Munich Regional Court II: Bank not responsible for phishing damage

The Munich Regional Court II has ruled that a bank does not have to reimburse a damaged customer for the entire loss after a phishing attack. This is one of the first rulings in such a case. It is not conclusive; the plaintiff has time to accept or reject a settlement.

20,000 euros looted

The course of events is unsurprising for a phishing attack: the plaintiff received an e-mail with an invitation to the e-Tan procedure. However, the mail did not originate from the bank itself, but from unknown persons who eventually captured the money in question. Shortly after the false mail, the plaintiff also received a letter that actually came from her bank and received access data for an online banking account. The plaintiff then called up the fake website specified in the mail and entered the code she had received from her bank – which gave the unknown persons access to her account. As a result, around 20,000 euros were debited. More than 12,000 euros of this amount were not taken directly from the plaintiff’s account, but from that of her son. The account of the plaintiff’s husband was also accessed.

Negligent action by the plaintiff

The court saw the entire course of events as made possible by the plaintiff’s negligent actions. Not only due to numerous spelling mistakes in the fraudulent mail, but also due to the fact of receiving two letters within a short time with similar subject matter, but clearly differing concrete instructions, she should have become suspicious. The fact that the bank’s letter contained a note never to pass on the code by telephone, but not one not to enter it on a fake website, was thus rejected as irrelevant. The comments strongly suggest that the court would rule in favor of the bank if it had to.

Whether that will actually be the case is not clear at this point, as the bank has offered the plaintiff a settlement: it would reimburse the son, who was harmed through no fault of his own, 2,000 euros. The plaintiff, for her part, had previously offered a settlement that provided for the payment of 6,500 euros to her son. If she accepts the bank’s offer, the case will be settled. Otherwise, the regional court will issue a verdict in March.