Phishing in Online Banking – An Overview of the Development and the European and German Legal Positions

Abstract

Conducting banking transactions via Online Banking is well established in today’s society. It is therefore not surprising that it is subject to frequent criminal attacks which lead to high economic damage. The so-called phishing attacks, which have been occurring in Germany since about 2005 are a particular example of this. The investigation of phishing cases is interesting from both a technical and a legal perspective. This article gives a basic overview of the development of phishing in recent years, different attack methods and various Online Banking procedures with which attempts are made to protect against phishing attacks. Furthermore, this contribution explains the basic European and German legal rules which apply in case of a phishing attack. Since the attacker cannot usually be identified and held accountable, it must be determined who is liable for the damage caused by the phishing attack. Phishing in Online Banking has received very specific legal regulation, initially European and subsequently at German level. This paper will therefore examine the apportionment of risk under German law and according to the currently applicable European standards introduced by the First and Second Payment Services Directives. In addition, the most important innovations introduced by the Second Payment Services Directive are considered, in particular the so-called Two-Factor authentication.