Phishing victims are preparing legal action against banks

A group of around 40 clients of Luxembourg banks, primarily the Banque Internationale à Luxembourg (BIL), are preparing for legal proceedings. During a spate of frauds this summer involving the LuxTrust authentication system, each of the victims lost between €6,000 and €20,000. According to lawyer Marc Theisen, who is representing the victims, attempts to resolve the dispute out of court have been unsuccessful, leaving legal action as the only available option to protect the clients’ rights. The phishing victims are expected to hold a joint meeting in early October to coordinate their next legal steps.

At the same time, the financial institutions categorically deny any blame for what has happened. Marc Theisen explained that the banks are steadfastly maintaining the position that they did not make any operational errors and bear no direct responsibility for their clients’ financial losses. Months of negotiations, in which the Commission for the Supervision of the Financial Sector (CSSF) was involved, ended without result and did not lead to the conclusion of settlement agreements or the establishment of a mechanism for the payment of compensation out of court.

Although the specific nature of each individual incident means that the claimants cannot be grouped together to bring a single class action, the defence points to the existence of recurring patterns. According to the lawyers, in many cases identical amounts were debited from the accounts. This gives reason to believe that the banks possessed the technical resources and algorithmic capabilities to block at least some of the fraudulent transactions, even in the face of the attackers’ sophisticated methods. A further argument in favour of the financial institutions’ vicarious liability is the sharp decline in the number of fraud cases at the end of the summer. Marc Theisen attributes this trend not only to increased public awareness, but also to the introduction of enhanced security measures by the banks themselves. At the same time, he criticised the attitude of credit institutions towards affected customers, describing it as decidedly cold.

Furthermore, the true scale of the problem may turn out to be considerably greater. The solicitor reports that he is aware of thousands of similar incidents, with confirmed financial losses exceeding €100,000 in some cases. Despite recent statements by the Luxembourg Public Prosecutor’s Office regarding several arrests in connection with these incidents, Marc Theisen believes that those detained are low-level operatives rather than the organisers of the scheme. In the current situation, he urges victims to realistically assess the prospects of recovering their funds through standard complaints against unknown persons. According to the lawyer’s assessment, the process of recovering losses through the criminal prosecution of rank-and-file participants in the criminal network could drag on for years with no guarantee of ultimate success.