IT Forensics · Private Individuals

How can I have an online banking fraud case investigated using IT forensics?

In the event of an unauthorised bank transfer, the bank usually asks how the login details and authorisation fell into the wrong hands. A technical investigation determines whether, for example, a phishing site, a remote maintenance app, a SIM swap or a newly registered banking app was involved.

Enquire without obligation

Why this question is important for private individuals

Following a digital fraud incident, financial loss, time pressure and technical uncertainty all come into play. A well-structured investigation can help to organise the available evidence and distinguish between assumptions and events that can actually be substantiated.

Technical background

Common tactics include fake bank text messages containing links, phone calls from people claiming to be bank staff asking you to install remote support software (e.g. AnyDesk, TeamViewer), and registering a new Push-TAN app on someone else’s device. Each pattern leaves different traces.

Relevant evidence and data sources

• Text messages, emails and call logs for the period
• Browser history and phishing domains visited
• Signs of installation and use of remote maintenance apps
• Banking app data, Push-TAN registrations, notifications
• Bank statements and transaction details (provided by you)

Borders

• Whether a payment was legally authorised and who is liable is determined by the bank, the ombudsman’s office or the court.
• The Bank’s Server logs are only accessible via the Bank.

Possible results

• Phishing site or remote access verified by time stamp
• Evidence of the registration of a third-party TAN device
• No trace found on the devices examined (suggesting other means)

Why LanCologne?

In cases of digital fraud, it is not just the fact that money is missing that matters. To establish the facts, it must be clarified which technical sequence of events can actually be verified: Was a phishing page opened?

Here’s how we do it

• Record the timeframe and sequence of events from your perspective.
• Back up your smartphone and computer before deleting any apps.
• Traces correlate with the booking dates.
• Report for a bank, the police or a solicitor.

Not every fraudulent payment means that the device has been hacked

Phishing, social engineering, stolen login credentials, compromised sessions and an actual device infection are technically distinct scenarios. We examine these possibilities separately and only explain the sequence of events as a finding that is supported by the available data.

Rapid damage control is a priority

If unauthorised transactions or account misuse are still taking place, the bank, payment service provider, card and affected accounts should be secured without delay. A forensic investigation will be planned around this; it must not artificially prolong any further damage that could be avoided.

Why LanCologne following a digital scam?

LanCologne does not attempt to spin a financial loss into the most dramatic account of an attack possible. We reconstruct the technically verifiable steps, document original sources and the limitations of witness statements, and present the findings in such a way that they remain understandable to the client whilst remaining technically comprehensible to lawyers, banks, insurance companies or investigating authorities.

Depending on the circumstances, different criminal law provisions may be relevant. Section 263 of the German Criminal Code (StGB) concerns fraud, and Section 263a of the StGB concerns computer fraud. Section 263a covers, amongst other things, financial losses resulting from the manipulation of a data-processing operation, for example through the unauthorised use of data. Which provision applies in a specific case is a legal question and is not decided by the IT forensic expert.

In the case of compromised accounts, Sections 202a et seq. of the German Criminal Code (StGB) may also be relevant. In the case of manipulated digital evidence, Section 269 of the StGB – which deals with the forgery of evidence-relevant data – may be particularly relevant, provided the legal requirements are met. However, the technical finding that a file or message has been altered does not automatically establish all the elements of the offence or the identity of the perpetrator.

For those affected, the priority following an ongoing fraud is to minimise the damage. The police and the BSI recommend taking swift protective measures in the event of hacked accounts or phishing, whilst at the same time documenting relevant digital evidence. A forensic investigation must not delay the necessary blocking of accounts, cards or payment methods.

In cases of disputed payments, issues relating to civil law and payment services law may also be relevant. Whether a payment was authorised, whether duties of care were breached or whether there is a claim for a refund must be assessed from a legal perspective. LanCologne can investigate the technical facts and chronology of events in this regard, but it does not replace legal advice and does not determine whether a refund is due.

A privately commissioned IT forensic report can document technical details in a way that is understandable to lawyers, banks, insurance companies or investigating authorities. It does not replace the investigative powers of the authorities, nor does it replace a court’s assessment of the evidence.

Frequently Asked Questions

Related topics

• How can I find out whether my login details have actually been used following a phishing attack?
• How can a private IT forensic report following online fraud help my solicitor, my bank or the police?
• How can I digitally document a fake online shop scam for the police, my bank or a solicitor?
• IT Forensics for Private Individuals

LanCologne – IT Forensics for Private Individuals

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now