Online Banking Fraud

Whether credit card fraud at booking.com, fake emails in the name of major banks or data theft via companies such as Facebook and vinted: the scams used by fraudsters to obtain your account and payment details are becoming increasingly sophisticated. This clever approach often means that police investigations and chargeback attempts by banks come to nothing.

Have you been the victim of online banking fraud? Report the incident to your bank and the police. If the fraudsters responsible cannot be identified, you should file a claim for damages against your account-holding bank. As banks rarely act cooperatively here, legal support is often required to enforce your claim. In a free initial meeting, we offer you a clear view of the next steps in your case.

The most important facts in brief

• We experience it with our clients: Online banking fraud scams are very diverse and almost all banks are affected by phishing in particular
• If you have been the victim of a phishing attack, you should report the incident to your bank and file a complaint with the police
• According to the law, the bank must pay compensation in the event of fraud. If they refuse to accept liability, you should seek advice from a lawyer

Who pays for the damage caused by phishing, pharming and the like?

As a victim of fraud, you are generally entitled to compensation. If, for example, you have not authorized a transfer and have not breached your contractual obligations, your bank must pay compensation in accordance with §§ 675 u BGB ff.

A payment transaction is considered unauthorized if the transaction was not knowingly and intentionally approved by the account holder or an authorized person. This also applies if the fraudsters have managed to carry out the transfer with your help, e.g. when you receive a call from a supposed employee or by entering data on a fake website. It only becomes difficult if you have authorized the transfer yourself. But in this case, it may still be possible to assert claims.

If the money was sent abroad via a German interim account, you may be entitled to compensation from the account holder. In the legal field, this intermediate figure is referred to as a financial agent.

But even if the transaction went directly abroad: Your bank is generally obliged to reimburse you. After all, the transfer was made without your knowledge or consent. Only if the fault is legally on your side is your bank released from its obligation.

If you have breached your contractual obligations, it must be clarified whether your conduct was grossly negligent.

As the account holder concerned, you must not breach your duty of care. In online banking, you act with gross negligence if you seriously violate the due diligence required for payment transactions. This may be the case in particular if you disclose your online banking access data to a third party by telephone or e-mail.

The burden of proof regarding the breach of your duty of care lies with the bank in the first step(§ 675l BGB). Only when the latter has proven that it cannot be otherwise than that you have passed on the data do you have to demonstrate that you are not responsible for this.

In its ruling of June 5, 2025 (Ref. 8 U 1482/24), the Higher Regional Court of Dresden decided that a savings bank had to assume part of the loss in a specific case even though the customer had acted with gross negligence. This makes it clear that the bank may be liable in individual cases even if it breaches its duty of care.

Types of online banking fraud

Online banking fraudsters use numerous tricks to steal your money. The most common scam is phishing.

Here, the criminals send you links in e-mails that direct you to a fake bank website. Under the pretext of a fictitious problem, you are asked to disclose your account number and other data at this point. A phone call is also one of the popular scams where you are asked to access your account.

Unfortunately, the online banking fraudsters are so well positioned that the fake websites hardly differ from the original websites. The calls also appear to be made by authentic bank employees. It is particularly important that you never disclose your access data or TAN numbers by e-mail or telephone. A reputable bank will never ask for access to your bank account.

In addition, the fraudsters exploit loopholes that arise when changes are made to online banking software. For example, when switching to 2-factor authentication. Here they send numerous e-mails with a notice about the upcoming change of the authentication method. These e-mails contained fraudulent links asking users to install the new procedure themselves. A classic case of phishing.

Transfer fraud in online banking

Simple bank transfer fraud, on the other hand, hardly ever occurs among private individuals. For this scam, the fraudsters find out the bank customer's account details and submit a transfer. Alternatively, the criminals make use of the printed transfer forms by stealing them from the bank and manipulating them. The course of events is much easier to prove in the case of a forged bank transfer.

Under these circumstances, the bank is at fault, as it is obliged to carefully examine the risk of forgery. This not only applies to large banks such as Sparkasse, Postbank & Co. Smaller banks must also ensure sufficient security.

Account opening fraud in online banking

Data leaks also enable yet another method of online banking fraud. Using stolen or forged documents, the fraudsters open a bank account that they use for two options. Firstly, they submit a series of direct debits for the account details. As soon as the money is in the account and before the bank can recognize the fraud, the money flows abroad. In this case, the bank bears the loss.

Secondly, fraudsters can use a forged signature to obtain a debit card and use it to make purchases at various businesses. The merchant usually bears the loss here. The University of Bonn provides an Identity Leak Checker that you can use to check whether your information has been stolen.

However, a financial agent has nothing to do with this attempted fraud. While an account is opened with a false identity, the fraudsters use a real person for a financial agent.

Protection against online banking fraud

The mere suspicion of online banking fraud should prompt you to take action. Contact your bank immediately and have the account and all cards blocked. You can do this online at Sparkasse, Commerzbank and many other major banks. Check your bank statements and card debits.

If you are the victim of attempted fraud, report it to the police. It can help to create a memory log as soon as possible. Keep a written record of which events took place and when. The more details you can provide, the better. Save e-mails and text messages using screenshots and note the content of any phone calls, together with the date and time.

You should also contact a lawyer specializing in banking and capital market law. This will help you to enforce your claim for damages. Experience shows that the banks usually do not want to pay the refund.

The most important thing, however, is prevention. In their own interest, bank customers should never communicate their account details, TAN numbers and personal data by telephone, text message or e-mail.

How to get your money back with CDR Legal

In the event of fraud, banks initially assume that you as a customer have acted with gross negligence and must bear the loss yourself. However, this assumption does not always correspond to the legal situation. That is why we regularly represent clients affected by online banking fraud and enforce their claims with our many years of experience and expertise in banking and financial law.

Arrange a free, no-obligation meeting with us to tell us about your case and clarify the next steps. You are then free to decide whether you would like us to handle your case.

F.A.Q.