverses arrears or threatens debt collection and a Schufa entry, object in writing there as well.

Investment fraud, trading platforms, crypto

With fraudulent investments (fake trading platforms, "brokers" who refuse to pay out, crypto investments with advance costs), recovery works differently: here you have usually transferred the money yourself, so § 675u BGB generally does not help directly. What may come into consideration is a chargeback where payment was made by card, as well as claims against the payment service providers and accomplices involved. Claims against your own bank do not generally exist in this context simply because payments went to fraudulent recipients – not even where conspicuous features are recognisable in hindsight. Where the money has been transferred abroad, experience shows that recovering it from Germany involves considerable practical obstacles and is difficult to enforce in many cases. Which routes are open in an individual case depends heavily on the payment method and on the timing.

A warning about the second fraud: "recovery agencies" that promise to track down lost money against advance payment are almost always the next fraud – often the same perpetrators. Reputable legal enforcement never works with advance-payment promises of that kind.

Costs, legal expenses insurance and the next step

Many legal expenses insurance policies cover disputes with the bank – what legal expenses insurance pays in cases of internet fraud is something we have written up separately. Insured or not: lawyer Corinna Ruppel will look at your case in a free initial consultation – you will learn which claims come into consideration, which deadlines are running and what enforcement would cost, before you decide. More about representation: lawyer for online banking fraud · for credit card fraud · for bank transfer fraud.

Lawyer Corinna Ruppel represents victims of phishing, credit card and bank transfer fraud as well as investment fraud against banks and payment service providers. View profile

Further reading: Credit card fraud – an overview · Online banking fraud – an overview · Credit card fraud: what to do? · The bank will not pay

F.A.Q.