Fake bank advisor fraud, often referred to by the Anglicism spoofing, has become one of the most profitable scams in Switzerland. Individuals, SMEs, self-employed: no one is safe, and the amounts involved run into tens, sometimes hundreds of thousands of francs. After the shock, almost always the same question arises: Does the bank have to reimburse?
The honest answer is: it depends. The Federal Supreme Court has established a precise analytical framework, which can rule in favor of either the victim or the bank, depending on the case. Three parameters are weighed: what the general terms and conditions stipulate, the severity of the institution’s fault, and the client’s behavior. There are therefore legal arguments to be made, and it’s best to know them before signing a waiver.
The mechanism, in a few strokes
The scenario is well-rehearsed. A call, an interlocutor who introduces themselves as the bank’s “security service” or “anti-fraud service,” an invented threat to the account. The voice is calm, professional, urgent. Under the pretext of protecting assets, remote control software is installed, or authentication codes are extorted. From there, the fraudster controls the victim’s banking environment.
The obstacle of validation remains. When the bank requests confirmation, the victim, manipulated and under pressure, provides it, sometimes by reciting a text dictated over the phone. It is precisely this confirmation that the bank will then use to absolve itself. The funds, meanwhile, have already left: fragmented, sent to relay accounts (in a recent case, a transfer of CHF 280,000 split into three orders to Hong Kong and Cyprus in less than an hour), then dispersed. After forty-eight hours, traceability collapses.
What the Federal Supreme Court really says
Two misconceptions to dispel. The bank does not automatically reimburse; but it also does not free itself by brandishing the confirmation you provided.
Since 2019-2020, the 1st Civil Law Chamber has established a now stable method, through three landmark rulings: ATF 146 III 121 (general framework), ATF 146 III 326 (fraudulent orders sent by email, in the presence of a risk transfer clause), and ATF 146 III 387 (CEO fraud, the 4 million ruling I will return to). The reasoning unfolds in three stages.
First stage: Was the order given by the client, or without them? When a third party places the order fraudulently, or when the agreed signature method (typically collective signature by two) is not respected, there is no valid mandate. The damage is then, in the legal system, that of the bank, not the client: the money in the account belongs to the institution, the client having only a claim for restitution based on the giro relationship (ATF 146 III 387, consid. 4.1).
Second stage, and this is often where everything changes: do the general terms and conditions contain a risk transfer clause, and is it enforceable? Such a clause is in principle valid. It yields when the bank has committed a serious fault (Art. 100 para. 1 CO). In plain terms: if your GTCs transfer the risk to you and the bank has not committed a serious fault, you bear the loss. This is the hypothesis that victims prefer to ignore.
Third stage: Does the bank have a claim for damages against its client for their concurrent fault (Art. 97 para. 1 CO), which it offsets? The client only gets away if the bank’s own fault is serious enough to break the chain of causation (Art. 44 para. 1 and 99 para. 3 CO). Nothing is guaranteed here: the judge assesses on a case-by-case basis.
The 4 million ruling illustrates a favorable outcome. In ATF 146 III 387 (TF 4A_178/2019 of August 6, 2020), an employee of a company, holding a collective signature by two, falls victim to CEO fraud; falsified orders are sent by email, outside the agreed method. No risk transfer clause in this case. The Federal Supreme Court rules that the serious fault of the bank and its auxiliaries breaks the causation, and orders the institution to reimburse EUR 4,041,537.61, with 5% interest from October 16, 2014. A spectacular decision, but one that hinges on its facts: absence of a risk clause, characterized banking fault.
The specific trap of the fake advisor
Here, we must be frank, because the transposition is not mechanical. The major rulings primarily concern falsified orders or orders placed outside procedure by a third party. In the fake advisor scenario, the victim authenticates the operation themselves. They enter, they validate, they confirm. The “no mandate” argument becomes more delicate: formally, the order originates from the client.
Nevertheless, the angle exists, and it is solid when the facts lend themselves to it. A will extracted under duress, by usurpation of the bank’s identity and control of the device, is not a free will. Above all, the most rewarding ground is rarely the first stage. It is the second and third: the bank’s serious fault. Because in most of these cases, the operation presented signals that the institution could not ignore. Amounts disproportionate to the account’s history. Unknown beneficiaries, recently formed companies, high-risk jurisdictions. Rapid-fire orders where the account was dormant. Account holder whose profile called for increased vigilance.
Faced with unusual operations, the bank must clarify, and serious clarification is not limited to a call on a line that the fraudster may already control. In a recent case, a local bank had itself identified signs of fraud before executing the transfers, then executed them anyway. This admission, once in the file, is golden: it establishes that the detection system was working, and that inaction constitutes serious fault.
The red flags of serious fault a bank should not miss
Case law and practice look to a series of warning signs when assessing serious fault. The more they accumulate, the more compelling the bank’s duty to clarify becomes, and the heavier execution without reaction weighs. They fall usefully into four families.
Transaction anomalies. Amounts out of step with the account’s history, rapid-fire transfers on a usually quiet account, operations at unusual hours, structuring designed to slip below control thresholds.
Geographic anomalies. Beneficiary located in a jurisdiction with no connection to the client, or one known for money-laundering exposure; destination account recently opened; beneficiary company newly incorporated.
Technical anomalies. Login from a device or location never seen before, recent installation of remote-control software, a change of contact details shortly before the order.
Profile anomalies. An operation inconsistent with the client’s known financial knowledge and risk profile — the textbook case being an elderly person, unfamiliar with digital tools, suddenly making complex transfers abroad.
No single indicator is decisive. But their convergence is precisely what builds the case: it shifts the debate away from the client’s own validation, often a losing battle, toward the institution’s serious fault, which is the realistic line of attack.
You are a victim: the right reflexes
Time is working against you. Every hour, the funds cross one more correspondent bank.
Within the hour, cut off e-banking access from a healthy device (not the compromised one), uninstall any software added during the incident, and demand from the bank, on its official number, the freezing of ongoing orders and the activation of a fund recall procedure with the beneficiary banks.
Within two days, file a criminal complaint for fraud (Art. 146 SCC). The criminal route opens tracing and blocking levers that civil law alone does not offer, including international mutual assistance. Keep everything: calling numbers, screenshots, SMS, emails, logs of installed software.
Within one month, file a written objection, by registered mail, within the contractual claim period (often one month from receipt of notice, Art. 6 of usual banking GTCs). And assert your claims on the merits. A formal notice constructed according to the Federal Supreme Court’s framework, and not a letter of grievances, changes the nature of the discussion: it places the bank before a quantifiable procedural risk.
If the bank refuses
Refusal, as a first response, is almost systematic. Several avenues remain open. Civil action for restitution or damages (Art. 97 et seq. CO). Referral to the Banking Ombudsman, which is free but non-binding. And, depending on the case, a report to FINMA regarding organizational obligations and fraud detection systems. This last lever will not get you reimbursed directly, as the authority does not rule on individual disputes, but it sometimes influences the institution’s stance.
Frequently asked questions
Can the bank hold my own mistakes against me?
It almost certainly will. This does not close the debate. If its own fault is serious, typically the failure to react to obvious warning signs, the judge may admit that it breaks the chain of causation and relegates your imprudence to the background. May, not must: it is an assessment.
What is the deadline to react?
The contractual claim period is generally one month from receipt of notice (Art. 6 of usual GTCs). Beyond that, legal action remains open (the ordinary contractual limitation period is ten years), but the balance of power deteriorates. Act quickly.
Should I file a complaint even if the bank agrees to discuss?
Yes. Criminal proceedings provide access to blocking and tracing tools that civil law does not, and it documents your good faith.
Legal basis and case law
Contractual liability and concurrent fault: art. 97(1), 99(3) and 44(1) CO. Risk-transfer clause and serious fault: art. 100(1) CO. Fraud: art. 146 SCC.
Leading Federal Supreme Court decisions: ATF 146 III 121 (general framework for risk allocation), ATF 146 III 326 (fraudulent orders by email and risk-transfer clause), ATF 146 III 387 / TF 4A_178/2019 of 6 August 2020 (CEO fraud, interruption of the causal link by the bank’s serious fault).
On this type of case
These cases are won at the intersection of civil law (restitution) and criminal law (tracing), often in the urgency of the first few days. This is the working approach of Sentinel Legal, which intervenes in banking law and economic criminal procedure. To present a situation: +41 22 512 76 00 or via the contact form.
This article is purely informative and does not constitute legal advice. Each situation requires its own analysis; for a specific case, consult a lawyer.