The ruling of the Linz Higher Regional Court: A decision for consumer protection
In the specific case, a bank customer fell victim to a classic phishing attack. He received an SMS that appeared to be from his bank and was asked to update his data due to an alleged system upgrade. He followed the link, entered his access credentials, and—believing he was confirming a security measure—authorized a transaction.
The court of first instance initially dismissed the customer's lawsuit for a refund. The argument: The customer had acted with gross negligence. But the Higher Regional Court of Linz saw it differently and overturned the judgment or ruled in favor of a Apportionment of loss.
Why did the bank have to partially compensate for the damage?
The court recognized that although there was misconduct on the part of the customer, the bank had not sufficiently fulfilled its own duty of protection. In particular, this concerned the so-called Fraud Transaction Monitoring. Banks are legally obligated to detect and prevent unusual transaction patterns. If a system fails that should have stopped such obvious fraud, the bank cannot simply shift the loss onto the customer.
When is the bank liable for phishing in Austria?
The legal basis for liability in the event of unauthorized payment transactions can be found in Payment Services Act 2018 (ZaDiG 2018). Basically, the following applies:
-
Unauthorized payment: If the customer has not effectively authorized the payment (e.g., because they were deceived as to the nature of the transaction), the bank must immediately refund the amount pursuant to Section 68 of the 2018 Payment Services Act (ZaDiG 2018).
-
The exception – Gross negligence: The bank can refuse the refund if the customer has acted fraudulently or [has breached] their duty of care grossly negligent injured.
The New Perspective on „Gross Negligence“
In the past, almost every click on a phishing link was interpreted as gross negligence. Today, the Higher Regional Court of Linz and the Supreme Court (OGH) make a greater distinction.
-
How professional was the forgery?
-
Was the customer heavily pressured through social engineering?
-
Was it recognizable to a layperson that it was a fraudulent website?
If the deception is particularly skillfully done, there is often only a slight negligence before – and in this case the Bank must fully reimburse phishing damage.
The Role of Fraud Transaction Monitoring
A central point in the proceedings before the Higher Regional Court of Linz was the bank's duty of monitoring. Modern banks use algorithms to prevent fraud. For example, if:
-
an unusually high amount is transferred abroad,
-
the transaction is made from an unknown device or location,
-
or user behavior deviates massively from the usual,
the system must sound an alarm. The Higher Regional Court of Linz emphasized that banks have a objective duty of care . If the bank fails to implement warning mechanisms or to respond to warning signs, it bears contributory negligence.
Liability sharing between bank and customer: What does that mean financially?
The Loss sharing in bank fraud means that the court weighs the responsibilities. In the case of the OLG Linz, this meant that the customer was not left bearing the entire loss.
Often a quota of 50:50 or 75:25 applied, depending on how severe the customer's mistake was and how flawed the bank's security system was. For phishing victims, this is a huge success as it paves the way to recover at least a significant portion of the lost money instead of ending up empty-handed.
Phishing in online banking: Typical scenarios in Austria
Scammers are becoming increasingly sophisticated. In our legal practice, we primarily see the following methods:
-
Vishing (Voice Phishing): A fake bank employee calls and persuades the customer to approve a transaction in the app.
-
SMS Phishing (Smishing): Messages about expiring debit cards or blocked accounts („Your s-ID Check must be renewed“).
-
Reverse Phishing: Scammers pose as buyers on platforms like Willhaben and send links to fake payment pages.
In all these cases, the question arises: Does the bank have to pay in the event of online banking fraud? The answer is more and more often: Yes, at least in part.
Checklist: What to do after a phishing incident?
If you notice that unauthorized withdrawals have been made from your account, every minute counts.
-
Block account and cards: Call your bank's blocking hotline or the central card blocking emergency number immediately.
-
Secure evidence: Take screenshots of the phishing text message, the website, and the transaction history in your banking app. Do not delete anything!
-
File a report: File a report with the police. Prior legal advice or preparation of the report by a lawyer is recommended.
-
Contact bank: Request the refund of the amount in writing in accordance with the 2018 Payment Services Act (ZaDiG 2018).
-
Legal review: Do not let yourself be fobbed off with a standard rejection letter from the bank („You acted with gross negligence“).
FAQ: Frequently asked questions about bank liability in phishing cases
1. Does the bank always have to compensate for the damage?
Not always, but more and more often. If the bank cannot prove that you acted with gross negligence, it must bear 100 % of the loss. In cases of contributory negligence, the loss is apportioned.
2. Does confirmation via app (two-factor authentication) count as gross negligence?
Banks like to claim that. Case law takes a more nuanced view: if the app authorization was provoked by clever deception (social engineering), that is not automatically gross negligence.
3. How much time do I have to report the damage?
You must report the unauthorized payment transaction to your bank immediately after discovery, but no later than 13 months after the debit.
Conclusion: Fighting is worth it
The ruling by the Higher Regional Court of Linz is a clear signal to the financial industry: responsibility for security in online banking does not lie solely with the customer. If you are a victim of online banking fraud have become, you have a good chance in Austria of getting your money back – or at least achieving a fair sharing of the damages.
Have you lost money through phishing? Have your claims examined. We support you in taking action against the bank and asserting your rights. Banks often back down once they see that affected parties are making legally sound arguments and are familiar with current case law.
Contact ATB.LAW for a non-binding initial assessment of your case.
