Online fraud comes in a limited number of recurring forms – a purchase that is paid for and never delivered, a phishing message that leads to a bank login, an investment that does not exist, an invoice with altered payment details, a marketplace buyer who reverses a payment. The legal response falls into three tracks that run in parallel: criminal, civil and financial.
Track one: report it to the police
Fraud is a criminal offence, and a report can be filed online for many forms of it. A report rarely leads to recovery on its own, but it is often a precondition for the other two tracks: banks and insurers ask for it, and it is what allows patterns across victims to be connected.
File promptly and include everything: the advertisement or message, the account number used, the correspondence, the transaction details, the URL and dated screenshots. Preserve the originals rather than only screenshots where you can, because header information in an email is frequently what identifies the sender.
Track two: the money
This is the track most likely to produce a result, and it is time-sensitive. Contact your bank immediately: where a transfer has just been made, the receiving account can sometimes be blocked before the money is moved on. Where a card was used, a chargeback may be possible, and the periods for requesting one are short.
Banks are not automatically liable for money you transferred yourself. Where a payment was made by the customer after being deceived, the starting point is that the loss lies with the customer, unless the bank failed in its own duty of care – for instance by ignoring signals of unusual activity that it had undertaken to monitor. Where the fraudster gained access to the account, the position is different, and a bank can only place the loss on the customer where the customer was grossly negligent, for example by handing over security codes.
Payment platforms and marketplaces frequently operate their own buyer protection schemes with their own deadlines. Use them; they are usually faster than any legal route.
Track three: the civil claim
Where the counterparty is identifiable, a civil claim for repayment or damages is available, and for smaller amounts the subdistrict court is accessible without a lawyer. The obstacle is almost never the merits; it is identification and enforcement. Where a name and address can be established, a claim is realistic; where all you have is an account number and a message, the practical route runs through the bank and the police.
Where a website or a platform is involved, a takedown request can limit further damage and preserve evidence, and platforms are subject to obligations on notice and action.
The invoice fraud variant
One form deserves separate mention because it hits businesses hard: an email that appears to come from a supplier announcing new bank details. The money is paid to the fraudster, and the original debt remains outstanding, so the business pays twice. The dispute that follows is between the two legitimate parties, and it turns on who could most reasonably have prevented the error – which is why verification of changed payment details by telephone, to a number already known, is worth more than any legal remedy afterwards.
Advice
Speed determines outcomes here more than anything else. We advise on claims against banks and platforms, on civil recovery where the counterparty can be identified, and on the position between businesses after invoice fraud. Please contact Law & More.
