HAVE YOU LOST MONEY TO AN ONLINE SCAM? WHEN CAN YOUR BANK BE HELD LIABLE?

A text message seemingly coming from one’s bank. A call from the so-called “fraud department.” An email inviting the recipient to click on a link. A person who knows the client’s name, recent account transactions, and appears to be fully aware of the credit institution’s procedures. In just a few minutes, the money can be transferred elsewhere, and only afterward does the victim realize they have been deceived. This is no longer a marginal phenomenon. The most recent data from the Banking Financial Arbitrator shows that in 2025, approximately 13,500 complaints were lodged, with disputes related to the fraudulent use of payment instruments—particularly phishing, spoofing, smishing, and vishing—accounting for 37% of the overall litigation handled by the ABF. (Economia per Tutti⁠) The legal issue following the fraud is therefore extremely concrete: who must ultimately bear the economic loss? The answer is not always “the client was at fault,” nor is it automatically “the bank must refund the money.” It is essential to carefully examine the methods employed to carry out the operation, the authentication system used, the communications exchanged, any timely reporting of the fraud, and the conduct of both the client and the intermediary. The legal distinction between authorized and unauthorized transactions can become decisive. Even when the client has been induced by deception to perform certain transactions, the legal qualification of the case cannot be automatically determined: it is necessary to reconstruct the dynamics of the event and assess the obligations imposed on the parties. This is why, after a bank fraud, promptly preserving SMS messages, emails, phone numbers, application screenshots, bank statements, transfer receipts, and any communication with the bank can be fundamentally important. The Data Protection Authority, when discussing smishing, specifically highlights the mechanism through which fraudsters lead the victim to click links or provide personal information by leveraging urgency and the threat of account or card blockage. (Garante Privacy⁠) Therefore, the first mistake is to assume that an online fraud is solely a criminal matter. There can certainly be a crime committed by the organizer of the fraud, but simultaneously, civil, banking, and compensation issues may arise. Urgent interventions may also be needed to attempt to prevent further transactions, recover information related to the operation, and preserve documentation useful for subsequent protection. In practice, timeliness can be crucial. The issue becomes even more complicated when the fraud has technologically sophisticated characteristics: phone spoofing, caller identity falsification, messages seemingly coming from the credit institution, unauthorized access, manipulation of the victim through social engineering techniques. In these cases, the legal assessment cannot stop at the simple question: “Did the client provide the code?” It is necessary to reconstruct how that code was obtained, which operation was actually authorized, what security systems were active, and what controls were conducted by the intermediary. This phenomenon is set to become even more significant considering the evolution of artificial intelligence. The Data Protection Authority recently drew attention to deepfakes and the risks arising from the manipulation of real images and voices, highlighting the possible consequences on data protection and the fundamental rights of individuals. (Garante Privacy⁠) So what should someone do if they discover they have been a victim of bank fraud? First, they should act immediately towards the bank or intermediary, documenting the incident and requesting the necessary measures to be taken. It is also advisable to chronologically reconstruct every step: the first contact received, phone calls, messages, any logins, ordered transactions, the moment of discovering the fraud, and the report made. Digital documentation must be kept in full. Subsequently, it is necessary to evaluate, on a case-by-case basis, which protective measures are actually usable, including extrajudicial remedies and, when the conditions are met, recourse to the Banking Financial Arbitrator or judicial action. The ABF is, in fact, one of the channels through which the client can present a banking dispute to a specialized organization. The most recent official data shows how this channel is now frequently used specifically in disputes related to fraud involving payment instruments. (Economia per Tutti⁠) The most important rule, however, is one: do not automatically resign yourself to the loss of money. Each case must be examined in its specific legal dynamics. A digital fraud can simultaneously involve criminal law, civil law, banking law, contractual liability, personal data protection, and payment instrument regulation. It is precisely this interdisciplinarity that necessitates a timely and documented legal assessment. When money has been taken through cyber fraud, the correct question is not only “how was the client defrauded?” but also: what obligations did the parties have, which operation was actually authorized, what security systems were in place, and what legal tools are still available to recover the amounts? These are the questions from which the professional analysis of each individual case should begin.