EFRI practical guide for victims · Austria · OGH 7 Ob 95/24g (28 August 2024), 3 Ob 123/24w (11 September 2024), 10 Ob 56/25w (13 January 2026), 3 Ob 40/26t (29 April 2026) and OLG Linz 1 R 45/25f (22 May 2025) · Revised 19 October 2026

When an investment or bank-impersonation scam has emptied an account, the bank’s first answer is usually the same: you authorised the transfers. In Austrian law that answer settles one question but not the other. It excludes the statutory refund regime for unauthorised payments. It does not decide whether the bank breached a contractual duty to warn, to query or to monitor, and whether that breach caused the loss.

This guide sets out what the Austrian Supreme Court (OGH) and the Higher Regional Court of Linz (OLG Linz) have actually decided, where the realistic openings for victims lie, where claims typically fail, and how a victim can obtain the bank-internal evidence that such a claim needs.

Key points for victims

• Authorisation is not the end of the analysis. It excludes a refund under §§ 67, 68 ZaDiG 2018, but a damages claim for breach of the bank’s contractual protective duties remains possible.
• There is no general duty to warn. Whether a bank must warn or intervene depends on the individual case.
• The four OGH decisions are rejection orders. In each, the OGH refused to hear the appeal because the lower courts’ assessment was tenable. None of them lays down a general rule, for or against victims. Cases are won or lost on the facts at first instance.
• OLG Linz 1 R 45/25f is the strongest appellate authority for victims. Inadequate fraud transaction monitoring (FTM) breached the bank’s contractual protective duties, and the loss was split 50:50. We already discussed this judgement.
• Causation is the main obstacle. The victim must show that a proper warning or intervention would probably have stopped the payment (OGH 3 Ob 40/26t). Gather this evidence from the start.
• The evidence is held by the bank. Start with a data subject access request under Article 15 GDPR. In proceedings, use §§ 184 and 303 ff ZPO and the bank’s civil-law duty to account.
• Watch the limitation period. Damages claims become time-barred three years after the victim knows of the damage and the liable party (§ 1489 ABGB).

1. Scope and terminology

Authorised push payment (APP) fraud describes a scam in which the payer is deceived into authorising a push payment, for example a credit transfer. The mechanism is social engineering of the payer, not execution without the payer’s consent. Investment scams and bank-impersonation scams both use it.

A multi-stage crypto-investment scam needs a precise transaction map. The fiat on-ramp (the bank transfer that funds an account at a crypto exchange or buys crypto-assets) must be separated from the downstream crypto-asset transfer through which the assets reach the fraudster. The bank that executes the on-ramp often sees only a payment to a legitimate exchange account held in the victim’s own name. As OGH 10 Ob 56/25w shows, this can decide the case.

Every claim must answer three separate questions:

1. Duty and breach: When did the bank have to warn, query or stop a payment, and did it fail to do so?
2. Evidence: How can the victim prove what the bank’s systems flagged and what its staff did?
3. Causation: Would a timely and adequate intervention have prevented this particular loss?

Authorisation under ZaDiG 2018

Under § 58 ZaDiG 2018 a payment transaction is authorised if the payer consented to it in the agreed form and procedure. Austrian courts do not treat fraudulent inducement as removing that consent. In OLG Linz 1 R 45/25f (section II.5.2) the customer had been told he was “cancelling” fraudulent transfers. He nevertheless knew that each confirmation moved money from his account to unknown accounts, so the court held that he had authorised the payments. His error concerned only their purpose. Merely because a payment was induced by fraud, it is not unauthorised (see also OGH 7 Ob 95/24g, paragraph 10).

Consequently, the no-fault refund regime for unauthorised payments (§§ 67, 68 ZaDiG 2018) does not apply. This guide deals with the remaining route: damages for breach of contractual protective and care duties owed by the bank under the payment-account contract.

2. The starting point: no general warning duty, but a duty to query

Under Austrian law the payment-account contract (Girovertrag) is a contract to manage another’s affairs (Geschäftsbesorgungsvertrag). The rules on mandate apply. The bank must execute the customer’s payment orders. The duty to protect the customer’s interests, however, includes a duty of care and a duty to query unclear orders (OGH 3 Ob 123/24w, paragraph 4, with reference to RS0019656 [T4]).

Whether, and how far, a bank owes advisory and information duties is in principle a question of the individual case (RS0106373 [T4]; RS0111165).

This procedural posture is the key to reading the case law. All four OGH decisions below are orders rejecting an appeal for lack of a substantial question of law (§ 502(1) ZPO). The OGH confirmed that the lower courts’ assessments were tenable. It did not hold that the banks acted correctly in every respect, and it did not state general rules on warning duties. In 7 Ob 95/24g (paragraph 12) the OGH added that the scope of information duties does not become a substantial question merely because it arises in many cases or affects many victims (RS0042816; RS0106373 [T12]).

For victims this means that the decisive battle takes place in the first-instance proceedings. What matters is which facts are pleaded, proven and recorded in the court’s findings.

3. The decisions

3.1 OGH 7 Ob 95/24g (28 August 2024): monitoring stopped the first payment, but not the next four

Facts. The claimant clicked a link in a text message disguised as a parcel-delivery notice and entered personal data and his online-banking user number. On the same day he withdrew €7,500 in cash. That evening a fraudster called him and asked him to open his banking app. By entering his PIN, the claimant confirmed both his own log-in and the fraudster’s parallel log-in to the web version. The fraudster then prepared a €20,000 foreign transfer, which the claimant authorised. The bank’s fraud transaction monitoring stopped it, because the amount and the recipient account deviated from his usual behaviour. The fraudster then sent four further pre-filled transfers to the same account: two of €9,000, one of €3,950 and one of €5,700, totalling €27,650. The claimant authorised each of them with both app steps. Monitoring did not stop them, and the money could not be recovered. He had previously received a phishing warning from the bank (paragraphs 1–2). The decision does not record whether the bank contacted him after stopping the €20,000 transfer.

Procedural posture. The OLG Linz (11 R 7/24i) had allowed an ordinary appeal because the OGH had not yet ruled on whether a bank must stop and re-confirm further payments after blocking a first suspicious one. The OGH rejected the appeal as inadmissible (paragraph 8).

Holdings.

• The payments were authorised, so §§ 67, 68 ZaDiG 2018 did not apply (paragraph 10).
• The lower courts denied a breach of protective duties in view of the existing monitoring and the prior warnings. The OGH found this assessment not to require correction (paragraph 13).
• Findings on what was “customary” in banking, or on which payments the bank’s previous system would have stopped, would not have changed that assessment (paragraph 14).
• The appellate court’s alternative reasoning could stand on its own: even assuming a breach by the bank, the claimant’s conduct was so careless that any fault of the bank receded entirely (paragraph 15, RS0027202 [T12]).
• A fraudulent payment can also be an authorised payment. This is precisely why the bank monitors payments that have already been authorised. The OGH saw no reason to refer the relationship between “unauthorised” and “fraudulent” payment transactions in Article 2 of Delegated Regulation (EU) 2018/389 to the CJEU (paragraph 16).

What it means for victims. The decision is a warning against relying on the pattern “first payment stopped, follow-ups to the same account not stopped”. On these facts that was not enough. At the same time, paragraph 16 confirms that monitoring of authorised payments is legally relevant. The dismissal rested on the specific facts, the prior warnings and above all the claimant’s own conduct.

3.2 OGH 3 Ob 123/24w (11 September 2024): an alert triggers a duty to inform, but not a duty to override the customer

Facts. The claimant and his wife held a joint account on which each could act alone. The claimant ordered a series of transfers to accounts of crypto exchanges. The bank’s internal warning system flagged a suspicion of fraud, which later proved justified. The bank blocked the claimant’s online access when the first transfer was stopped and warned him twice at the beginning of the payment sequence. He reaffirmed his orders, and his access was reactivated. The claim was for €2,275,870.03 (OLG Wien 3 R 158/23m; OGH rejection order, paragraphs 1–7).

Holdings.

• Duty to inform: given the suspicion of a criminal offence flagged by its own warning system, the bank was obliged to inform the customer. This is the most victim-relevant sentence in the decision (paragraph 5).
• No duty to override: absent special circumstances, such as doubts about the customer’s legal capacity, the bank had to execute orders that the customer reaffirmed after being told of the fraud suspicion. It was neither obliged nor entitled to alert the co-account holder in order to stop him indirectly (paragraph 5).
• Reactivating the online access without the co-holder’s consent was permissible, because it concerned only the means of access, not a disposition over the account (paragraph 6).
• The argument that more than two warnings were required failed procedurally. The appeal did not engage with the appellate court’s reasoning that the underlying facts had not materially changed, that the recipient accounts belonged to large, reputable crypto exchanges, and that the money was later lost through the fraud of third parties (paragraph 7).

What it means for victims. When the bank’s own system flags a suspected fraud, the customer must be informed. Once the customer has been informed and nevertheless insists, the bank may execute. The content of the warning is therefore decisive. A victim should establish exactly what the bank said: did it name a suspected fraud, or did it merely ask whether the customer really wanted to make the payment?

3.3 OGH 10 Ob 56/25w (13 January 2026): a verification call is not a scam warning, but it may be enough

This is a non-APP comparator: it concerns authorised credit-card payments, not credit transfers. It is included because it shows how courts deal with a multi-stage crypto scheme.

Facts. From 27 January 2024 the claimant made several credit-card payments totalling €262,950 to two foreign recipients, a crypto platform and an exchange, where he had registered and opened his own accounts. All payments used strong customer authentication (SCA). An amount threshold triggered the issuer’s transaction monitoring. On 28 January 2024, before the first transaction was booked on 29 January, the issuer called him to verify that he had deliberately ordered the payment. He replied that he was investing in crypto-assets. On 5 February 2024 the issuer called again, and he again confirmed. He did not mention that third parties were guiding him by telephone. The issuer’s website warned about fraud schemes and advised hanging up on suspicious callers. The fraudsters had him convert the funds into Tether tokens and transfer them to a wallet disguised as a trading platform (paragraphs 1–5).

Holdings. The lower courts held that the loss arose only when the Tether tokens were transferred to the fraudsters’ wallet. Until then, the claimant had retained full control of his assets. The issuer had no concrete indication of those later transfers (paragraph 7). The OGH found no correctable error, in view of the transaction monitoring, the website warning, the two calls and the information the claimant gave or withheld (paragraph 10). Findings on the amount of loss and on causation were therefore unnecessary (paragraph 11).

What it means for victims. A call to verify payment intent, SCA and a personalised scam warning are three different controls. In this case the courts nevertheless considered the issuer’s overall conduct sufficient. Two practical lessons follow. First, what the victim tells the bank during such calls will be used in any later proceedings. Second, the further the bank is from the actual point of loss, the harder the claim. A payment to the victim’s own exchange account is a weaker starting point than a payment to the fraudster.

3.4 OGH 3 Ob 40/26t (29 April 2026): causation decides

Facts. The original claimant, who died during the appeal proceedings and whose son continued the case as her sole heir, had lost funds in a supposed crypto investment arranged by unknown fraudsters. She claimed €434,303.03 from her bank. The bank had contacted her only once, on the occasion of one of her first transfers to a crypto exchange (OLG Wien 4 R 91/25v; OGH rejection order, paragraphs 1–5).

Holdings. The OGH expressly left open whether the bank had met its contractual protective duties by contacting her only once. The claim failed for another reason. The trial court had made a negative finding: it could not establish that she would have refrained from the relevant transaction had the bank’s fraud-warning system issued another security alert and her adviser asked again (paragraph 5). The claimant bears the burden of pleading and proving causation (RS0022686). The reduced standard of proof for the causation of an omission is only an evidential relief. It does not shift the burden (RS0022900 [T44]; 9 Ob 17/24a). The trial court had correctly applied the reduced standard (paragraph 6).

What it means for victims. Proving that the bank should have warned again is not enough. The victim must also make it probable that a further, adequate warning would have stopped this payment. Section 4 below explains how to prepare that evidence.

3.5 OLG Linz 1 R 45/25f (22 May 2025): inadequate monitoring is a breach, even where the customer authorised the payments

Facts. On 30 December 2022 the claimant acknowledged a mandatory in-app warning. It stated that fraudsters were calling customers in the bank’s name, claiming they needed to recover fraudulent payments, and persuading customers to confirm a log-in and further actions. On 4 January 2023 he clicked a link in a phishing e-mail and entered his online-banking user number. That evening a fraudster posing as the bank’s technical support called him. During a call of about 90 minutes, the claimant confirmed the fraudster’s log-in in the authentication app. He then authorised 35 real-time transfers from the account of an association that he managed, totalling about €185,000, in roughly one hour. Next he moved €18,000 from his savings account to his current account and authorised six real-time transfers from that account between 18:02 and 18:13: €8,500, €1,500, €3,500, €3,500, €500 and €500. Each authorisation screen stated: “Only authorise transfers that you have created yourself and actually want to make.” The last two payments of €500 were reversed because the recipient account was flagged in the bank’s system. The claim concerned €17,000 lost from the private account.

Holdings.

• Authorised: the claimant knew that each confirmation moved money to unknown accounts. His error about the purpose did not remove his consent, so §§ 67, 68 ZaDiG 2018 did not apply (section II.5.2).
• Breach of contractual protective duties: Article 2(1) of Delegated Regulation (EU) 2018/389 requires transaction-monitoring mechanisms that enable the detection of unauthorised or fraudulent payment transactions. The factors listed in Article 2(2) are minimum requirements (“at least”). Where transactions follow each other closely, the comparison with the customer’s previous payment behaviour must consider their cumulative value and their number. It must do so across all accounts operated by the same person, because Article 2(2) refers to the payment behaviour of a person, not to the turnover of a single account. Otherwise any monitoring could be circumvented by splitting large sums into many small payments (section II.7.2).
• Application: 41 transfers totalling about €200,000 within about 1.5 hours deviated massively from the claimant’s previous behaviour. The system should have raised an alert and stopped the payments. By failing to provide an adequate control system, the bank breached its protective duties (section II.7.3).
• The fact that the fraud hotline could not be reached was not causal: real-time transfers could not have been recalled anyway (section II.7.3).
• Gross negligence of the claimant: he had acknowledged the specific warning only days earlier, entered his user number via a phishing e-mail with visible irregularities, authorised transfers created by a stranger despite seeing the recipient and amount each time, and moved his savings to make further transfers possible (section II.8.2).
• Apportionment 1:1 (section II.10). The court awarded €8,500 plus 4% interest from 3 February 2023, half of the €17,000 claimed. This was not half of the approximately €200,000 overall loss, most of which was the association’s.

Limits of the decision. Banks will point out three things. First, in section II.5.3 the court itself described the purpose of monitoring as detecting confirmations “not stemming from the authorised payer”, which is in tension with the broader reading in section II.7.2. Second, the trial court could not establish what other banks’ monitoring systems check as a matter of state of the art. The OLG derived the standard directly from Article 2 of the Delegated Regulation as a question of law. Third, the case concerned bank impersonation, not crypto investment fraud.

Generic warnings do not replace monitoring. The acknowledged in-app warning weighed heavily against the claimant when the court assessed his negligence. It did not, however, release the bank from its duty to run adequate monitoring. Both findings stand side by side.

3.6 Reading the decisions together

OGH 7 Ob 95/24g and OLG Linz 1 R 45/25f are not simply contradictory. The OLG Linz cited the OGH decision itself. In 7 Ob 95/24g the system did react and stopped the first payment, and the following pattern was smaller (four payments, €27,650). In Linz the system did not react at all to 41 payments of about €200,000 across two accounts. The comparison must focus on what the monitoring did and failed to do, and on each party’s conduct, not on the mere fact of authorisation.

None of the decisions reviewed addresses squarely the typical crypto-investment scenario: a customer sends a series of transfers to a legitimate exchange, receives no individual warning or query, and later loses the assets downstream. No Austrian appellate decision on that exact combination was identified for this guide. This is a qualified research finding, not proof that no such decision exists. An exact precedent is also not a precondition for liability, but each claim must establish duty, breach and causation on its own facts.

4. Causation: prepare it from day one

OGH 3 Ob 40/26t makes causation the central obstacle. In Austrian law the injured party must prove that the omission caused the loss. The courts apply a reduced standard: it suffices that there are predominant reasons to assume that the bank’s conduct caused the damage (RS0022900). But if the court cannot make a positive finding, the claim fails.

Victims should therefore collect, from the very beginning, evidence of how the victim would probably have reacted to a proper intervention:

• Did the victim ever hesitate, stop or reduce payments when a bank, a family member, an exchange or the police raised doubts?
• What exactly did any actual bank contact say? A specific fraud warning (“we suspect you are being defrauded by a fake investment platform”) is a different counterfactual from a verification question (“did you order this payment?”).
• How quickly did the victim stop once the fraud became clear, and what triggered that?
• What did the fraudsters tell the victim to say to the bank? Coaching scripts show both the manipulation and why a well-designed intervention could have broken it.
• Would the monitoring system itself have held the payment (as the OLG Linz assumed), rather than merely producing a warning that depended on the customer’s reaction? Note, however, that after a hold and a warning, a customer who reaffirms the order may still have it executed (OGH 3 Ob 123/24w).

Contributory negligence must be addressed in the same evidence file. Acknowledged warnings, disclosure of credentials and confirming transfers prepared by strangers can reduce a claim by half (OLG Linz 1 R 45/25f) or defeat it entirely (OGH 7 Ob 95/24g, paragraph 15).

5. Proving an alert-handling failure or an FTM deficiency

5.1 The evidence sits with the bank

A victim can produce account statements, messages, call logs and screenshots. The bank holds the monitoring output, internal case notes and records of manual review, escalation and payment release, insofar as such records were created and still exist. Together they form the fraud-management audit trail.

This creates an information gap: the victim needs bank-internal records to substantiate the claim, while procedural routes to those records require sufficiently concrete allegations. Two types of failure should be distinguished from the outset:

Alleged failure	What to investigate
Alert-handling failure: an alert was generated but not properly assessed or acted upon.	Alert timestamp and trigger, risk classification, triage, review history, escalation, customer contact (what was said), hold and release decision.
Detection failure: the monitoring failed to detect a pattern that it should have detected.	Payment sequence, the customer’s historical baseline, cumulative value and number of transactions (across all accounts operated by the customer), relevant monitoring functions, and why the pattern passed without intervention.

These are lines of investigation, not assumptions that either failure occurred. Reconstruct the timeline payment by payment and separate alerts raised before execution from monitoring hits raised after execution. A later alert cannot show a missed opportunity to stop a payment already made, although it may matter for subsequent payments.

5.2 Step one: a data subject access request (DSAR) under Article 15 GDPR

Before bringing a claim, the victim can submit a data subject access request (DSAR) under Article 15 GDPR. The victim need not give reasons, and the first copy must be provided free of charge even if the request serves to prepare litigation: the purposes listed in recital 63 GDPR are not a condition (CJEU, 26 October 2023, C-307/22, FT v DW, paragraphs 38, 43 and 52; see also EDPB Guidelines 01/2022, paragraph 13).

A targeted request should name the period and the payments concerned and ask for the personal data contained in:

• transaction, authentication and payment-confirmation records;
• customer-specific fraud alerts, risk scores, alert triggers and the recorded reasons for flagging payments;
• alert-triage and manual-review notes, escalation records, payment holds and release decisions;
• warnings, correspondence, telephone notes and existing call recordings, including the customer’s recorded answers;
• customer profiles and assessments of expected account activity.

Assessments and inferred data are covered. The right of access extends to opinions and assessments relating to the data subject, and to data derived or inferred from other data. The EDPB expressly mentions data used to assign a credit score or to comply with anti-money-laundering rules (EDPB Guidelines 01/2022 on the right of access, version 2.1, paragraphs 96, 97 and 99).

Copies of documents where needed for intelligibility. A “copy” is a faithful and intelligible reproduction of the personal data. Where context is essential to make the data intelligible and to exercise GDPR rights effectively, this can include extracts from documents, entire documents or extracts from databases (CJEU, 4 May 2023, C-487/21, paragraphs 41 and 45). Article 15 is not a right to inspect the bank’s entire file.

Log of consultations. The customer may obtain the dates and purposes of consultations of their personal data. The identities of the employees involved are, in principle, not disclosable, unless that information is essential for the effective exercise of the customer’s rights, taking the employees’ rights and freedoms into account. The fact that a bank carries on a regulated activity does not, in principle, affect the scope of the right of access (CJEU, 22 June 2023, C-579/21, Pankki S, paragraphs 62, 72–80 and 83).

Limits. An existing customer-specific alert or review note can contain accessible personal data. General monitoring rules, thresholds, model architecture and source code do not become accessible merely because they might prove a monitoring defect. A missing alert in the DSAR response is not, on its own, proof of an inadequate system.

AML restrictions are not a blanket exemption. Under § 20(1) FM-GwG, banks must keep confidential all processes serving the reporting of suspicious transactions (§ 16) and the non-execution of transactions (§ 17). Under § 21(6) FM-GwG, refusing access may be justified as a restriction under Article 23(1) GDPR, but only where necessary to keep such processes confidential in order to protect the proper performance of AML tasks or investigations. The restriction therefore does not apply automatically to every fraud-monitoring record. A refusal must be justified for the specific record.

Deadlines and remedies. The bank must respond within one month. It may extend that period by up to two further months where necessary because of the complexity and number of requests, but it must inform the customer of the extension and the reasons within the first month (Article 12(3) GDPR). An inadequate response can be challenged by a complaint to the Austrian Data Protection Authority (Article 77 GDPR), enclosing the request and any reply.

A DSAR does not establish liability. It can, however, reveal concrete facts that connect the customer’s payment history with the bank’s internal handling, and so support a more precise claim.

5.3 Step two: in proceedings, questions under § 184 ZPO

Under § 184 of the Austrian Code of Civil Procedure (ZPO), each party may put questions to the other about all facts relevant to the proceedings, including the existence and nature of documents. This is a tool within proceedings, not a pre-action discovery procedure.

In OGH 4 Ob 78/22g (18 October 2022, paragraphs 10, 14 and 20) the OGH rejected a restrictive reading. The party not bearing the burden of proof has a procedural duty to cooperate in establishing the truth. That duty is not limited to facts within its exclusive sphere. It applies at least where the other party faces evidential difficulties or information deficits that cannot easily be overcome. A complete and detailed pleading cannot be demanded before the opponent has provided the information. It suffices to plead the (possibly only reasonably suspected) facts coherently enough to support the questions.

Applied to identified payments, questions can address whether an alert was created, whether the payment was held for review, which records document that review, and whether and by whom the payment was manually released.

The bank must investigate internally. A party questioned under § 184 ZPO that lacks immediate knowledge can usually be expected to ask the employees concerned or consult records. A breach of this duty can lead the court to treat the other party’s allegations as true when assessing the evidence (§ 272 ZPO). It does not, however, shift the burden of proof: if the court still makes a negative finding, it operates against the party bearing the burden (OGH 6 Ob 120/23z, 18 June 2024, paragraphs 23–24).

The same decision (paragraph 22) restates when proximity to the evidence can, exceptionally, shift the burden of proof. This requires facts that lead “deep into the sphere” of one party, the other party having made reasonable efforts to prove its case and facing disproportionate difficulties, and disclosure being easily possible and reasonable for the party with knowledge. How a bank’s monitoring flagged and handled a specific payment is a natural candidate for that argument. Whether it succeeds depends on the individual case.

5.4 Step three: production of identified documents (§§ 303 ff ZPO)

Once relevant records have been identified, the claimant can apply for an order that the bank produce them. In OGH 8 ObA 9/15d (28 April 2015, section 2.1) the OGH stressed that production under § 303 ZPO relates to a specific document that allegedly exists and whose content is to prove concrete, relevant allegations. It is not a tool for an exploratory search for a possible claim.

Under § 304 ZPO, the opposing party cannot refuse production where it has itself relied on the document as evidence, where it is obliged under civil law to hand over or produce it, or where the document is by its content common to both parties. Documents created in the interest of both parties or recording their mutual legal relations count as common. An internal record is not automatically “common” because it mentions the customer, but labelling it “internal” does not answer the question either.

An unjustified refusal to comply with a production order is assessed freely by the court when deciding whether the claimant’s description of the document’s content is proven (§ 307(2) ZPO; OGH 8 ObA 9/15d, section 2.1). It does not automatically establish liability.

5.5 A further route: the bank’s civil-law duty to account

Because the payment-account contract is a mandate-type contract (OGH 3 Ob 123/24w, paragraph 4), the bank as agent may owe a substantive duty to account and to hand over information gathered in performing the mandate (§§ 1009, 1012 ABGB). In OGH 4 Ob 78/22g (paragraph 16) the OGH derived precisely such a duty to provide information from §§ 1009, 1012 ABGB in the relationship between an auditor and the audited company. Whether this extends to a bank’s fraud-monitoring records about the customer’s own payments has not been decided. If it does, it also supports a production obligation under § 304(1) no. 2 ZPO. Where the content of the bank’s records is unknown, a stepped action combining a claim for information with the damages claim (Article XLII EGZPO) may be considered.

5.6 Fraud alerts are not AML reports

An internal fraud alert is not automatically a suspicious transaction report (STR) to the Financial Intelligence Unit. AML confidentiality covers specified processes relating to reporting under §§ 16 and 17 FM-GwG, not every record in a fraud-management system. Production rules also recognise grounds for refusal, such as protected confidentiality and business secrets, subject to mandatory production obligations. The analysis must distinguish the type of record, the right invoked and the precise legal basis for withholding it.

Note: This article is for general information only and does not constitute legal advice. Victims should seek independent legal advice from a lawyer with experience in banking law.

7. Practical checklist

1. Secure your own evidence immediately: account statements, app screenshots, authorisation screens, e-mails and messages from the bank, call logs, and all communication with the fraudsters.
2. Build a payment-by-payment chronology: date, time, amount, recipient name and account, authorisation method, and every bank contact, hold, limit change or query.
3. Map the transaction chain: separate the fiat payment from your bank from any later crypto transfers, and record who controlled each account or wallet.
4. Write down what the bank said, word for word, and what you replied. Distinguish a verification question from a specific fraud warning.
5. Record your causation evidence: moments of hesitation, doubts raised by others, and how and when you stopped.
6. Send a targeted Article 15 GDPR request for the period and payments concerned (see section 5.2) to your bank as well as to the beneficiary´s bank. No reasons are required.
7. Diarise the deadlines: one month for the DSAR response (plus possible extension notified within the first month), and the three-year limitation period.
8. Report the fraud to the police and request a copy of your statement. Courts compare later testimony with what you told the police, as the OLG Linz did.
9. Have a lawyer assess the claim, the evidence strategy (§§ 184, 303 ff ZPO) and the contributory-negligence risk before filing.

Our Assessment

The Austrian case law is less hostile to victims than its outcomes suggest, and less helpful than victims hope.

It is less hostile because none of the four OGH decisions says that a bank may stay passive when confronted with concrete fraud indicators. On the contrary, 3 Ob 123/24w confirms a duty to inform the customer once the bank’s own system flags a suspected fraud. And 7 Ob 95/24g recognises that authorised payments can be fraudulent and that this is exactly why banks monitor them. The defeats were rejection orders on specific facts: victims who had been contacted or warned, who reaffirmed their orders, who did not disclose that they were being coached, or whose own conduct was judged grossly negligent.

It is less helpful because the OGH has made clear that it will not convert these questions into general rules, not even in view of the large number of victims (7 Ob 95/24g, paragraph 12). And it has placed the burden of proving causation squarely on the victim (3 Ob 40/26t). By contrast, German law presumes that a properly informed customer would have acted on a warning, which shifts the burden to the bank. In Austria, a victim who cannot convince the trial court that a further warning would have worked loses, even if the bank’s warning practice was inadequate. In EFRI’s view, this places on the victim the risk of a counterfactual that the bank’s own omission created. Whether the reduced standard of proof is applied generously enough in fraud cases deserves close scrutiny.

OLG Linz 1 R 45/25f is the decision that matters most. It derives a concrete, testable monitoring standard from Article 2 of Delegated Regulation (EU) 2018/389: cumulative value and number of transactions, assessed across all accounts operated by the same person. It confirms that an acknowledged generic warning does not discharge the bank’s monitoring duty. And it shows that an equal split is achievable even against a customer found grossly negligent. Its standard has not yet been tested before the OGH. A detection failure is also causally more robust than a warning failure: a system that holds a payment does not depend on the customer’s hypothetical reaction in the same way. However, 3 Ob 123/24w shows that a customer who reaffirms after being warned may still have the payment executed.

For crypto-investment fraud, the open question is the fiat on-ramp to a legitimate exchange in the victim’s own name. 10 Ob 56/25w shows how quickly courts locate the loss downstream, outside the bank’s view. The answer will depend less on doctrine than on evidence: what the bank’s systems saw and what its staff did. This is why the evidence chain matters. A targeted DSAR, followed by focused questions under § 184 ZPO and identified production requests, is the realistic route to the facts that decide these cases. EFRI encourages victims to start that process early, and well within the limitation period.

The current legal landscape leaves victims to prove, one case at a time, what the bank knew and what a warning would have changed. Clear statutory monitoring and intervention standards for payment service providers, including for authorised fraud, would replace that lottery with predictable rules.

Sources

OGH 28.8.2024, 7 Ob 95/24g, ECLI:AT:OGH0002:2024:0070OB00095.24G.0828.000

OGH 11.9.2024, 3 Ob 123/24w, ECLI:AT:OGH0002:2024:0030OB00123.24W.0911.000

OGH 13.1.2026, 10 Ob 56/25w, ECLI:AT:OGH0002:2026:0100OB00056.25W.0113.000

OGH 29.4.2026, 3 Ob 40/26t, ECLI:AT:OGH0002:2026:0030OB00040.26T.0429.000

OLG Linz 22.5.2025, 1 R 45/25f (RIS)

OGH 18.10.2022, 4 Ob 78/22g, ECLI:AT:OGH0002:2022:0040OB00078.22G.1018.000

OGH 18.6.2024, 6 Ob 120/23z, ECLI:AT:OGH0002:2024:0060OB00120.23Z.0618.000

OGH 28.4.2015, 8 ObA 9/15d, ECLI:AT:OGH0002:2015:008OBA00009.15D.0428.000

CJEU 4.5.2023, C-487/21, F.F. v Österreichische Datenschutzbehörde; CJEU 22.6.2023, C-579/21, Pankki S; CJEU 26.10.2023, C-307/22, FT v DW

EDPB Guidelines 01/2022 on data subject rights – Right of access, version 2.1 (28 March 2023)

Commission Delegated Regulation (EU) 2018/389, Article 2; ZaDiG 2018, §§ 58, 67, 68; FM-GwG, §§ 16, 17, 20, 21; ZPO, §§ 184, 272, 303, 304, 307; ABGB, §§ 1009, 1012, 1489; GDPR, Articles 12, 15, 23, 77