Who is liable for credit card fraud or a hacked bank account in Germany?
In short
Who is liable for credit card fraud or a hacked bank account in Germany? First the bank: it must refund payments you did not authorise by the end of the next business day. You bear at most EUR 50, and nothing at all if the bank did not require strong customer authentication. If you act with gross negligence or approve the payment yourself, you carry the loss.
What card fraud can cost you in Germany and what extra cover costs.
Example
Typical range
Your share without gross negligence
at most EUR 50
Your share if the bank required no second factor
EUR 0
Private cyber insurance, individual, range in the consumer test
EUR 7 to 212 a year
Typical limit for account misuse in private cyber policies
about EUR 3,000 to 15,000 a year
Liability under the German Civil Code, price range from the consumer test of May 2024.
Limits of private policies are a guide value from our quoting practice;
the worked example uses assumed figures.
Worked example
Card details copied on holiday, EUR 2,300 charged
Fraudsters use the card details for online purchases. The cardholder notices two days later and reports it at once.
Online purchases with the copied card details
EUR 2,300
Of which approved with strong customer authentication
EUR 0
Her share, as no second factor was required
EUR 0
For comparison: card stolen and used in a shop
share at most EUR 50
The bank refunds the full EUR 2,300. Had she read out an approval code to a caller, the bank could argue gross negligence.
The bank pays first, not an insurer
If someone uses your card details or transfers money from your hacked bank account, the payment is not authorised. The bank then has no claim against you and must restore your account as if the debit never happened, without delay and at the latest by the end of the business day after you report it (section 675u BGB).
Your own liability is capped. If the misuse is based on a lost, stolen or otherwise misused card, the bank can ask you for no more than EUR 50. If the bank did not require strong customer authentication, meaning no second factor such as app approval or a code, you pay nothing (section 675v BGB).
Situation
Who pays
Your share
Online payment with your card data, no second factor
bank
EUR 0
Card stolen, thief pays in a shop
bank
at most EUR 50
Charges after you reported the card blocked
bank
EUR 0
Fraudster transfers from your hacked online banking
bank
at most EUR 50, all with gross negligence
PIN written on the card, card stolen
you, if the bank proves gross negligence
the full loss
You approve a transfer yourself after being tricked
nobody by law, cyber cover may help
the full loss
When you pay more than EUR 50
The EUR 50 cap does not apply if you acted fraudulently or breached your duties intentionally or with gross negligence (section 675v(3) BGB). These duties include protecting PINs, passwords and approval codes and reporting loss or misuse without delay (section 675l BGB).
Whether conduct was grossly negligent depends on the case, and the bank must present evidence. The mere fact that card and PIN were used does not on its own prove gross negligence (section 675w BGB). Always ask for a written reason if the bank refuses.
What is different with a hacked bank account
With hacked online banking, it matters who approved the payment. If fraudsters gained access and made the transfer themselves, it is unauthorised and the same rules apply as for card misuse.
If you confirmed an approval in your banking app after a fake message, the payment may count as authorised and the bank need not refund it. Our page on cyber insurance and phishing explains this case and which policies cover it.
Where private cyber insurance helps
For card fraud that the bank refunds, you need no insurance. A private cyber policy matters once the bank alleges gross negligence or you were tricked into paying yourself. Most policies pay only after the bank has refused, and with low limits.
Many also help with the clean-up: blocking accounts, restoring access, legal advice. Whether that is worth the premium depends on how much you pay online and how much money sits in accounts with online access.
When you need no extra cover
If you only pay with app approval, never share PINs or codes, report misuse immediately and check your statements, the law already protects you well. A cyber policy just for card fraud adds little.
Step by step
Block your card or access at once; in Germany call 116 116 around the clock.
Inform the bank in writing of every unauthorised debit and demand a refund.
Report the fraud to the police, online if you like.
Change passwords, check your devices, renew access data.
If refused, ask for written reasons and contact the bank's arbitration body.
Notify any cyber or contents policy if the bank does not pay.
Checklist
Blocking number 116 116 saved in your phone
Push alert for every card payment switched on
PIN and passwords never written down
Statements checked at least monthly
Approvals only in your own app, never on request
Common mistakes
Waiting for the monthly statement before reporting
Accepting a refusal without written reasons
Passing approval codes to supposed bank staff
Assuming the insurer pays before the bank
Questions and answers
Frequently asked
Does the bank always have to pay for credit card fraud?
For unauthorised payments yes, except for at most EUR 50.
Exceptions are fraud and gross negligence, which the bank has to prove.
How long do I have to report a wrong debit?
At most 13 months after the debit.
Report immediately, though, as delay can count against you.
Do the same rules apply to debit cards?
Yes.
The law does not distinguish by card type, only between authorised and unauthorised payments.
Does contents insurance pay for card fraud?
Only with an internet or cyber add-on.
Basic contents cover does not include financial losses online.
Is the bank liable if I transferred money to fraudsters myself?
Usually not, because you authorised the payment.
Only a cyber policy that names this case may help.
