Athens Court Orders Bank to Return €100,250 to Phishing Victim
The Single-Member Court of First Instance of Athens ruled in favour of a company that fell victim to electronic fraud, awarding it €100,250 and an additional €4,000 in compensation for non-pecuniary damage.
Bank Convicted over Phishing: €100,250 and Compensation for Non-Pecuniary Damage
The Single-Member Court of First Instance of Athens ordered a bank to fully compensate a company that fell victim to phishing, rejecting the bank's refusal to pay compensation. According to Dikastiko.gr, decision number 9179/2026 awarded the company €100,250 as well as an additional €4,000 as monetary compensation for non-pecuniary damage.
The case concerned a phishing attack in which third parties gained access to the company's e-banking through deceptive communication and a website that mimicked the bank's site. Within approximately twenty minutes, thirteen consecutive transfers totalling €100,300 were executed from the corporate bank account. Throughout this period, no prevention mechanism or alert was activated by the bank.
Burden of Proof and Gross Negligence
The central legal issue in the case was the application of Law 4537/2018 on payment services, in particular the rules governing unauthorised transactions, the burden of proof and the concept of gross negligence. The court held that the mere recording of use of a payment instrument was not in itself sufficient to prove that the transaction was authorised by the account holder or that the latter acted with fraud or gross negligence.
The bank, according to the court, was required to prove specific user conduct that exceeded simple negligence. Although the authorised user of the company disclosed OTP codes to third-party perpetrators, the court did not characterise this act as gross negligence. In justifying its decision, the court emphasised the particularly deceptive nature of the phishing method — a nature known to banks, which are required to take effective measures to protect their customers.
Failure to Detect Suspicious Transactions
The court gave particular weight to the enhanced security obligations that burden financial institutions. It negatively assessed the fact that thirteen consecutive transfers of significant amounts were carried out within twenty minutes without any prevention mechanism or timely alert being activated. The court held that the bank was required to have effective systems in place for detecting suspicious transactions.
The Amount of Compensation
The court ordered the bank to cover the entire pecuniary loss of the company, deducting only the amount of €50 provided for by law for the payer. It thus awarded the company €100,250 with legal interest from 23 January 2023 — the date of the extrajudicial notice — until full payment. Furthermore, recognising that the bank's unlawful conduct harmed the company's professional reputation, standing and prestige, the court awarded €4,000 as monetary compensation for non-pecuniary damage.
Significance for Businesses and Corporate Accounts
The decision establishes that protection against unauthorised electronic transactions extends to corporate accounts. The court did not rest content with finding that the user disclosed the codes and OTPs through slight negligence in order to relieve the bank of liability. Rather, it substantially examined both the user's conduct and the effectiveness of the institution's security mechanisms.
The case was handled by Tellos N. Agapinós, an Athens advocate before the Court of Appeal and partner of the law firm "N. T. Agapinós & Associates".
Source: Dikastiko.gr