9,321 euros gone after phishing: no gross negligence

The case

A bank customer offered an item on the 'Vinted' platform and then received an email asking him to confirm the alleged sale. He followed the instructions and entered his payment details on a fake page. Shortly afterwards, his bank's banking app was set up on a new mobile phone that did not belong to him — for this purpose, the bank had sent an activation code by text message, which the customer had entered on the fake page, although the text message expressly stated that the code should only be used within his own banking app. Within 34 minutes, five transactions abroad totalling 9,321.79 euros were made with his credit card. The bank refused a refund, arguing that the customer had acted with gross negligence.

The decision

The LG (Regional Court) Berlin II largely found in favour of the customer (judgment of 13.3.2026 – 38 O 262/25, not final, appeal pending before the Kammergericht (Higher Regional Court of Berlin) under 26 U 38/26). The mere record that a technical authentication took place does not yet prove that the payment transaction was also authorised by the customer — the bank bears the burden of proof for this. Prima facie evidence (Anscheinsbeweis) in the bank's favour had already been rebutted here by the atypical course of events: the sudden change of device, followed by five foreign transactions within half an hour, pointed to misuse by third parties, not to authorised action by the customer.

The standard of gross negligence

The court also did not follow the bank on the standard of fault: gross negligence requires a breach of the duty of care that is objectively serious and subjectively utterly inexcusable — merely objectively incorrect conduct is not automatically sufficient for this. The customer had credibly stated that he was using the platform for the first time, believed the process to be a necessary verification and assumed that by entering the code he was merely enabling access via his daughter's mobile phone, from which he had made the entries. In these specific circumstances, the court assessed the conduct as merely simple negligence — with the result that the customer only had to bear the statutory deductible of 50 euros and was refunded the rest.

Assessment

The case is one of a whole series of similar decisions in which German courts are increasingly setting a high threshold for gross negligence in phishing cases: according to these, anyone who falls victim to a well-crafted fraud attempt for the first time on a platform unfamiliar to them does not automatically act with gross negligence merely because they entered a code on the wrong page. For those affected, this means: a blanket refusal by the bank with reference to 'gross negligence' should not simply be accepted — the specific circumstances of the individual case are decisive, and the burden of proof for this lies with the bank, not the customer.