Home insurance not liable for IBAN disclosed in chat

The Bernau Local Court in Germany has ruled that a home insurance policy's cyber protection does not cover losses incurred when an individual discloses their IBAN and credit card details in a chat. This decision stems from a case where a seller was tricked into revealing sensitive information.

The case involved a woman selling a stroller via the platform Vinted. An individual posing as a buyer claimed payment had been made and directed her to a chat room for confirmation. In the chat, another person, claiming to be from the platform, instructed the woman to enter her IBAN and credit card numbers. Subsequently, the woman confirmed a transaction request in her banking app, leading to a deduction of nearly €2,000 from her account.

The woman sought compensation from her home insurance, which included an add-on for cyber risks and phishing. However, the court dismissed her claim. Judges reasoned that the situation did not constitute an insured phishing event as defined by the policy terms. They stated that IBANs and credit card details are not considered "confidential access credentials" like passwords or PINs, as they are regularly shared in payment processes.

Furthermore, the court determined the loss did not arise from a misuse of online banking credentials but from the claimant herself confirming the payment in her banking app. The judges suggested she should have realized she was initiating a payment to a third party. The court did not definitively address whether fraud conducted via a chat room would fall under the policy's scope, as the clause specifically mentioned fake emails.

This ruling underscores the importance of carefully reviewing insurance policy wording, particularly concerning cyber coverage. Such cases are not uncommon in Germany, where disputes over whether specific types of online fraud are covered by insurance policies continue to be a subject of litigation.