Phishing in online sales: Around 700 euros disappear from the account
A customer of a Polish bank wanted to sell an article on an online sales platform. A supposed buyer sent her a link that she was supposed to confirm the sale with. However, the link led to a fake website that looked deceptively similar to her bank's website.
The customer entered her online banking credentials there. Shortly thereafter, a third party transferred around 700 euros from her account. When she reported the incident to her bank the next day, the bank refused to refund the money, citing that the customer had enabled the fraud through gross negligence.
ECJ: Gross negligence alone does not justify immediate rejection
The Court of Justice made it clear: In the event of an unauthorized payment, the payment service provider must, in principle, immediately refund the amount, no later than by the end of the following business day after receiving or being informed of the payment. The allegation that the customer enabled the fraud through gross negligence is in itself not sufficient to refuse the immediate refund.
An exception may be considered in particular if legitimate reasons support the suspicion that the customer himself has committed fraud. In Austria, the bank must in this case immediately inform the financial market supervision (FMA) in writing of the suspicion of fraud.
What applies in Austria?
The requirements of the EU Payment Services Directive are in Austria in Section 67 ZaDiG 2018 Once implemented, the bank must restore the affected account to the state in which it would have been without the unauthorized payment. The amount must be repaid immediately, no later than the end of the following business day after the bank learned of or was informed about the payment.
Who ultimately bears the damage?
The immediate refund does not yet answer conclusively who ultimately bears the damage. The Court of Justice of the European Union resolves these questions: First, the unauthorized amount must be reimbursed in principle. Then the bank can demand compensation if it proves that the customer breached his obligations intentionally or with gross negligence. The bank must prove gross negligence.
It is not yet conclusively clarified how the bank can claim such compensation under Austrian law. The European Court of Justice does not require that a separate follow-up procedure must be conducted for this. The Supreme Court has so far left this procedural question open, leaving the procedure to be decided by the court. 8 or 115/25g was interrupted until the decision of the European Court of Justice was made.
The authorization question remains crucial
The ECJ judgment concerns a payment that has already been classified as unauthorized. Therefore, whether a payment was indeed unauthorized in the specific case must still be examined separately.
According to § 58 ZaDiG 2018, a payment is only considered authorized if the payer has agreed to its execution. Such consent does not automatically prove that access data or a payment instrument were used. The specific assessment depends on the circumstances of the individual case.
Phishing detected? Now it's time to act quickly
Anyone who notices an unauthorized payment should inform the bank immediately and have access to online banking or the affected payment instruments blocked. Keep any fraudulent messages, links, emails, and screenshots for later review. They may be important for later investigation.
If the bank refuses to refund the money or accuses you of gross negligence, it should be examined whether an unauthorized payment actually took place and whether the bank can substantiate its claims.
Are you affected by phishing fraud or has your bank refused the refund? We will examine your legal options and assist you in enforcing your claims. For a personalized consultation, please contact us. Anela Blöch and your team at the phone number 01 3912345 or by email bloech@atb.law happy to help.
