Credit card use - Disclosure of SMS TANs constitutes negligence
Anyone who discloses an SMS TAN to a third party acts grossly negligently and has no right to claim repayment of amounts debited illegally to their credit card. This was recently decided by the Local Court (Amtsgericht, AG) in Munich.
Its ruling of 8.1.2025 (case reference: 271 C 16677/24) concerned the following issue - on the 6.1.2024, the claimant’s husband wanted to book a trip via the online platform ‘Check24’ and used his wife’s credit card for this purpose. Shortly afterwards, a reservation for €318.99 was initially displayed. The claimant had her credit card blocked on the very same day. Nevertheless, on 8.1. 2024, there were six unauthorised debits in a total amount of €1,953.29 for the purchase of gift cards. Mastercard 3-D Secure Authentication was used for the transactions. To activate this on another device, the bank had sent an SMS TAN on 6.1 to the claimant’s mobile phone number saved in its system. This TAN was entered on a new end device where the banking app was subsequently activated. The claimant disputed that she had ever used an SMS TAN, or had disclosed it and demanded the reimbursement of the debited amounts from the bank.
The court dismissed the claim. It stated that it was indeed beyond doubt that the SMS TAN had been used. Proof of this was provided both by the bank’s IT logs as well as the SMS saved, on 6.1.2024, on the claimant’s mobile phone. For the court, it was therefore clear that the claimant must have disclosed the TAN to unauthorised persons through gross negligence. It is admittedly not unusual for credit card data to become known to a third party because these are disclosed each time the card is used. The situation is however different with access codes that are sent as a part of two-factor authentication. Anyone who divulges such SMS TANs circumvents the entire security architecture of the system.
