How the alleged refund of account management fees works and what rights you have against your bank
The email claiming a refund of €106.99 in account maintenance fees is not from Sparkasse, but from fraudsters. Anyone who has clicked on the link and entered their data should immediately have their online banking access blocked. Rogert & Ulbrich assists those affected in reclaiming unauthorized debits from their bank.
What's behind the €106.99 email in the name of the savings bank?
Customers of savings banks are currently receiving emails claiming that account maintenance fees of €106.99 were wrongly charged during an account review. The emails demand a "full and immediate" refund, requiring customers to confirm the refund within 24 hours via a supposedly secure customer portal. The Brandenburg Consumer Center classifies this message as a phishing attempt.
The scam is cleverly designed. Instead of threatening to freeze the account, the perpetrators promise money. The odd amount seems plausible. Furthermore, many bank customers have actually received refunds in recent years after the Federal Court of Justice ruled in 2021 that banks cannot impose price increases through tacit consent. The fraudsters are exploiting precisely this knowledge.
The following characteristics reveal the true nature of the email:
- Impersonal salutationThe message begins with "Dear Customer" instead of your name.
- Foreign sender address: This email did not originate from an address of your savings bank.
- Surprising credit: You did not request a refund and were not informed of it in any other way.
- Artificial time pressureConfirmation should be received within 24 hours, otherwise the payment will be delayed.
- Link to a customer portalThe link asks you to enter data. It does not lead to the real savings bank, but to a fake website.
The savings bank clarifies that it will not ask its customers for personal login details via email, SMS, or telephone. You can only check whether a refund is actually outstanding using the savings bank app or your bank's website.
You received the email and are unsure whether you have already disclosed any data? Clarify this now before money is lost.
Link clicked or data entered: These steps are now crucial.
What to do depends on how far you've gone:
- Only opened the linkClose the page and do not enter anything. If you have not disclosed any data and have not downloaded any files, no damage has usually occurred.
- Access data enteredImmediately have your online banking access blocked via a known contact method with your savings bank and change your access data, preferably via a different device.
- Card or credit card details enteredBlock your card as a precaution. The emergency blocking hotline 116 116 is available 24/7.
- TAN entered or release confirmedInform your savings bank immediately. The sooner the bank is informed, the sooner further debits can be stopped and current payments may still be delayed.
- File downloadedDo not use the device for banking transactions until it has been checked and cleaned.
Reporting the misuse of your login credentials immediately is not only advisable, but legally required. According to Section 675l Paragraph 1 of the German Civil Code (BGB), you must notify your bank immediately of any unauthorized use of your login details as soon as you become aware of it.
File a police report; this can also be done via the online police portals of your state. Secure evidence: the phishing email including the sender's address, screenshots of the fake website, bank statements, and all push notifications from your banking app.
Don't wait to see if anything else happens. With phishing, every hour counts.
Have you disclosed your data and there have already been withdrawals from your account? Have the process checked before you make any statements to your bank.
Your rights vis-à-vis the bank: Reimbursement of unauthorized payments
If fraudsters have withdrawn money from your account using your data, this is generally an unauthorized transaction. A payment is only authorized if you have explicitly consented to it (§ 675j German Civil Code). For unauthorized payments, § 675u German Civil Code applies: The bank is not entitled to reimbursement of its expenses and must restore your account to the balance it would have been without the debit.
The refund must be processed immediately, at the latest by the end of the business day following the day on which the bank assigned the transaction to you or you reported it. The bank may not simply withhold the refund to conduct an internal review. An exception applies only if the bank has legitimate grounds for suspecting fraud against the customer and reports these grounds to the supervisory authority.
Your own liability is limited. In the event of misuse of your access data, your liability is limited to a maximum of €50 according to Section 675v Paragraph 1 of the German Civil Code (BGB). You are liable without limit only if you have acted intentionally or with gross negligence (Section 675v Paragraph 3 BGB). The burden of proof for this lies with the bank. The mere fact that your access data or a TAN was used does not automatically imply that you acted with gross negligence according to Section 675w BGB.
Further information about your entitlements at online banking fraud and at Credit card fraud You can find them on our topic pages.
Is your savings bank refusing to refund your money or making you wait? Have it checked whether this procedure is legally sound.
Gross negligence: The banks' main argument and its limits
In practice, banks often reject reimbursements after phishing attacks, citing gross negligence. Gross negligence is defined as an unusually serious breach of the required standard of care, disregarding what should have been obvious to anyone in the specific situation. The individual circumstances of the person affected are also relevant, not just an abstract standard.
Case law is inconsistent and heavily influenced by individual circumstances. Anyone who discloses a TAN (transaction authentication number) over the phone or confirms a payment authorization when the banking app clearly indicates a transfer to an unknown recipient is often considered grossly negligent by the courts. In 2025, the Federal Court of Justice dismissed a bank customer's lawsuit in such a case. At the same time, it emphasized that the threshold for establishing gross negligence is high. In cases of deceptively realistic forgeries without any discernible warning signs, courts have repeatedly rejected the notion of gross negligence.
Whether the bank can claim gross negligence depends on the details:
- Design of the phishing pageThe more professional the forgery, the more difficult it is to prove a gross breach of duty of care.
- Release message textThe crucial factor is what the app actually displayed when granting permission and whether the purpose of the permission was clearly recognizable.
- Process and time pressureA short deadline and a surprising situation may suggest a momentary lapse that is not yet grossly negligent.
- Strong customer authenticationIf the bank has not required strong customer authentication for the payment, the customer is generally not liable according to § 675v para. 4 BGB, except in cases of fraudulent activity.
- Unusual transactions: Large amounts, new recipients or payments abroad can constitute contributory negligence on the part of the bank under § 254 BGB if its fraud detection system has not been triggered.
- Behavior after discoveryAn immediate suspension and report demonstrates a careful handling of the incident.
Is the bank accusing you of gross negligence? This accusation is often contestable. Have it reviewed before accepting it.
Typical mistakes after a phishing attack
Many people weaken their position without realizing it. You should avoid these mistakes:
- Accept the bank's rejection without question.A letter of rejection is not a final decision. It reflects the bank's legal opinion, not necessarily the actual legal situation.
- Making hasty statements: Formulations in damage reports or meeting notes are often later used as evidence of gross negligence.
- Delete evidenceDeleting a phishing email immediately will cause you to lose important documents. Save them first, then delete them.
- Letting deadlines passUnauthorized payments must be disputed with the bank no later than 13 months after the debit (§ 676b para. 2 BGB). After this period, claims are excluded.
- Falling for "money-back services"After a scam, supposed helpers often contact the victim, promising a recovery in exchange for advance payment. This is often a scam.
Do not sign any pre-formulated statement from the bank before you know what you are agreeing to.
You can read more about other online scams on our page about Online fraud.
Have you already corresponded with your bank? Have the correspondence reviewed before taking any further steps.
Greater protection through new EU rules: What's emerging
At the European level, Parliament and Council reached a political agreement in November 2025 on a new Payment Services Regulation. Among other things, it provides for a right to compensation if fraudsters impersonate employees of the customer's own bank and thereby induce customers to make a payment. A prerequisite is that the customer files a police report and informs their bank. Furthermore, banks will be held more liable if their fraud prevention measures are inadequate.
These rules are not yet in effect. For phishing cases occurring today, the provisions of the German Civil Code (BGB) remain applicable. However, the mandatory verification of the recipient's name and IBAN for SEPA transfers is already in force. This can make fraud more difficult, but it does not protect against payments that you yourself authorize under false pretenses.
New rules will only help in the future. For damages already incurred, current law applies. Have your claims reviewed now.
Rogert & Ulbrich – Your lawyers in banking law
Rogert & Ulbrich represents consumers nationwide in phishing cases, online banking fraud and card fraud. The law firm led by Dr. Marco Rogert and Tobias Ulbrich has taken on over 40,000 cases and filed more than 25,000 lawsuits. In banking law It enforces the claims of bank customers against savings banks, cooperative banks, direct banks and credit card providers.
We will examine the sequence of events during the attack, request the transaction and authorization logs from your bank, and assess whether the allegation of gross negligence is justified. We will then pursue your claim for reimbursement out of court and, if necessary, conduct legal proceedings.
Is your savings bank refusing reimbursement or accusing you of gross negligence? Get in touch and secure your claims. Claims.
