5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Banking fraud in businesses
Approval is not the same as authorisation.
After phishing, smishing, fake customer service or identity theft, we examine whether the bank must refund unauthorised payments, how far the gross negligence objection extends and which evidence counts now. We review bank liability when fraudulent payments were approved in the business.
The first contact is free of charge. No costs arise without our prior express notice.
Response within 24 hours on working daysTo the cybersecurity main page
As of: 23 October 2026
Alleged bank customer serviceTue 08:47
A suspicious login was detected on your business account. Please confirm the security check in the app.
FinanceTue 08:52
The app only said approve security check. I did not see an amount.
House bankThu 14:10
The payment was authorised with pushTAN. A refund is therefore not possible.
Point of review: Authentication does not yet prove authorisation
- 1Secure the outflowChronology, records, blocking
- 2Examine the claimAuthorisation, negligence
- 3RecoverBank or court decides
Schematic illustration of a fraud sequence. Simplified example. Whether a refund is made is decided by the bank or, in the event of a dispute, a court.
We support payment cases for
- SMEs
- Online retail
- Agencies
- Start-ups
- Crypto companies
What should you do right now?
- Report the incident to the bank without delay and have affected access blocked. This report is required by law. Section 675l BGB: obligations of the payer
- File a criminal complaint and keep the case number.
- Secure emails, text messages, call logs, account statements and approval logs before systems are cleaned up.
Key points at a glance
- Under Section 675u BGB (German Civil Code), the bank must in principle refund unauthorised payments; under Section 675v BGB, the customer is liable only within narrow limits, above all in cases of gross negligence.
- At ITMR, we examine whether the payment was legally authorised, which authentication the bank can prove and whether its objection is justified.
- This results in a robust chronology and a coordinated recovery from the bank or payment service provider.
- Whether a refund is made is decided by the bank or, in a dispute, a court.
- Your contact is Timocin Can and his team. He is a lawyer. Response within 24 hours on working days.
Acute payment situation
When should banking fraud be reviewed by a lawyer?
In our experience, online banking fraud is rarely just a single wrong click for businesses. In our cases, outflow of funds, bank communication, internal approvals, technical authentication and securing evidence all come together.
Communicating imprecisely now risks a weaker position towards the bank or payment service provider.
In our experience, an outflow of funds via account, card, wallet or payment service often hits businesses at a critical moment. The bank refers to app approval, TAN, login or device binding. Internally, management, finance and IT have to reconstruct the sequence of events.
Fast help therefore means informing the bank, securing evidence and aligning communication legally from the outset. Whether phishing, smishing, fake contact or identity theft, we also support businesses where crypto law is involved.
We examine whether there is a claim to a refund or recovery, how the gross negligence objection is to be assessed, which evidence must be secured and how communication with the bank, payment service provider and platform is structured.
- Bank refuses refund
- It refers to TAN, app approval, login, device binding or strong customer authentication and places responsibility on the business.
- Fake bank contact
- An alleged bank employee, security dialogue, support contact or spoofed number led to approval, a limit change or disclosure of data.
- Payment service affected
- The outflow ran via credit card, PayPal, payment service provider, platform, wallet or a crypto-related interface.
- Internal approval unclear
- Management, finance, office, IT or external accounting have to reconstruct who saw which payment, warning or app display and when.
- Follow-up access possible
- Access, email accounts, devices, payment profiles or administrator rights could be further compromised.
The evidence must also hold up. Screenshots, bank messages, push notifications, logs, emails, phone numbers, URLs and account statements should be secured in an orderly way.
Besides the sequence of events, the legal position counts
For recovery, what counts above all is whether the payment transaction was legally authorised. Technical authentication and legal authorisation must be examined separately.
In our experience, banks often argue with proper login, app approval, TAN procedure or device binding. That is important for the review but does not end it.
The deception situation, duties of care and burden of proof decide whether the bank has a justified objection to the refund. We arrange these points into a robust line for the claim and communication.
Brief assessment before the initial conversation
Describe the amount, time and the bank's response. We will tell you which steps take priority now and which documents we need for the review.
How it works
How do you get to recovery in three steps?
After your enquiry, we will get back to you within 24 hours on working days.
01
Secure the outflow You describe the amount, time, bank response, approval route, communication history, affected accounts, payment services or wallets.
- Outflow
- Tue 08:53, business account
- Bank response
- Refusal, pushTAN
02
Examine the claim We examine authorisation, authentication, burden of proof, gross negligence, the bank's arguments, records and possible opponents.
- Section 675u BGBRefund
- Section 675v BGBNegligence
03
Recover We structure the next communication, deadlines, escalation options and the economically sensible approach. The bank decides on the refund.
What counts legally in the first hours
- 1
Have accounts blocked Have the bank and payment service block access. Further transactions must be prevented and the report documented.
- 2
Object Object to the affected payments. The bank must be able to see which transactions are disputed and which claims are being examined.
- 3
No hasty admissions Phrases such as “we approved it ourselves” can be misunderstood without context.
- 4
Create a chronology Minutes, messages, contacts, app displays, warnings and reactions must remain traceable.
- 5
Secure evidence Emails, text messages, URLs, phone numbers, screenshots, push notifications and account statements should not be deleted.
- 6
Check the IT security situation If devices, email accounts or admin access are affected, the case can also be a security incident.
Scope of work
What do we review in online banking fraud?
Service package: banking fraud
Payment and sequence analysis We put amount, time, recipient, approval route, device, app, TAN, login, push notification, limit change and the bank's response into a robust chronology.
Claim against the bank or payment service provider We examine whether the focus is on an unauthorised payment, misuse of a payment instrument, defective execution or another route to a claim.
Gross negligence objection We assess whether warnings, approval dialogues, security notices or unusual processes were so clear that they could jeopardise the claim.
Evidence on the bank's side We assess authentication, proper recording, security procedures, blocking response, risk monitoring and conspicuous transaction patterns from a legal perspective.
Evidence and communication line Screenshots, account statements, bank messages, push notifications, emails, phone numbers, URLs, the criminal complaint and internal responsibilities are put in order.
Out-of-court recovery We prepare the demand, deadline and negotiation and assess settlement, lawsuit and further opponents from an economic perspective.
- For whom
- Businesses, management and finance teams after an outflow of funds
- Service
- Review of claims and out-of-court recovery from the bank or payment service provider
- First response
- within 24 hours on working days
- Initial contact
- free of charge, to assess the outflow, the bank's response and the next step
- Costs
- We inform you expressly in advance. Only then do you decide.
- Not included
- Lawsuit, criminal complaint and action against other parties. This is a separate service, on request and as needed.
Who delivers what and who decides
- Account statements and bank letters
- Screenshots, text messages, emails and push notifications
- Names of the people involved internally
- Blocking and report confirmations
- Chronology and review of claims
- Assessment of the bank's arguments
- Recovery letter and setting deadlines
- Coordination with IT security and data protection
- The bank or payment service provider, on the refund
- In a dispute, a court
How does the engagement work?
- 1
First assessment We review your information and tell you whether the package fits or another route makes more sense.
- 2
Offer for the package If the package fits, you receive an offer for review, recovery letter and deadline monitoring. We only start once you agree.
- 3
Court steps separately A lawsuit against the bank and representation in court are not part of the package. We agree these steps separately if the bank does not refund.
Case groups
Which fraud scenarios does the service cover?
The service is deliberately broader than a pure phishing review. In our business cases, account, card, payment service, wallet, email communication, internal approvals and bank response often interlock.
Phishing Fake bank websites, emails or QR codes lead to entering login details or to approval.
Smishing Text messages, messengers or alleged parcel and bank notifications direct to manipulated websites.
Vishing and caller ID spoofing A fake bank customer service with a spoofed number gets employees to approve transactions or disclose data.
Approvals under deception PushTAN, app or device approvals are confirmed under false pretences.
Card and payment service misuse A credit card, wallet, PayPal or another payment service is misused.
Payment diversion and CEO fraud Fake invoices, changed bank details or alleged instructions from management divert payments.
Crypto and platform cases The outflow of funds runs close to the bank via an exchange, wallet or platform.
Core review in the mandate
What does recovery depend on?
For businesses, it is about more than the individual payment transaction. Roles, approval processes, responsibilities, power of attorney (Prokura), accounting, payment policies, IT security and communication with the bank must also be clarified.
| Review question | What matters | Typical document |
|---|---|---|
| Was the payment legally authorised? | What was displayed, how the approval came about and whether deception shaped the transaction. | App screens, push notifications, chronology |
| Which authentication can the bank prove? | Recording, security procedures and logs under Section 675w BGB. | Bank letter, information on the approval |
| Does the gross negligence objection apply? | Warnings, the deception situation, roles in the business and the specific sequence of events. | Message history, internal notes |
| Were there deficits on the bank's side? | Deficits in warnings, checks, blocking or communication and conspicuous transaction patterns. | Blocking confirmation, account statements |
| Which records support recovery? | Complete, orderly evidence instead of individual screenshots. | Evidence folder with timestamps |
Cases with several parties involved are particularly prone to errors. The account must then clearly distinguish between management, finance, office, IT, external accounting, bank contact and payment service provider. Otherwise, the claim quickly appears vague or contradictory.
Benefit
What do businesses get from the review?
The goal is not a blanket demand to the bank but a verifiable recovery strategy.
Outflow of funds, deception, authorisation and authentication are classified legally.
Possible claims against the bank, payment service provider or other parties are examined.
We assess the gross negligence objection on the basis of the specific sequence of events.
For the bank, police, insurer or management in one version.
The out-of-court recovery is ready, supplemented by an assessment of settlement, lawsuit or further escalation.
Connections to cybersecurity, data protection or crypto law are identified and classified early.
Follow-on routes
Which specialist route fits my case?
At ITMR, banking fraud is the response page for outflows of funds and digital fraud scenarios. Depending on the focus, the further assessment lies more in one of these areas of law.
IT-Recht For digital payment, platform, account, contract and system conflicts with a business connection.
Cybersecurity When devices, access, email accounts, admin rights or security incidents are also affected.
Crypto law When wallets, exchanges, custody, token holdings or crypto-related payment flows are part of the situation.
Data protection law When compromised accounts, personal data, customer information or reporting obligations are affected.
IT Law & Digitalisation For the overarching framework of digital business models, IT structures and platform risks.
Media and communications law When identity misuse, platform communication, visibility or reputation also play a role.
Legal framework
Which provisions apply to banking fraud?
In the case of unauthorised payment transactions, misuse of a payment instrument and disputed authentication, the payment services provisions of the BGB (German Civil Code) are central review points. They do not replace the review of the individual case but set the basic legal structure. Under Section 675u BGB, the bank must in principle refund the amount of an unauthorised payment transaction. For businesses, different agreements may apply under Section 675e(4) BGB, which is why we review the bank's terms.
At European level, payment services and fraud protection are being developed further. For current mandates, what remains decisive is which rules apply at the specific time and how the bank, payment service provider, platform and business actually acted.
- Section 675u BGB Refund in the case of an unauthorised payment transaction.
- Section 675v BGB Liability of the payer for misuse of a payment instrument.
- Section 675w BGB Proof of authentication and proper recording.
- BSI on online banking Security information on online banking risks.
- European Parliament on PSR and PSD3 Assessment of the political agreement on stronger fraud protection in payments.
Limits
What legal support does not replace
Legal recovery runs in parallel with technical stabilisation, not instead of it.
- 1
No forensics A legal review does not replace technical forensics, account blocking or an internal security clean-up.
- 2
No promised result A refund cannot seriously be promised. What matters are the sequence of events, evidence, approval route, bank response, duties of care and the economic ability to escalate.
- 3
No standard letter In our experience, a template email to the bank is often not enough in business cases. We examine how authorisation, authentication, deception, duties of care, the bank's checks and evidence fit together.
What unnecessarily weakens recovery claims
- Imprecise communication with the bank. If the sequence of events is described only roughly or contradictorily, the objection of own responsibility gains weight.
- Deleted evidence. Phishing emails, text messages, websites, call logs, app screens and bank notices can later be decisive.
- Only a criminal complaint, no claims strategy. The criminal complaint does not replace civil law recovery from the bank or payment service provider.
- Treating technology and law separately. Devices, email accounts, admin access and payment profiles can be relevant to the claim, evidence and future prevention.
- Accepting the bank's arguments unchecked. Successful authentication does not automatically mean that the question of liability has been conclusively resolved.
- Not reconstructing internal roles. Failing to separate which person saw which approval, message or warning weakens the business's account of events.
Your contact
Lawyer · IT law · Social media law · E-commerce
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“I have worked with a great many lawyers. Never has the process been as easy as here. Competent advice – quick handling – compliance with all deadlines – great availability. And the most important point for me: everything was handled with vigour! Very satisfied!” (translated from German)
“The appointment by video conference was very friendly and professional and helped me a great deal with the next steps.” (translated from German)
“"Thank you very much for the trust you have placed in me, and I am always pleased to hear or read from you. I will recommend your firm to anyone at any time!"” (translated from German)
FAQ
Frequently asked questions about online banking fraud in businesses
Does the bank always have to refund after online banking fraud?
No. It depends on whether the payment transaction was authorised, which authentication the bank can prove and whether gross negligence can be held against the business.
Is a TAN or app approval automatically valid authorisation?
Not necessarily. Technical authentication and legal authorisation must be examined separately. What matters is what was displayed, how the approval came about and whether deception or manipulation shaped the transaction.
What does gross negligence mean in banking fraud?
It may apply if particularly obvious security requirements were seriously disregarded. Whether this is the case depends on warnings, the deception situation, roles in the business and the specific sequence of events.
What should a business tell the bank first?
The report should document the affected payments, the time of discovery, the request to block, the objection to the transactions and the known sequence of events. Unclear speculation or admissions of fault should be avoided.
Is a criminal complaint enough?
No. The criminal complaint can be important but does not replace recovery from the bank or payment service provider. Criminal investigation and civil law claims follow different rules.
When is banking fraud also a cybersecurity case?
When devices, email accounts, admin access, payment profiles, passwords or internal systems may be compromised. Recovery must then be coordinated with technical security measures and internal damage limitation.
What is different when wallets, platforms or crypto are involved?
Then bank account, payment service, wallet, exchange, custody service, platform terms and transaction records may interact. The case should not be hastily treated as a mere bank, crypto or IT problem.
When should a lawyer be brought in?
At the latest in the event of a significant outflow of funds, refusal by the bank, an allegation of gross negligence, several parties involved, unclear approval or interfaces with a payment service, wallet, platform, cybersecurity or data protection.
Is a lawsuit part of the package?
No. The package covers review and out-of-court recovery. A lawsuit, criminal complaint and action against other parties are a separate service, on request and as needed.
Next step
Classify the outflow of funds on a sound legal basis
If the bank or payment service provider refuses a refund or places responsibility on the business, the case should be structured. This includes the sequence of events, evidence, opponents, objections and escalation options.
Helpful for the initial classification
- Account statement with the affected payments
- Letter or message from the bank
- Screenshots of text messages, emails, app and push notifications
- Short chronology with times
- Blocking and report confirmations
An incomplete collection is enough to start. We will sort the rest together.
Have outflow of funds reviewed
Briefly describe the amount, time, approval route and the bank's response.
Helpful are the account statement, bank letter and screenshots of the message history.
Related services
Cybersecurity When devices, access or email accounts are also affected.IT-Recht For digital payment, platform, account and system conflicts.Crypto law When wallets, exchanges or crypto-related payment flows are part of the situation.Data protection law When personal data or reporting obligations are affected.IT law & digitalisation Overarching framework of digital business models and IT structures.Media & communications law When identity misuse or reputation play a role.Data breach: help with a data breach When data has been leaked.