Account takeover fraud in online banking

The cheapest route is credential stuffing, which OWASP describes as the automated submission of stolen username and password pairs into login forms. It works because people reuse passwords across sites, so one breach opens accounts elsewhere. The BSI lists the other routes to online banking access: phishing emails, trojans that capture access data and databases stolen from service providers.

A password alone rarely moves money at a European bank, because strong customer authentication asks for a second element. Attackers therefore go after that element too: a TAN typed into a phishing page, a code read out to a fake bank employee on the phone, or SMS codes redirected through a SIM swap.

A payment that the attacker initiates is unauthorized. Under section 675u of the Civil Code the bank must refund it at once, at the latest by the end of the business day after it learns of it. Under section 675v the customer carries at most EUR 50 where a payment instrument was misused, carries the full loss only after fraud, intent or gross negligence, and carries nothing if the bank did not require strong customer authentication.

The 2025 report on payment fraud by the EBA and the ECB shows how the line between unauthorized and authorized payments moves losses. In more than 90 percent of the value of card fraud the fraudster issued the payment order, and users bore 38 percent of card fraud losses. For credit transfers, where most fraud came from manipulating the payer into paying, users bore around 85 percent.

Passkeys bind the login to the bank's own domain, so a phishing page cannot reuse them. Behavioral biometrics compares typing and touch patterns during the session with the customer's usual ones. ENISA describes an interface that some mobile operators offer to banks, so the bank can ask whether a customer's SIM card was swapped shortly before it sends a code.

The Payment Services Regulation adds duties of its own. According to the European Parliament, payment service providers have to offer spending limits and blocking measures to reduce the risk of fraud. The AI fraud detection page covers the payment scoring that runs after the login.

Identity theft is the misuse of someone's personal data in general. Account takeover is the form that targets an account the victim already holds: the attacker logs in as the customer and acts from inside. The BSI names online banking among the accounts that criminals take over with stolen data.

No. Authorized push payment fraud covers payments the customer makes personally after being deceived, as the APP fraud page explains. In an account takeover the fraudster initiates the payment, which makes it unauthorized, and under the Payment Services Regulation a transaction that a fraudster starts or changes also counts as unauthorized.