Legal Steps and Evidence After Crypto Scams and Online Fraud

When an unauthorized transfer drains a digital account following a deceptive SMS or remote-access scam, German civil law requires courts to separate technical authentication methods from actual legal consent. Recovering funds depends entirely on mapping the exact chain of communication, payment execution, and platform interaction.

The Bottom Line

• Legal Separation: Under Sections 675j and 675u of the German Civil Code (BGB), a logged session or inputted TAN does not automatically equate to legal authorization for a disputed transfer.
• Evidentiary Chain: Recovering losses requires preserving original chat histories, deceptive URLs, and specific banking records rather than relying on isolated screenshots.
• BGH Precedent: A Federal Court of Justice (BGH) ruling from July 22, 2025, establishes that deficient strong customer authentication during a login does not automatically trigger full customer liability for subsequent payments.

Fraud Pathways and Their Digital Footprints

Fraudulent operations frequently begin with deceptive text messages mimicking legitimate cryptocurrency exchanges or banking institutions. These messages generate artificial urgency, directing victims to spoofed websites or phone numbers designed to capture login credentials. A familiar sender name in an SMS history offers no proof that the message originated from the actual service provider.

In other instances, bad actors request remote-maintenance software installations under the guise of security verification. Once installed, third parties can monitor screens or manipulate inputs in real time. Legal evaluations of these cases require examining software installation permissions, active connections, and corresponding banking actions rather than applying broad assumptions of gross negligence.

Fake-trading platforms are another vector, where initial deposits generate fabricated dashboard metrics showing rising values. When victims attempt withdrawals, platforms demand purported taxes or release fees. Additional payments to these entities fail to establish a legally enforceable payout claim, necessitating independent verification of all platform interactions.

Applying German Civil Law to Unauthorized Transfers

Determining liability for an unauthorized transaction hinges on the distinction between authorization and technical authentication under Sections 675j and 675w BGB. When a payment service provider processes a non-authorized transaction, Section 675u BGB generally mandates reimbursement to the payer. The provider must then prove customer liability under Section 675v BGB by demonstrating a specific breach of duty and a direct causal link to the loss.

A significant legal benchmark arrived with the BGH ruling on July 22, 2025 (Docket XI ZR 107/24, paragraphs 34 to 39). The court differentiated between strong customer authentication during an initial login and authentication required for a disputed transfer. The absence of strong authentication at login does not automatically bar a customer’s reimbursement claims under Section 675v BGB if that login step was distinct from the payment authorization.

Legal Standard	Relevant BGH / BGB Provision	Core Legal Principle
Payment Authorization	§ 675j BGB	Requires explicit consent to the specific payment; technical logins or TAN inputs are insufficient on their own.
Unauthorized Transactions	§ 675u BGB	Obligates the payment service provider to refund unauthorized outflows unless customer liability is proven.
Authentication Separation	BGH XI ZR 107/24 (July 2025)	Flaws during login do not automatically establish customer liability for later transactions requiring separate authentication.

Constructing an Evidentiary Chain from Digital Records

Building a viable path toward recovery requires organizing communication logs, financial statements, and device data into a coherent chronology. According to Max Hortmann, isolated screenshots rarely suffice for formal legal proceedings. Plaintiffs must link specific advisory messages directly to the actions and payments that followed.

Evidence gathering focuses on categories including messaging records, bank and exchange statements, device access logs, and formal responses from financial institutions. Establishing the paper trail involves identifying the specific blockchain, transaction identifiers, destination addresses, and exchange records. While blockchain analytics map the movement of digital assets, they do not automatically verify the identity behind a recipient wallet.

Procedural Deadlines and Next Steps for Affected Account Holders

Immediate action is required when account access remains compromised. Victims must prioritize restricting further account access through independently verified contact channels of their financial institutions. Under Section 676b BGB, non-authorized or incorrectly executed payment transactions must be reported to providers without undue delay, subject to an outer statutory limit of 13 months.

Legal strategy must balance potential civil claims against banks, exchanges, and illicit recipients while avoiding fraudulent recovery services promising guaranteed returns for upfront fees. Establishing liability requires identifying specific contractual breaches under provisions such as Section 280 BGB, linking those breaches directly to the sustained financial loss.