ECJ ruling: Banks must refund money in the event of account fraud

Clicking on a phishing link or a QR code that fraudsters use to get important data: This is happening more and more often on the Internet. “At first you get a huge fright,” says Rudolf Wolter, a doctor from Thuringia. "It makes you feel hot and cold down your spine and you think, 'For God's sake, what have I done?'"

He was a victim of such a scam. Fraudsters sent him a letter that looked like it was from his bank and contained a QR code. Wolter scanned the code - and in the end fraudsters withdrew more than 100,000 euros from his account. "It goes through your head: 'Man, did I really miss something important? Should I have done something?'" Wolter reports. The letter really looked deceptively real and was "so traditional as a letter" that he didn't think anything of it. “And then I made the mistake of scanning this code,” says Wolter.

Bad news for banks

But how do you get your money back in such cases? So far, banks have mostly refused to refund the money. They argue that customers need to be more careful. Clicking on such a phishing link or scanning a fraudulent QR code would be grossly negligent, i.e. a serious mistake on the part of the customer. And if the customer completely disregards all due care, the bank does not have to step in.

The European Court of Justice (ECJ) sees things differently and strengthens consumer rights with its ruling today. In such cases, banks would have to pay first. “In the event of an unauthorized payment transaction, the payment service provider is fundamentally obliged to immediately reimburse the amount of this transaction,” explains Helge Homburg, press officer of the European Court of Justice.

“Gross negligent behavior” is rare

In particular, the refund cannot be refused on the grounds that the customer made the debit possible through grossly negligent behavior - for example, by arguing that he did not adequately protect his personalized access data and security features.

As a first step, banks must immediately refund any money that fraudsters deduct from the account. However, the following also applies: In a second step, the bank can try to get the money back. To do this, she must first prove that the customer has actually made a serious mistake.

Good news for consumers

Overall, the verdict is good news for consumers, says lawyer Johannes Goetz: "Because now it's up to the bank to compensate for the damage. And if it is of the opinion that the customer acted with gross negligence and can prove this, then the bank must actively demand the money back and, if in doubt, take its own customer to court."

It will often be difficult for banks to prove that customers make serious mistakes when they fall for such phishing links or similar. Because the scams are getting better and better - also thanks to artificial intelligence - and the phishing attempts are becoming more and more genuine. Customers' mistakes are often not grossly negligent, says Goetz.

How should victims react?

Attorney Goetz explains what should be done immediately if you notice fraud: "First inform the bank and then block everything that is possible. So block the account, block cards, block online access." You also have to ask the bank to reimburse the fraudulently debited amount.

The next step is to secure evidence. Emails, screenshots and anything else related to the fraud should be saved carefully, says Goetz. Because: “You will need that later if there is a dispute with the bank.” You can also inform the police - but police investigations in such cases are usually not very successful.