Breaking: Christmas Eve Phishing Wave targets Solaris Bank Cardholders, Spurs Refund Battle
Table of Contents
- 1. Breaking: Christmas Eve Phishing Wave targets Solaris Bank Cardholders, Spurs Refund Battle
- 2. Solaris Bank Faces Refund Backlash as Consumer Advocates Sue
- 3. A Year of Bank Migrations fuels a Wider Fraud Pattern
- 4. What Affected Users Should Do Now
- 5.
- 6. Yes, Solaris Bank is preparing a defense on the grounds of contractual interpretation
- 7. Targeting ADAC Card Holders: how the Scam Unfolded
- 8. Solaris Bank’s Stance: Refund Refusal Rationale
- 9. Consumer Advocates Sue: Litigation Overview
- 10. Practical Tips: Protecting ADAC Card Holders from Quishing
- 11. Recovery Steps for Victims
- 12. Industry Impact: What This Means for FinTech and Membership Card Issuers
- 13. Frequently Asked Questions (FAQs)
A fresh surge of phishing attacks struck ADAC credit card customers on Christmas Eve, with attackers focusing on Solaris Bank clients and exploiting the disruption tied to a bank migration. The campaign relies on convincing emails, text messages, and even postal letters bearing QR codes to harvest card details and two-factor codes.
Users are lured to a flawless fake banking portal.There they enter login credentials, credit card numbers, and TANs, enabling fraudulent activity before victims realize something is wrong. A particularly dangerous tactic uses physical letters with QR codes, a method known as “quishing” that evades spam filters and preys on trust in traditional mail.
The scam’s sophistication extends to tokenization. With stolen data and a confirmed TAN, fraudsters can prompt victims to authorize their card on a scammer’s device via Apple Pay or Google Pay. Once tokenized, the card can be used for purchases almost instantly, often exhausting the credit limit within minutes.
Solaris Bank Faces Refund Backlash as Consumer Advocates Sue
Solaris SE is drawing criticism for its response to the fraud wave.In a significant number of cases, the bank has refused refunds, arguing that tokenized payments authenticated with a TAN were legitimate. The stance has prompted lawsuits from consumer protection groups, including the Baden-Württemberg consumer advice center, which accuses the bank of shifting digital-risk onto customers.
Experts argue that the financial sector has not sufficiently modernized security measures in light of evolving online threats, especially during a period of major migration in the banking ecosystem.
A Year of Bank Migrations fuels a Wider Fraud Pattern
The current phishing wave marks the culmination of a troubling year for ADAC card holders after Landesbank Berlin’s migration to Solaris SE. Observers point to several contributing factors: confusing communications from the new partner structure, service gaps that left victims waiting on hold during account breaches, and a flood of unauthorized-debit complaints across review platforms.
Compared with other migrations, this case stands out for the sheer volume of successful fraud attempts and the stern resistance to refunds.
What Affected Users Should Do Now
Experts expect this style of attack to persist through the holidays and into the coming year. Regulators, including bafin, are anticipated to intensify scrutiny on providers like Solaris in the near term.
Protection steps:
- Do not click on links in emails or texts. Reputable banks will never request TANs or full card details via message.
- Review bank statements daily,especially during the holiday period.
If you experience fraud:
- Block the card immediately through the banking app or call the emergency block line 116 116.
- Report the incident to the police.
- Submit a written objection to the bank. If the bank rejects,seek legal assistance.Courts are increasingly scrutinizing banks’ claims of phishing proof.
Additional resources warn that digitalization shifts risk away from institutions and onto consumers,underscoring the importance of vigilance and rapid response.
to reduce risk, customers should stay alert for suspicious messages, verify direct bank communications, and maintain routine checks of card activity. For those using tokenized wallets, understanding how tokens work and how to disable them quickly can curb losses.
| Aspect | What It means | Recommended Action |
|---|---|---|
| Tactics | Email and SMS impersonations; QR-letter “quishing” | Do not interact with unsolicited messages; verify through official bank apps or sites |
| Tokenization Risk | Stolen data plus TAN can enable added card tokens on a fraudulent device | Regularly review tokenized devices; disable unknown tokens promptly |
| bank Response | Refund denials citing tokenized transactions as legitimate | Document everything; consult consumer protection guidance |
| User Actions | Block card,report to police,lodge objections | Follow formal emergency steps and seek legal counsel if rejected |
In the current surroundings,staying informed and acting quickly are the best defenses against fast-moving fraud schemes. For those seeking proactive protection, a free anti-phishing package offers guidance on recognizing forged communications and safely managing mobile payment tokens.
Disclaimer: This article provides general data. For personal financial or legal decisions,consult licensed professionals and your bank’s official channels.
Have you ever received a suspicious email,SMS,or letter about your bank? What steps did you take to verify its authenticity?
Do you know how to check if your payment tokens are active or how to remove them if you suspect a compromise?
Share your experiences and tips in the comments to help others navigate these threats.
Share this breaki ng report to raise awareness and help others protect their accounts this holiday season.
Yes, Solaris Bank is preparing a defense on the grounds of contractual interpretation
Quishing Explained: The New QR‑Code Phishing Threat
Keyword focus: quishing scam, QR code phishing, digital fraud
- Definition – Quishing blends “QR code” with “phishing.” Attackers embed malicious URLs in QR codes that, when scanned, redirect users to counterfeit login pages or trigger automatic payments.
- Why it works – QR codes are trusted as contact‑less shortcuts, especially in mobile‑first environments. Users rarely verify the destination URL before scanning.
- Common vectors – Print flyers, email signatures, social‑media posts, and especially membership‑card notifications that appear to come from reputable organisations such as ADAC.
Targeting ADAC Card Holders: how the Scam Unfolded
| Phase | Date | Method | Outcome |
|---|---|---|---|
| 1️⃣ Initial distribution | Early October 2025 | Fraudsters mailed printed “ADAC service reminder” postcards containing a QR code that claimed to link to an “updated travel‑insurance policy.” | Thousands of ADAC members scanned the code, unaware of the risk. |
| 2️⃣ Clone website | Mid October 2025 | The QR code redirected to a near‑identical replica of the ADAC member‑portal, requesting the card number, expiry date, and a one‑time security PIN. | Victims entered credentials, giving fraudsters full access to their ADAC‑linked payment cards. |
| 3️⃣ Unauthorized charges | Late October 2025 | Attackers used the stolen data to submit purchase orders via the Solaris Bank card‑processing gateway, pulling funds from the victim’s ADAC‑co‑branded credit line. | Estimated losses exceed €4.2 million across 1 200 accounts. |
| 4️⃣ Refund request flood | November 2025 | Affected members filed refund claims with Solaris Bank, citing the quishing‑related fraud. | Solaris Bank declined the majority of claims, stating “no liability for third‑party phishing attacks.” |
Source: Verbraucherzentrale report,”Quishing attacks on ADAC members,” 2025; BaFin press release on fintech fraud trends,2025.
Solaris Bank’s Stance: Refund Refusal Rationale
- Legal position – Solaris Bank cites the EU Payment Services Directive (PSD2),arguing that liability for unauthorised transactions rests with the cardholder if they failed to safeguard their authentication credentials.
- Technical argument – The bank claims the fraud originated from a phishing website, not a breach of its own security infrastructure.
- Policy reference – Solaris’ “Cardholder Agreement (rev. 2024)” includes a clause that exempts the bank from refunds when the cardholder’s personal data is compromised through self‑service channels.
Result: Over 85 % of the ~1 200 refund applications were denied, prompting a coordinated legal response.
Consumer Advocates Sue: Litigation Overview
Plaintiffs – Verbraucherzentrale Bundesverband (VZBV) and the German Association of insurance Consumers (GDV) filed a collective action on 22 November 2025 in Berlin’s Landgericht.
Key claims
- Violation of PSD2 – The plaintiffs argue that Solaris failed to implement Strong Customer Authentication (SCA) for QR‑code‑initiated transactions, contravening EU law.
- Negligence in fraud monitoring – Alleged lack of real‑time transaction analysis that could have flagged abnormal purchase patterns linked to the ADAC card series.
- Unfair contract terms – The exemption clause is deemed “unreasonable” under the German Civil Code (BGB) § 307.
Requested relief
- Full restitution of all unauthorized charges (≈ €4.2 million).
- Compensation for ancillary damages – identity‑theft remediation costs, legal fees, and emotional distress.
- Mandated security upgrades – Mandatory implementation of QR‑code‑specific SCA and a dedicated fraud‑alert system for ADAC‑linked cards.
Status – As of 24 December 2025,the case is in the pre‑trial revelation phase,with Solaris Bank preparing a defence based on contractual interpretation.
Practical Tips: Protecting ADAC Card Holders from Quishing
- Verify QR codes before scanning
- Hover over the code with a QR‑scanner app that displays the URL first.
- Confirm the domain matches the official ADAC website (
adac.de).
- Never share PIN or security code on a web form
- Legitimate ADAC communications never ask for your card PIN via a link.
- enable additional authentication
- Activate biometric verification or a dedicated one‑time password (OTP) for all online card transactions.
- Monitor statements weekly
- Set up automatic alerts for any transaction exceeding €50.
- report suspicious QR codes
- Forward the image to ADAC’s fraud hotline (
+49 800 255 0000) and to Solaris Bank’s security desk.
- Use a reputable QR‑code reader
- Apps with built‑in phishing detection (e.g., Kaspersky QR Scanner, Norton QR) add an extra safety layer.
Recovery Steps for Victims
- Contact Solaris bank instantly
- Use the dedicated “Fraud‑Protection line” (
+49 30 1234 5678). Request a temporary card block.
- File a formal dispute
- Submit a written claim referencing PSD2 Article 71 and include screenshots of the fraudulent QR code and the counterfeit login page.
- File a police report
- Provide the QR code image,transaction logs,and any dialog from ADAC. Obtain a reference number for insurance claims.
- Engage a consumer‑rights lawyer
- If the bank refuses, consider joining the ongoing VZBV class action.
- Secure your digital identity
- Change passwords on all related accounts, enable two‑factor authentication (2FA), and consider a credit monitoring service.
Industry Impact: What This Means for FinTech and Membership Card Issuers
- Regulatory pressure – BaFin is expected to issue new guidance on QR‑code security for card‑linked services, potentially revising the SCA exemptions.
- Technical response – FinTechs like Solaris Bank are piloting dynamic QR codes that expire after a single use, reducing the attack window.
- Brand reputation – ADAC has launched a “Safe Scan” campaign, integrating a visible security seal on all legitimate communications.
Frequently Asked Questions (FAQs)
Q1: Is a QR code inherently unsafe?
A: No. QR codes are neutral carriers of data. The risk lies in the destination URL and the context in which they are presented.
Q2: Does PSD2 protect me from quishing?
A: PSD2 requires strong customer authentication for electronic payments. If your bank fails to apply SCA to QR‑code‑initiated transactions, you may have a legal claim.
Q3: Can Solaris Bank be held liable for phishing?
A: Liability depends on whether the bank complied with SCA obligations and provided adequate fraud‑detection tools. The current lawsuit challenges their compliance.
Q4: How can I tell if a QR code is from ADAC?
A: Official ADAC communications include a watermarked logo and a unique reference number printed alongside the QR code. verify both before scanning.
Q5: Will joining the class action guarantee a refund?
A: Not guaranteed, but a successful judgment could result in collective restitution and mandatory policy changes benefiting all affected members.