After the theft of the mobile phone, unauthorized payments and loans follow.
During a trip abroad, an Austrian bank customer had his smartphone stolen. The device was protected with a personal code and Face ID. Upon his return, he informed his bank about the theft and requested the blocking of his account and the associated payment instruments.
Nevertheless, further payments were subsequently triggered. In addition, unknown parties concluded credit and installment payment agreements in his name. The damage incurred amounted to the five-digit range.
The case shows how quickly a stolen smartphone can become a gateway to further financial damage. In addition to the bank liability, it is also necessary to separately examine whether the credit agreements concluded without the knowledge of the person concerned actually came into effect.
Unauthorized payments: When does the bank have to issue a refund?
According to § 58 of the ZaDiG 2018, payment is only authorized if the customer has agreed to its execution. If the customer disputes the authorization, the payment service provider must provide certain proofs of authentication and execution of the payment. The mere use of a payment instrument in itself does not necessarily prove that the customer has agreed to the payment.
In the event of an unauthorized payment, the bank must, in principle, refund the amount immediately, no later than by the end of the following business day after it has learned of or been informed of the matter. This applies according to the judgment of the European Court of Justice of October 15, 2026 in the case Tukowiecka (C‑70/25) even if the bank accuses the customer of gross negligence. Gross negligence alone is not a reason to refuse immediate reimbursement.
An exception exists in particular in cases of reasonable suspicion that the customer himself has committed fraud. In Austria, the bank must immediately report such suspicion in writing to the Financial Market Authority (FMA).
The bank's fraud detection system can also play a role.
Banks must establish appropriate measures and control mechanisms to manage operational and security-related risks. This includes monitoring payment transactions for any signs of fraud.
In another phishing case, the Oberlandesgericht Linz upheld the bank’s complicity due to insufficient transaction monitoring and shared the damages. Numerous unusual transfers had been made within a short period of time there. The decision shows that, in addition to the customer’s behavior, the bank’s specific fraud detection can also be considered. However, it concerns a different matter and cannot easily be applied to every phishing case.
After a mobile phone theft: quickly lock the bank and payment instruments
Anyone who loses their mobile phone or notices theft should immediately inform their bank and have the affected payment instruments blocked. The loss or misuse of the funds should be reported to the bank as soon as possible. A police report, the preservation of messages and account statements, and written confirmation of the blocking request can also be important for subsequent clarification.
Also check whether contracts, loans, or installment purchases have been made in your name in addition to the payments. If you dispute such transactions with the respective companies explicitly, have the further charges reviewed.
Mobile phone stolen and money disappeared from the account? We are checking whether payments were authorized, whether the bank fulfilled its obligations, and what steps can be taken against unauthorized debits or contract terminations.
For individual advice, you are Anela Blöch and your team at the phone number 01 3912345 or by email bloech@atb.law happy to help.
