Phishing verdict from Koblenz: No negligence in deceptively real bank call

The Koblenz Higher Regional Court (OLG) has strengthened the rights of bank customers in the fight against professional phishing on the internet. It had to clarify when online banking users act so carelessly in a fraud scenario that they lose their claim for reimbursement of damages against the bank. In a ruling available to heise online dated April 17, the judges clarified that even clicking on links in SMS messages and entering transaction numbers (TAN) into a browser form of the home banking application does not automatically justify the accusation of gross negligence (Ref.: 8 U 682/24).

The three bundled cases, which the OLG has now decided in the second instance, illustrate the professionalism of modern fraudsters. The customer of Sparkasse Westerwald-Sieg, who was primarily affected, was told by an alleged employee of the technical department over the phone that he had to switch his security procedure from Chip-TAN to Push-TAN. The caller used "Call ID Spoofing," causing the victim's phone display to show the real number of their Sparkasse. Since the caller also knew various personal details of the customer, the latter did not become suspicious and followed the instructions.

In the course of the phone call, the customer, whose two accounts were combined online as part of a so-called multibanking, did generate a transaction number with his Chip-TAN generator and entered it into the online banking portal. According to his own statement, he did not verbally communicate the TAN to the caller. Shortly thereafter, several real-time transfers abroad took place, resulting in a total of over 56,000 euros disappearing from the two accounts of the plaintiffs. While the Koblenz Regional Court had initially affirmed gross negligence on the part of the customer, the OLG has now fundamentally revised this view.

The role of technical expert reports

A decisive factor for the outcome of the appeal proceedings was an IT expert report. The bank had claimed that the customer must have actively transmitted a special activation code to the perpetrators, as this was technically essential for linking the Push-TAN app on the perpetrator's mobile phone. However, the expert refuted this: In the procedure used, the activation code is displayed directly in the app on the device to be linked – in this case, directly on the fraudster's mobile phone. The customer could therefore not have seen this code and consequently could not have passed it on with gross negligence.

The 8th Civil Senate emphasizes that gross negligence only exists if the required care is violated to a particularly severe degree and simple considerations are not made. In a situation of being overwhelmed by professional perpetrators who use real bank data and falsify phone numbers, such a serious accusation cannot be made against the customer. Clicking on a link in an SMS from the bank, which was sent automatically as part of the regular update process, is also not negligent. Rather, this corresponds to the intended use.

Signal effect for bank customers

In the ruling obtained by the law firm Ilex Rechtsanwälte for the plaintiffs, the second instance also emphasizes the obligation of banks to refund unauthorized payments in accordance with Section 675u of the German Civil Code (BGB). This applies at least if the financial institutions cannot prove grossly negligent behavior. The burden of proof therefore lies entirely with the payment service provider. For online banking users, the ruling brings more legal certainty: As long as security features are not actively and carelessly disclosed to third parties, protection against the financial consequences of cybercrime remains in place.

The OLG ordered the Sparkasse to fully refund the amounts plus interest. It did not allow an appeal to the Federal Court of Justice. The defendant could at most file a complaint against this. The ruling thus shows that the judiciary sometimes takes into account the technical complexity of fraud schemes and does not solely place the responsibility on customers who are confronted with increasingly sophisticated phishing methods. Last year, the Rostock Regional Court ruled on the other hand: Users who transfer money to a wrong account due to a manipulated email in a phishing attack must still comply with the claims of the account holder.

(vbr)