DR. SARAFI Rechtsanwälte / HomeFrankfurt am Main · Throughout Germany

Money missing from your bank account

Lawyer for phishing and online banking fraud.

Phishing: has your bank refused a refund?

A fake bank call, phishing message or unauthorised transfer has left money missing from your account. Your bank points to your transaction code or alleges gross negligence. We examine the payment, the bank’s refusal and possible claims. We agree the scope and fees before you instruct us.

Request a review of your phishing case

Advice & representation

Phishing and online banking fraud
in practice.

Prompt reimbursement and the final allocation of the loss are separate questions. On 15 October 2026, in C-70/25, the Court of Justice of the European Union held that a bank cannot refuse prompt reimbursement of an unauthorised payment on the ground of the payer’s gross negligence. A later claim by the bank remains possible if its requirements are met. For your case, we examine authorisation, evidence, timely notification and the bank’s objections.

01

The bank’s refusal and your refund claim

We assess the bank’s reasons and examine reimbursement under section 675u of the German Civil Code in light of CJEU C-70/25. The judgment expressly separates immediate reimbursement from the later allocation of liability (paragraphs 31 to 42 and 46). A general allegation of gross negligence therefore does not resolve whether the bank must reimburse first.

Understand the CJEU judgment and its limits
02

Transaction codes, banking apps and device approval

What was actually displayed and confirmed? We distinguish registering a device, technical authentication and consent to a particular payment. Under section 675w of the German Civil Code, recorded use of a payment instrument alone does not necessarily prove authorisation or gross negligence. The actual displays and sequence remain decisive.

03

Fake bank calls and deceptive messages

For email phishing, text-message scams or a supposed security call, we reconstruct the chronology with you. Messages, call records, warnings and payment details matter. Even if you performed one step yourself, it must be established whether you consented to the payment later debited. A transfer you authorised does not automatically become unauthorised because you were deceived.

04

Counterclaims and cost risks

An initial refund does not necessarily mean you can keep the money permanently. We examine any counterclaim by the bank under section 675v of the German Civil Code, including statutory exceptions to liability. The CJEU emphasises the bank’s burden of proving gross negligence (C-70/25, paragraph 40). Prospects, the amount lost and expected costs are considered together.

05

Legal action after an agreed instruction

After assessment and acceptance of the instruction, we can pursue reimbursement from the bank and address its objections. Whether court proceedings are appropriate is assessed separately in light of the case and costs. An enquiry does not itself establish representation or responsibility for deadlines. We cannot guarantee reimbursement or a particular processing time.

06

Immediate steps and an evidence checklist

Our concise checklist covers contacting the bank, blocking access, preserving evidence and preparing your enquiry. Download the German-language PDF directly. Doing so does not send us any case details.

Download the phishing checklist (German PDF)

Specific enquiries

Is this the right service for you?

For consumers affected by phishing and unauthorised bank payments

My bank refused a refund after phishing. Can you take on the case?

Tell us the amount, when you discovered the incident and the bank’s reasons. We assess whether we can accept the instruction, payment authorisation and the available evidence. Legal work and its fees are agreed in advance.

Describe your phishing case

A supposed bank employee persuaded me to approve something in the app. What matters now?

Preserve what device or payment approval was displayed, as far as you still can. We need the sequence of events and bank documents for the legal assessment. Immediate blocking and notification to the genuine bank take priority.

Read about reimbursement and evidence

The first request

These documents
help us review your matter.

First, briefly describe the facts. We will coordinate with you how to submit further documents.

  • Bank statement showing dates, amounts and disputed payments
  • The full refusal letter and previous bank correspondence
  • Messages, call records and any saved approval screens
  • Chronology and evidence of your notification and account or instrument blocking
  • Any police reference number; never send PINs, transaction codes or passwords

Working with us

From the request
to the mandate.

Before the assignment, we agree on the scope of services and remuneration. When taking over, we will name your legal contact person.

01

Inquiry

They describe the facts, the parties involved and known deadlines.

02

Acceptance of your matter

We agree on performance and compensation and name your contact person.

03

Case handling

The responsible lawyer will check your documents and coordinate the procedure with you.

Phishing and online banking fraud

Questions & answers.

What should I do immediately after discovering the fraud?

Contact your bank immediately using a number you have independently verified. Have affected access and payment instruments blocked, report the disputed payments and ask about a recall. Preserve messages and documents. A police report does not replace notification to the bank. Do not wait for a legal appointment before taking these steps.

Must the bank reimburse first despite alleged gross negligence?

For an unauthorised payment, generally yes. CJEU C-70/25 separates prompt reimbursement from a possible later claim by the bank. The exception concerns reasonable grounds for suspecting fraudulent conduct by the payer, reported in writing to the competent authority (paragraphs 31 to 42). The fact that a third party defrauded you is not enough. Timely notification is still required.

I entered a transaction code. Does that defeat my claim?

No. A transaction code alone does not settle every legal issue. What you confirmed and what information was displayed matter. Section 675w of the German Civil Code distinguishes technical use of the payment instrument from authorisation and evidence of a breach of duty. We examine the specific payment and the bank’s records.

Does the CJEU judgment also cover transfers I initiated myself?

The judgment concerns unauthorised payments. If you consented to a specific transfer, deception alone does not establish the same refund entitlement. Payment approval, device approval and the fraudster’s actions must be examined separately. We therefore do not promise a refund for every online scam.

What notification deadline applies?

Notify your bank without delay after discovering the transaction. Section 676b of the German Civil Code also generally provides a 13-month exclusion period; its start depends on the information the law requires the bank to provide. That outer limit is not a reason to wait. Older transactions or court documents require an individual assessment of deadlines.

How much does legal assistance cost?

We agree the scope and fees before you instruct us. The amount involved, documents, the bank’s objections and possible litigation affect the work required. If you have legal expenses insurance, cover must be assessed separately. No success rate or blanket refund promise is given.

SARAFI.CONSUMER LAW

Your concern: Consumer law

Briefly describe your case and known deadlines. We clarify the takeover, the scope of services and the remuneration.

Get in touchBook a consultationinfo@sarafi.deAn engagement begins only when we expressly accept it.

English translation of our German website. Statutory references concern German or EU law. The German original remains available through the language selector.