EFRI practical guide for victims · Germany · BGH XI ZR 343/22 (19 September 2023), XI ZR 327/22 (14 May 2024), XI ZR 107/24 (22 July 2025); OLG Frankfurt am Main 23 U 8/23 (30 July 2024); Saarländisches OLG 4 U 85/22 (29 February 2024); OLG Brandenburg 4 U 131/25 (27 May 2026) · Revised 19 October 2026

After an investment scam, the payer’s bank will usually answer that the customer authorised the credit transfers. In authorised push payment (APP) fraud, however, authorisation is part of the fraud mechanism itself: the payer is manipulated into issuing the payment order (very often via Anydesk or any other remote software). Authorisation decides whether the statutory refund rules for unauthorised payments apply. It does not, by itself, decide whether a payment service provider (PSP) breached a contractual duty to warn and whether that breach caused the loss.

The central questions are what the institution knew before each payment, whether that knowledge triggered a duty to warn or intervene, and which losses a timely intervention would have prevented. This guide sets out what the German Federal Court of Justice (BGH) and the higher regional courts (OLG) have decided, where victims have realistic openings, and how they can obtain the evidence.

Key points for victims

• Authorisation is not the end of the analysis. It excludes a refund under § 675u BGB, but a damages claim for breach of a contractual warning duty may remain possible – but is difficult to establish.
• The threshold for a civil-law duty to warn in payment processing is high. A bank is generally not required to investigate the underlying transaction or monitor account activity for the customer’s protection without specific indications. A duty to warn may nevertheless arise where compelling warning signs encountered during normal payment processing make suspected misappropriation objectively apparent without further investigation. A central consideration is whether the bank possesses relevant information about the danger that the customer lacks (BGH XI ZR 343/22, paragraphs 24–25; XI ZR 327/22, paragraph 26).
• Specific knowledge changes the picture. A bank that had for example received a regulator’s order against the recipient had to warn before crediting the payment (BGH XI ZR 327/22).
• Causation favours the victim once a breach is established. The presumption that a properly warned customer would have heeded the warning reverses the burden of proof: the bank must prove that the loss would have occurred anyway (BGH XI ZR 327/22). This is a significant advantage over Austrian law.
• Internal monitoring alerts are not, on their own, proof of a breach. High amounts, foreign recipients and system hits did not suffice in OLG Frankfurt 23 U 8/23.
• The evidence is held by the bank. Start with an Article 15 GDPR request. In proceedings, use the bank’s secondary burden of substantiation, § 142 ZPO and its duty to account.
• Watch the limitation period: generally three years from the end of the year in which the victim learned of the claim and the liable party (§§ 195, 199 BGB) (more on this in an extra posting)

1. Scope and terminology

APP fraud describes a scam in which the payer is deceived into authorising a push payment to a fraudulent beneficiary. The mechanism is social engineering of the payer, not execution without the payer’s consent.

The sending PSP is the payer’s payment service provider; the receiving PSP is the payee’s. Their contracts, knowledge and opportunities to intervene must be analysed separately. A multi-stage crypto-investment scam also requires a distinction between the fiat on-ramp (funding an account at a crypto exchange or buying crypto-assets) and the downstream crypto-asset transfer that delivers the assets to the fraudster.

None of the decisions reviewed establishes a crypto-exchange-specific warning duty for the sending PSP. Applying the general case law to an authorised fiat on-ramp requires its own factual and legal analysis. Two unauthorised-payment decisions are included in a clearly separate comparator section; they are not APP-fraud authorities.

Authorisation is not authentication

A customer who knowingly orders a particular credit transfer has authorised it, even if a fraudulent investment promise induced the decision. Authorisation concerns consent to the payment transaction, not the validity of the underlying investment (§ 675j BGB).

Authentication, including strong customer authentication (SCA), is a different question. The recorded use of a payment instrument does not necessarily prove authorisation, fraud or gross negligence (§ 675w BGB). Where remote-access software, compromised credentials or misleading confirmation screens are part of the scam, the actual payment process must be reconstructed. A payment is not APP fraud merely because a transaction authentication number (TAN) was used.

Where criminals execute a payment without the payer’s consent, the starting point is the refund regime for unauthorised payments (§ 675u BGB), subject to the bank’s counterclaim for grossly negligent breach of security duties (§ 675v(3) BGB) pls see our posting here. The comparators in section 3.5 belong to that regime.

2. The starting point: a restrictive warning duty

In cashless payment transactions, a bank acts for the purpose of fast, technical processing. In principle it need not concern itself with its customers’ interests in the underlying transactions. It need neither examine generally the risks for the parties involved nor monitor account movements without special indications. Exceptionally, good faith (§ 242 BGB) may require the bank not to execute an order without first querying it, namely where massive suspicious circumstances in the ordinary course of processing make a fraud or misappropriation objectively evident (objektive Evidenz) (BGH XI ZR 343/22, paragraphs 22–23).

A warning duty is also characterised by the bank’s superior knowledge (überlegene Sachkunde). Where the customer already knows the circumstances that would trigger a warning, there is nothing to warn about (BGH XI ZR 343/22, paragraph 24).

3. The decisions

3.1 BGH XI ZR 343/22 (19 September 2023): the threshold of objective evidence

Facts. An e-money and payment institution sued its customer for €2,500 after reversed top-up transfers. The customer had used the account to pay an unlicensed online casino, with which the institution had acceptance agreements, and lost the money. He set off a damages claim for breach of a warning duty.

Holdings. The unlawfulness of the gambling did not affect the validity of the customer’s authorisations. A warning duty was denied, because the customer himself took part in the gambling. He knew the circumstances that would have triggered a warning, and the institution had no superior knowledge. A gambler knows that participation exposes him to a loss of assets (paragraphs 22–25). The BGH set aside the appeal judgment and remitted the case.

What it means for victims. The general framework in paragraphs 22–23 applies to all payment cases. Its application in paragraphs 24–25, however, turns on a gambler’s awareness of the risk of loss. That reasoning cannot simply be transferred to a customer who is deceived about a fictitious investment. The deceived investor typically lacks exactly the knowledge the gambler had. The question is whether the bank had knowledge that the customer lacked.

3.2 BGH XI ZR 327/22 (14 May 2024): specific regulatory knowledge and the presumption of heeding a warning

Facts. The claimants transferred €350,000 for an investment. The payment ran from their bank (L) through an intermediary bank (H) to the defendant, which held the account of the recipient, U AG. On 1 March 2012 the Swiss supervisory authority FINMA prohibited U from accepting public deposits, blocked its accounts and appointed investigating agents with sole authority. The defendant received the order by fax on 5 March 2012, with the note “block on outgoing payments only”. It credited the transfer on 6 March 2012. U was later declared bankrupt. L assigned its claims to H, and H assigned its claims against the defendant to the claimants.

Holdings (headnotes a–d):

• Warning duty of the receiving bank: where a danger to the payer is objectively evident, the payee’s PSP may be obliged, before crediting the amount, to warn the preceding bank in the chain. The FINMA order made a loss to investors objectively evident; the note “outgoing payments only” did not change that.
• No protective effect for third parties: interbank contracts in cashless payment transactions do not have protective effect in favour of the payer. Instead, the principles of Drittschadensliquidation (recovery of a third party’s loss through another party’s contractual claim) apply. The claimants relied on assigned claims.
• Presumption of conduct consistent with proper information (Vermutung aufklärungsrichtigen Verhaltens): this presumption also applies to breaches of warning and information duties by a bank in payment transactions. It is a genuine reversal of the burden of proof: the bank must prove that the loss would have occurred even if it had warned.
• Limitation: for an assigned claim based on Drittschadensliquidation, the knowledge relevant for the start of limitation is that of the assignor, not of the third party who suffered the loss.

The presumption is rebuttable. The BGH held that the defendant had to be allowed to prove that H and L would not have passed the warning on, and that its new submissions on causation should have been admitted. It therefore set aside the judgment and remitted the case. It did not award compensation.

What it means for victims. This is the strongest German authority for victims. Specific, documented knowledge, such as a regulator’s order, a recall or fraud reports about the recipient account, can meet the objective-evidence threshold. Once a breach is established, the causation burden shifts to the bank.

3.3 OLG Frankfurt am Main 23 U 8/23 (30 July 2024): internal alerts are not conclusive

Facts. A property management company (a GmbH & Co. KG) authorised payments totalling €1,161,420.78 from the account of its client, a Dutch B.V., to third parties on the basis of fraudulent deceptions. The manager paid the client €696,852.47 under a settlement. Its liability insurer then sued the client’s account-holding bank for €348,426.24, half of the settlement, by way of recourse between joint debtors and by assignment. The Landgericht Frankfurt (2-27 O 251/22, 8 December 2022) dismissed the claim.

The alerts. According to the appeal, the bank’s system was triggered six times, and the parties agreed that it reacts to parameters such as high amounts or foreign accounts. Five of these six alerts were not passed on to the manager. A later submission listed nine alert-generating transactions. The court assumed this in the claimant’s favour without deciding it. “Nine confirmed fraud alerts were ignored” would therefore misstate the decision.

Reasoning (notice under § 522(2) ZPO of intention to dismiss the appeal):

• An alert does not by itself establish a massive suspicion. High amounts and foreign recipients are normal in international trade; a lawful €150,000 transfer to the UK had also triggered an alert.
• The manager had authorised every payment and was closer to the underlying transactions. The claimant had not shown that the bank had superior knowledge, nor explained the customer’s historical payment pattern.
• The monitoring systems required by § 25h KWG to prevent money laundering and terrorist financing protect the institution, not individual customers. There is no statutory or BGH basis for a duty to operate such a system for customer protection or to forward its alerts.
• Causation was left open because no breach was found.

The senate recommended that the appeal be withdrawn.

What it means for victims. The decisive evidence is the alert trigger and audit trail: reason, timestamp, customer baseline, related observations, review, escalation and release decision. A generic rule-based hit is not the same as an institution identifying a specific investment scam. The decision also shows a structural difficulty: in Germany, a duty to monitor for the customer’s benefit has not yet been recognised in the decisions reviewed.

3.4 Saarländisches OLG 4 U 85/22 (29 February 2024): the receiving bank

The Saarländisches OLG rejected a claim against a receiving bank concerning three expedited transfers totalling €843,000. Earlier suspicious activity on the recipient account and subsequent cash withdrawals did not, in the court’s assessment, make fraud against this particular payer objectively evident. The court also considered that the receiving bank had no relevant information advantage over the sending bank, and it took account of the statutory confidentiality rules on suspicious-activity reporting under the Money Laundering Act (§ 47 GwG). The bank’s reporting duty under the GwG did not translate into a duty to warn other banks or the payer (paragraphs 48–54).

What it means for victims. Suspicious activity on a receiving account is not the same as knowledge that a particular incoming payment is an APP-fraud loss. The decision is an assessment of this receiving bank’s position, not a general immunity for receiving PSPs. Compare BGH XI ZR 327/22, where specific regulatory knowledge made the difference.

3.5 Non-APP comparators: specific chances to interrupt the scam

The following decisions concern unauthorised payments. They are included only to compare concrete warning opportunities, authentication issues and the assessment of customer conduct. Their refund-and-counterclaim structure must not be transplanted into an APP-fraud claim.

OLG Brandenburg 4 U 131/25 (27 May 2026): a concrete missed warning. In June 2021 a caller posing as a bank employee led the customer to a phishing copy of the bank’s online banking, where he was to make a “demo transfer”. He gave the fraudster remote access to his laptop via TeamViewer and read out a TAN. Almost €20,500 left his account. During the remote session the customer called the genuine bank hotline. Instead of warning him, the employee promised a callback from the IT department. The bank’s own website already warned against exactly this method, so the employee should have recognised the attempted fraud and warned him. The customer was nevertheless grossly negligent: even a layperson should see that a “demo transfer” serves no purpose other than fraud, and banks do not offer support via remote access. The Landgericht Cottbus had reduced the bank’s counterclaim by one fifth, partly because the bank did not require strong authentication for the online-banking log-in. The OLG increased the reduction to one third, mainly because of the missed warning during the call, and awarded the customer €6,832.79.

BGH XI ZR 107/24 (22 July 2025): customer conduct. A customer clicked a pop-up claiming that her online-banking access would expire, entered personal data, and was then called from a number displaying the bank’s telephone number. On the caller’s instructions she generated several TANs for manually entered recipient accounts and amounts, and disclosed them. The next day, in a pre-arranged follow-up call, she disclosed further TANs. These raised the transfer limit to €55,555, and €35,555 was transferred to an unknown person. The BGH upheld the finding of gross negligence, centred on the second call: repeated entry of payment data and disclosure of TANs supposedly to install software was no momentary lapse. Inexperience with manual TAN generation and the spoofed bank number did not excuse it. A log-in without two-factor authentication did not bar the bank’s counterclaim, because the TAN requirement for transfers was itself strong authentication. The OLG had refused to reduce the bank’s claim for contributory fault (§ 254 BGB), and the BGH did not disturb that.

Taken together, the comparators show that a concrete, missed opportunity to intervene, such as a customer calling the bank mid-scam, can shift part of the loss to the bank even where the customer was grossly negligent. Without such an opportunity, the customer’s conduct may absorb the entire loss.

3.6 Applying the framework to crypto-investment scams

None of these decisions establishes a duty to stop every transfer to a crypto exchange. The analysis must be payment-specific and institution-specific: what information did the sending PSP have when it processed the fiat payment, and why did that information meet the demanding objective-evidence threshold? A fiat transfer to the customer’s own exchange account and a later crypto withdrawal are different decisions, potentially involving different knowledge (BGH XI ZR 343/22, paragraphs 22–24).

The investigation should reconstruct what the customer told the bank, the reasons for any hold or manual review, and whether the bank had concrete information about a risk affecting the recipient. A general warning that crypto-assets are volatile is not the same as a personalised warning that the customer may be following a fraudster’s instructions. Whether that more specific intervention was legally required, and whether it would have prevented the loss, must be established in each case.

4. Proving what the PSP knew and how it handled the payments

4.1 Build a payment-by-payment chronology and audit trail

For each payment, record date, amount, named beneficiary, beneficiary account and authorisation method, alongside every bank call, message, delay, payment hold, limit change, manual review or release. Separate the receiving PSP from the crypto platform and, where the evidence allows, identify who controlled the exchange account and the downstream destination.

Preserve the exact wording of questions and warnings. Transaction verification, SCA and a personalised scam warning are not interchangeable. A question whether the customer ordered a transfer does not necessarily tell the customer that the bank suspects an investment scam.

Separate established facts from investigative leads. A blocked transfer justifies enquiries but does not itself prove that the bank identified APP fraud. A post-execution alert cannot show a missed opportunity to stop that same payment, although it may matter for later payments.

Alleged failure	What to investigate
Alert-handling failure: an existing alert was not properly assessed or acted upon.	Alert trigger and timestamp, customer-specific risk assessment, triage, manual review, escalation, customer contact (what was said), payment-release decision.
Detection failure: fraud transaction monitoring (FTM) failed to detect an allegedly recognisable pattern.	Historical customer baseline, cumulative value and number of transactions, relevant monitoring functions, and a specifically identified legal duty requiring detection.

The second row is an investigative hypothesis, not a finding that German law imposes the monitoring standard of the Austrian OLG Linz (1 R 45/25f). The German authorities maintain a restrictive threshold, and OLG Frankfurt 23 U 8/23 treated AML monitoring under § 25h KWG as protecting the institution, not the customer. An allegation of inadequate monitoring needs its own legal foundation, for example Article 2 of Delegated Regulation (EU) 2018/389, which requires transaction monitoring to detect unauthorised or fraudulent payment transactions. Whether German courts will treat that provision as protecting customers in APP cases is not addressed in the decisions reviewed.

4.2 Customer-specific evidence: an Article 15 GDPR request

A targeted data subject access request (DSAR) under Article 15 GDPR can seek the personal data contained in transaction and authentication records, customer-specific fraud alerts and risk assessments, internal case notes, correspondence, call notes or existing recordings, and records of payment holds, manual reviews, escalations and releases, insofar as the bank processes them.

• No reasons required, first copy free. The bank must provide the first copy free of charge even if the request serves purposes other than those in recital 63 GDPR, such as preparing litigation (CJEU, 26 October 2023, C-307/22, FT v DW, paragraphs 38, 43 and 52).
• Assessments and inferred data are covered, including data used to assign a credit score or to comply with anti-money-laundering rules (EDPB Guidelines 01/2022 on the right of access, version 2.1, paragraphs 96, 97 and 99).
• Copies of documents where needed for intelligibility: extracts from documents, entire documents or database extracts where context is essential to make the data intelligible and to exercise GDPR rights effectively. This is not a right to the entire bank file (CJEU, 4 May 2023, C-487/21, paragraphs 41 and 45).
• Log of consultations: the dates and purposes of consultations of the customer’s data are accessible. Employee identities are disclosable only exceptionally, where essential for the effective exercise of the customer’s rights, taking the employees’ rights into account. A bank’s regulated status does not, in principle, affect the scope of access (CJEU, 22 June 2023, C-579/21, Pankki S, paragraphs 62, 72–80 and 83).

Limits. An existing alert may contain accessible customer-specific data. General detection rules, model architecture, thresholds and source code do not become accessible merely because they might prove a monitoring defect.

Who can ask. The right belongs to the natural person whose data are processed. A corporate account holder, such as the company in the Frankfurt case, cannot use Article 15 GDPR as a general right of access to corporate records; personal data of an individual representative are a separate matter (GDPR, recital 14 and Article 4(1)).

Deadlines and remedies. The bank must respond within one month. It may extend this by up to two further months where necessary, but must inform the customer of the extension and the reasons within the first month (Article 12(3) GDPR). An inadequate response can be challenged before the competent data protection authority (Article 77 GDPR).

4.3 Fraud alerts are not AML reports

An operational fraud alert is not automatically a suspicious activity report to the Financial Intelligence Unit. Under § 47(1) GwG, an obliged entity may not inform the contracting party, the person ordering the transaction or other third parties of an intended or filed report under § 43(1) GwG, of investigations initiated on the basis of such a report, or of an FIU information request under § 30(3) GwG. These are specific prohibitions with statutory exceptions (§ 47(2) GwG). They require a record-by-record analysis and do not make every customer-specific fraud-management record confidential.

4.4 In proceedings: secondary burden of substantiation and § 142 ZPO

Secondary burden of substantiation. In German civil procedure, where the claimant has no insight into events within the defendant’s sphere and the defendant can easily provide the information, the defendant bears a secondary burden of substantiation (sekundäre Darlegungslast). If the bank merely denies the claimant’s allegations about its internal handling without explaining what its systems recorded and what its staff did, the allegations may be deemed admitted (§ 138(3) ZPO). The Austrian Supreme Court has expressly noted this difference from Austrian law (OGH 6 Ob 120/23z, paragraph 29). The burden of proof itself remains with the claimant.

Document production under § 142 ZPO. The court may order a party or a third party to produce documents and other records in its possession to which a party has referred. A third party need not comply where this is unreasonable or where it has a right to refuse testimony (§ 142(2) ZPO). This is a court-controlled power, not a pre-action discovery right. Connect each factual allegation to an identifiable record, for example a dated call note, a message about a held payment, an alert identifier, or a review entry identified in the DSAR response, and explain which disputed fact it would prove.

Duty to account. The payment-services framework contract is a contract for the management of another’s affairs (§ 675 BGB). Whether the bank’s duty to provide information and render account (§ 666 BGB) extends to fraud-monitoring records about the customer’s own payments has not been decided. If the content of such records is unknown, a stepped action combining information and damages (§ 254 ZPO) may be considered.

4.5 Connect the missed intervention to the loss

The evidence file must address the counterfactual payment sequence: when did the warning duty arise, which later fiat transfers or crypto withdrawals would have been prevented, what did the customer understand, and how did the customer react to any warning actually received?

The presumption recognised in BGH XI ZR 327/22 materially helps once a breach is established. It does not establish the duty, the breach, standing or the amount of loss merely because an alert existed. Evidence of the customer’s actual responses, the onward payment chain and subsequent conduct remains important, because the bank will try to rebut the presumption. A customer who ignored earlier warnings, or who was coached by the fraudsters to reassure the bank, gives the bank material for that rebuttal.

Contributory negligence (§ 254 BGB) must be addressed in the same file. The comparators show both outcomes: a one-third shift to the bank where it missed a concrete warning opportunity (OLG Brandenburg 4 U 131/25), and no reduction at all where the customer repeatedly disclosed TANs (BGH XI ZR 107/24).

6. Practical checklist

1. Secure your evidence immediately: statements, app and confirmation screens, bank e-mails and messages, call logs, and all communication with the fraudsters.
2. Build a payment-by-payment chronology including every bank contact, hold, limit change or query.
3. Map the chain: sending PSP, receiving PSP, exchange account and downstream wallet, and who controlled each.
4. Record what the bank said, word for word, and what you replied. A verification question is not a fraud warning.
5. Look for specific knowledge on the bank’s side: regulator warnings or orders about the recipient, recalls, fraud reports about the recipient account, or your own call to the bank during the scam.
6. Send a targeted Article 15 GDPR request to your PSP as well as to the beneficiary`s PSP. No reasons are required.
7. Diarise the deadlines: one month for the DSAR response (plus any extension notified within the first month) and the limitation period.
8. Report the fraud to the police and keep a copy of your statement.
9. Have a lawyer assess the claim, the evidence strategy and the contributory-negligence risk before filing.

Our Assessment

German law offers victims a paradox: the hardest door to open is the duty, but once it is open, causation largely follows.

The duty threshold is demanding. The BGH requires massive suspicious circumstances that make the danger objectively evident in the ordinary course of processing, and it rejects any general duty to monitor account activity without special indications (XI ZR 343/22). OLG Frankfurt 23 U 8/23 adds that AML monitoring under § 25h KWG protects the bank, not the customer. Read together, these decisions leave little room for the detection-failure argument that succeeded before the Austrian OLG Linz in 1 R 45/25f. In EFRI’s view, that position deserves to be revisited. Article 2 of Delegated Regulation (EU) 2018/389 requires PSPs to operate monitoring that detects fraudulent payment transactions, not only unauthorised ones. A bank that is legally required to look for fraud, and whose system finds indicators of it, is not in the position of a neutral payment conduit.

Specific knowledge is the realistic route today. BGH XI ZR 327/22 shows what meets the threshold: concrete, documented information about the recipient, in that case a regulator’s order. For victims of investment fraud, this means looking systematically for such knowledge: regulator warning lists, recalls and fraud reports about the recipient account, and the customer’s own contacts with the bank during the scam. OLG Brandenburg 4 U 131/25 shows that a single missed opportunity, a hotline call in which the employee should have recognised a known fraud pattern, can shift part of the loss even to a bank whose customer was grossly negligent.

Causation is where German victims are better placed than Austrian ones. The presumption that a properly warned customer would have heeded the warning is a genuine reversal of the burden of proof (XI ZR 327/22). In Austria, by contrast, the victim must prove that a further warning would have worked, and a negative finding is fatal (OGH 3 Ob 40/26t). Together with the secondary burden of substantiation, this makes the evidence strategy in Germany particularly worthwhile: once the bank’s knowledge is established, the bank must explain why its warning would have been in vain.

The open question remains the fiat on-ramp to a legitimate exchange account in the victim’s own name. No German appellate decision reviewed addresses it squarely. The answer will depend on what the sending bank actually saw, which is why a targeted DSAR and a precisely pleaded claim are the starting point. Across Europe, victims currently face very different rules depending on where their bank sits. Clear, harmonised standards for fraud monitoring and intervention by PSPs would replace that divergence with predictable protection.

Note: This article is for general information only and does not constitute legal advice. Victims should seek independent legal advice from a lawyer with experience in banking law.

Sources

BGH 19.9.2023, XI ZR 343/22; BGH 14.5.2024, XI ZR 327/22; BGH 22.7.2025, XI ZR 107/24

OLG Frankfurt am Main 30.7.2024, 23 U 8/23 (notice under § 522(2) ZPO); LG Frankfurt am Main 8.12.2022, 2-27 O 251/22

Saarländisches OLG 29.2.2024, 4 U 85/22

OLG Brandenburg 27.5.2026, 4 U 131/25 (beck-aktuell, 9 July 2026)

OGH 18.6.2024, 6 Ob 120/23z; OGH 29.4.2026, 3 Ob 40/26t; OLG Linz 22.5.2025, 1 R 45/25f

CJEU 4.5.2023, C-487/21; CJEU 22.6.2023, C-579/21, Pankki S; CJEU 26.10.2023, C-307/22, FT v DW; EDPB Guidelines 01/2022 on the right of access, version 2.1

BGB §§ 195, 199, 242, 254, 666, 675, 675j, 675u, 675v, 675w; ZPO §§ 138, 142, 254, 522; GwG §§ 30, 43, 47; KWG § 25h; Delegated Regulation (EU) 2018/389, Article 2; GDPR, Articles 4, 12, 15, 77