In this decision, the Court ruled that the transaction described in the background was not carried out after strong identification of the plaintiff, since she never received any information from the bank about the details of the transaction in question before its completion in order to approve it, and therefore it cannot be accepted that the plaintiff approved the transaction. The bank’s claims that it is not liable under the terms of the banking services agreement, according to which it is not liable for any damage suffered by its customer in the event of unlawful use of its personal access codes to the Internet Banking service by third parties and that the third parties and the plaintiff herself are fully liable for this were rejected. According to the Court, these terms are invalid under the provisions of Article 103 of Law 4537/2018 as they are contrary to the provisions of Articles 71, 73 and 92 of the same Law, which provide for the universal liability of the provider and its exemption only in unusual and unforeseeable circumstances that are beyond the control of the party invoking them and whose consequences could not be avoided despite all efforts to the contrary, and these provisions introduce mandatory law in favor of users, as according to Article 103 of Law 4537/2018, payment service providers are prohibited from deviating from its provisions to the detriment of payment service users, unless the possibility of deviation is expressly provided for, and they may decide to offer only more favorable terms to payment service users, the aforementioned contractual limits do not constitute more favorable but less favorable terms for the payment service user.
Furthermore, the Court ruled, inter alia, that the bank’s liability, beyond that which is contractual and established in the provisions of Law 4537/2018, as an obligation to compensate the plaintiff, is also based on the provision of Article 8 of Law 2251/1994, since the plaintiff’s damage was caused by the bank’s failure to fulfill its obligations in the context of providing its services, but also on the provision of Article 914 of the Civil Code, in the sense of its unlawful and culpable omission to take action.
According to the Court, the bank failed to take the necessary high-security measures, by failing to thoroughly check the authenticity of the account and the alleged beneficiary when processing the order for the transfer of funds in question, preventing the transfer to an unauthorized person, despite realizing that the transaction was suspicious and unusual due to the amount involved, and failing to inform the client immediately and before the transaction was completed, by deactivating her account. According to the decision, instead of taking the above actions, the bank referred the plaintiff from department to department and finally instructed her to go to a physical branch, which was possible after two days since the incident took place on a Saturday, in order to submit a transaction dispute form, while refusing to provide information on the progress of the money, as it still does today, since its proposals do not justify why, since she was informed within a few minutes and the transfer in question was made to an account held by her, it was not possible to prevent or cancel the transaction and return the money to the plaintiff. Her conduct, in addition to being culpable, constituting gross negligence on her part, is also unlawful, since even without the contractual relationship being in place, it would be unlawful as contrary to the provisions of Law 4537/2018 and Law 2251/1994, linked to the lack of security of services that consumers are entitled to expect, as well as to the building of trust, which is essential in banking transactions, elements that it is obliged to offer within the scope of the services it provides, but also contrary to the principles of good faith and fair dealing, in accordance with the provisions of Articles 288AK and 914AK, and resulted, in addition to the positive damage to the plaintiff, in causing her moral damage.