Phishing on Classified Ads: €2,890 debited from account – when banks must reimburse
A first-time user lost almost €3,000 through a fake classified ads email. Courts often rule in consumers' favour.
Fake payment email on classified ads costs seller almost €3,000
Verbraucherzentrale-niedersachsen.de reports a case showing how sophisticated phishing attacks on classified ads users have become: a consumer wanted to sell a used folding table on the platform for the first time – and lost €2,890 in the process.
After listing the item, he received messages from a supposed prospective buyer as well as an email from the sender "Kleinanzeigen Team". The presentation appeared authentic and followed the style of the genuine platform. The message read: "Pay safely – The buyer has already paid for your item via Kleinanzeigen. To confirm and receive the payment, please click the button below."
Clicking the button opened another page requesting him to link his own bank account and confirm an alleged transaction. The consumer complied – whereupon a total of €2,890 was debited from his account.
Banks refuse reimbursement and point to gross negligence
Those affected who demand their money back from the bank frequently face rejection. Banks and savings banks regularly argue that the victims acted with gross negligence by following links in emails and entering their account details there. The victims themselves state they did not realise they were triggering a payment.
According to the consumer association, first-time users of the platform in particular have scarcely any opportunity to recognise the fake email as such. The attack catches them off guard before they can assess the situation.
Courts increasingly rule in consumers' favour
Several courts have ruled in favour of the victims in comparable cases – particularly when those affected had never previously used the Kleinanzeigen platform and the "Safe Payment" function.
The Berlin Regional Court established in a judgment of 13 December 2023 (ref. 10 O 21/23) that a consumer who entered their payment card data and online banking access data on a manipulated page did commit a breach of duty – but that this should not be classified as gross negligence. The court assessed the behaviour as a "moment of aberration": situationally conditioned misconduct in which the person affected was caught unaware by an attack. The failure to install antivirus software on an Android device should also not necessarily be regarded as gross negligence.
In another case, the Berlin Regional Court II decided similarly on 9 February 2024 (ref. 38 O 118/23). In this case, the claimant entered a release code from their bank received via SMS on the fake website – although the SMS explicitly instructed him to enter the code only in the banking app. Since the claimant had never previously used the "Safe Payment" function and had not yet installed the banking app, the court nevertheless did not classify the breach of duty as gross negligence.
How the genuine "Safe Payment" works on Kleinanzeigen
"Safe Payment" is an integrated payment system on Kleinanzeigen with buyer protection. Payments – via SEPA transfer, credit card, Apple Pay or Google Pay – are initially made to payment service provider OPP (Online Payment Platform). Only when the buyer confirms receipt of the goods or 14 days have elapsed since payment is the amount forwarded to the seller.
Crucially, the protection applies exclusively to transactions handled within the Kleinanzeigen app or website via the official message history and the buttons there. Anyone who follows an external link – such as from an email – operates outside the contractually secured system. In such cases, buyer protection does not apply.
When those affected have good chances of reimbursement
According to current case law, chances of reimbursement are particularly good when those affected can prove that they were using the platform and its payment function for the first time and therefore had no reason to suspect a phishing attack. The judgments to date point to a consumer-friendly trend – banks cannot rely blanket on gross negligence when first-time users are deceived by deceptively authentic imitations.
Source: Google News CH — Crime (de)