Smishing – when Fraudsters Want to Cash in via SMS

Underestimated Danger on Smartphones

Smishing – a term still unfamiliar to many, but long since become a real threat. The word creation from “SMS” and “Phishing” describes a particularly perfidious scam where criminals specifically target sensitive data via text message. Whether it’s an alleged package notification, blocked bank card, or a link for account verification – the tricks are sophisticated, the damage often enormous. And: Legal action is possible, but anything but trivial.

How Does Smishing Work Specifically?

Typical process: A deceptively genuine-looking SMS lures with an urgent matter – such as a link for shipment tracking, an alleged account login, or a security warning. Those who click land on a fake website where login details, credit card numbers, or TANs are requested. In some cases, malware is even installed unnoticed.

The goal: Access to bank accounts, payment services like Apple Pay or Klarna, and ultimately, reaching into your wallet.

Frequently Asked Questions from Affected Individuals

“I clicked on the link – what now?”
Act immediately: Put device in airplane mode, change login details, contact affected bank(s), file a report with the police. And above all: seek legal advice.

“The bank refuses a refund. Is this permissible?”
This is where the tricky part begins. According to § 675u BGB, the bank must refund an unauthorized payment. However, in practice, banks regularly try to evade responsibility with the accusation of “gross negligence” – for example, arguing that login details were carelessly disclosed. Whether this holds up legally depends on the individual case. And this is where I come in.

Legal Assessment: What Can Be Enforced?

The central question is always: Was there an “authorized payment” in the sense of § 675j BGB? And if not – can the bank invoke an exception such as gross negligence?
A trend is emerging in case law where courts increasingly scrutinize whether the customer could reasonably consider the SMS as genuine. Was the sender manipulated? Was the link deceptively real? Have there been similar cases with the same bank?

Some courts have obligated banks to refund – even with Apple Pay usage – arguing that the institution’s security measures were inadequate or the customer was misled by sophisticated deception.

My Practical Tips for Those Affected

  1. Don’t panic – but document.
    Screenshots, SMS contents, account statements, conversation notes – the more evidence, the better.
  2. Act swiftly.
    Inform the bank, file a report, secure the account, possibly reverse payments.
  3. Seek legal advice.
    Time limits are running. Many clients come too late – then claims for refunds are time-barred or forfeited through tacit approval.
  4. Don’t communicate with the bank alone.
    What you say (or don’t say) can weaken your position later. Upon request, I take over all correspondence – factual, assertive, legally sound.

Conclusion

Smishing is not an embarrassing “click error”, but organized crime. Victims need no shame, but support – legally and strategically. I help to limit damages, enforce claims, and minimize future risks. Anyone who has fallen victim to such fraud should not hesitate to seek legal advice early on. Because: Those who wait too long pay twice – first to the perpetrators, then to the system.


Do You Need Support Dealing with Smishing Consequences? I regularly represent clients who have lost money through fraudulent SMS – nationwide, efficiently, with a clear edge. Feel free to contact me.