Deep-Link Payment Redirection Fraud - The €700 Link That Empties Account

Deep-Link Redirection = Fraudster sends you link that looks like sales platform / courier / bank, you click, it deep-links to fake payment page that looks exactly like your bank, you enter credentials, fraudster uses them to authorize real payment to mule account.

This is #1 payment fraud in EU 2024-25 - 75% of phishing losses involve customers tricked into authorizing payments via deep-link.

1. How It Works - The Kleinanzeigen / Wallapop Pattern

Step 1 - Hook: Victim selling item on Wallapop, Milanuncios, Kleinanzeigen, Vinted. Buyer contacts: "I bought, click link to receive payment" or "Courier will pay, click to confirm".

Step 2 - Deep Link: Link is https://wallapop-secure-payments.com or https://correos-track-pay.link - looks real, uses platform logo. Page says "Enter bank to receive €500".

Step 3 - Cloning: Page clones bank login - Santander, BBVA, CaixaBank. Victim enters user, password, OTP. Page shows "Payment received".

Step 4 - Real Theft: In background, fraudster uses stolen credentials to initiate real transfer via bank's API - e.g., €700 to mule account. Bank sends OTP, fraudster asks victim "Enter OTP to confirm receipt" - victim enters OTP thinking it's receipt, but it's actually authorization for transfer.

Result: Payment is authorized by victim (APP fraud - Authorized Push Payment) - not unauthorized - so PSD2 protection weaker.

This type of fraud is referred to as authorised push payment fraud (APP fraud), because PSU himself has authorised payment transaction. Notably, current EU PSD2 provides PSP is liable in case of unauthorised payments, unless PSU failed with intent or gross negligence. However, in case of APP fraud, there is no provision in PSD2.

This gap is why liability disputes explode.

2. Liability - Who Pays? - EU vs UK vs Spain vs India

A. EU / Spain - PSD2 + CJEU C-70/25 + RD 19/2018

EU Top Court Rule: Banks Must Promptly Refund Phishing Losses Even When They Claim Customer Negligence.

Case - Polish Woman Selling Online - CJEU C-70/25 - The Deep-Link Case That Changed EU:

Dispute began in Poland. Customer selling item on online sales platform when supposed buyer sent her link that appeared to come from platform and claimed to confirm sale. Link led to fake website made to look like her bank's site. She entered online banking login details there, and fraudster used them to transfer sum equal to about 700 euros out of account.

Bank refused refund citing gross negligence - she clicked link.

CJEU Held:

• Even if customer showed gross negligence, bank cannot refuse immediate reimbursement if fraud reported promptly. Refund must be immediate, within next business day.
• Negligence question moves to separate civil process where bank bears burden of proving gross negligence.
• Deep-link fraud is unauthorised transaction under Art 62 PSD2 if bank cannot prove SCA was performed with customer's genuine consent.

Spain transposes same via Art 45 RD 19/2018 - nearly objective liability.

Spanish Supreme Court Doctrine:

• Banks liable for unauthorised transactions resulting from digital fraud such as phishing or SIM swapping unless they can demonstrate gross negligence on part of customer.
• Banks can no longer dodge responsibility - financial institutions liable for unauthorised transactions, as long as customer not negligent and reported suspicious activity promptly.

What is Gross Negligence in Deep-Link?

Spanish courts say:

NOT gross negligence: Clicking link from buyer on sales platform - many consumers do it, platform doesn't warn enough.

IS gross negligence:

• Delhi HC parallel: Customer clicking suspicious links despite warnings can't blame bank - Customer can be termed negligent if he does not heed bank's warnings against clicking suspicious links. Expression 'such as where he has shared payment credentials' is illustrative not exhaustive.

Spanish Provincial Court:

• In Context of Online Banking Fraud Cases, decisive was he followed link sent outside Kleinanzeigen communication system and entered personal credit card details there, despite being in role of payment recipient. This alone should have raised strong suspicion of fraud.

So test: If you are SELLER, you should never need to enter card details to RECEIVE money. Entering credentials as recipient = strong suspicion = may be gross negligence.

But still, bank must refund first, argue negligence later.

B. UK - Philipp v Barclays - Supreme Court July 13, 2023

Facts: Mrs Philipp victim of APP fraud, authorised two payments £700k to fraudster posing as NCA. Barclays executed.

UKSC Held: Bank was not liable to reimburse push payment fraud even if bank had reasonable grounds for believing fraud was being committed. Bank's duty is to promptly execute clear payment instructions. Duty to verify does not apply where customer clearly authorised payment.

Result: Under common law, victim bears loss.

But UK changed law after: Financial Services and Markets Act 2023 mandates full reimbursement for APP fraud victims starting Oct 2024 - sending and receiving banks split 50/50, must reimburse within 5 business days. Shift in liability from consumers to financial institutions sets global precedent.

Spain】 does NOT have mandatory APP reimbursement yet - only unauthorised. So deep-link APP fraud falls in grey.

C. India - RBI Circular 6 July 2017 - Customer Protection

Bombay High Court allows writ in cyber fraud - directs bank to refund Rs 76.9 lakhs under RBI circular. Unauthorized addition of beneficiaries and absence of OTP constitute deficiency.

Delhi HC two contradictory rulings:

• 2024: Delhi HC directs SBI to compensate customer in cyber fraud - banking transactions are both contractual and fiduciary - victim academic aged 55, vishing attack.
• 2025: Delhi HC says customers clicking suspicious links cannot automatically blame banks - Customer negligent by sharing payment credentials - has to bear entire loss until fraud reported to bank. Bench ruled customer can be termed negligent if he does not heed warnings.

Karnataka HC Aug 2026: SBI to refund Rs 1.99 lakh to 71-year-old - online banking made convenient but created opportunities via fake apps, fraudulent links.

Test in India: Clause 7 of RBI circular - If customer shares credentials, liability is customer's till report. If bank fails to have 2FA, bank liable.

3. Deep-Link Specific Case Laws

Case 1 - EU - Kleinanzeigen Deep-Link - Schleswig-Holstein Higher Regional Court - Germany 2024

Buyer sends link outside Kleinanzeigen system, seller enters card details as recipient. Court rejected appeal - seller gross negligent because as payment recipient, you never need to enter card details. Bank not liable for APP fraud. But receiving bank liable if didn't check name mismatch.

Case 2 - India - Kerala HC - SBI to Pay Rs 3.73 Lakh - SMS with URL Link

Retired teacher received SMS stating account blocked, clicked link, lost Rs 3.73 lakh. HC directed SBI to make good loss within 4 weeks, setting aside ombudsman order. Held SMS with URL link that when clicked compromises device - bank should have detected new device login, IP mismatch - deficiency.

Case 3 - Spain - BBVA IP Mismatch Case - Applied to Deep-Link

Factual element determining conviction of BBVA was inability to demonstrate fraudulent operation carried out from customer's usual IP address because bank must exercise great level of diligence when transaction occurs from IP not usual - clear signal.

Deep-link fraud always from new IP/device - fraudster's device in Nigeria, etc. If bank doesn't trigger step-up authentication when IP not usual, bank liable even if customer clicked link.

4. Governance - How Bank Must Prevent Deep-Link Redirection

To Avoid Liability, Spanish Bank Must Implement Under EBA/GL/2022/15 + PSD2 SCA:

1. Link Detection: SMS / email filter - warn if link outside whitelisted domains - "Este enlace no es de Wallapop"
2. Confirmation of Payee: Before executing transfer, show beneficiary name - "Vas a enviar €700 a IBAN ES... titular MOHAMED EL... ¿Confirmas?" - EU mandatory from Oct 2025 under Instant Payments Regulation.
3. Behavioral Biometrics: If user who normally receives payments suddenly enters credentials to receive, flag as anomaly - block.
4. Device Binding: Transaction from new device requires additional SCA - not just OTP via SMS (SIM swap) but app-based biometrics.
5. Refund First, Investigate Later: Under CJEU C-70/25, upon notification, refund next business day, then investigate gross negligence.

Liability Split Emerging in EU - PSR 2026:

New Payment Services Regulation (replaces PSD2) introduces mandatory APP reimbursement - sending bank + receiving bank share liability. Spain will transpose by 2026 - then deep-link victims will get 50% refund even if authorised, unless gross negligence proven.

Until then, dispute is:

• Victim argues: Transaction unauthorised because consent vitiated by deception - deepfake link = no valid consent.
• Bank argues: Consent given with SCA, authorised, so APP fraud, not liable.

Courts currently lean victim for unauthorised interpretation if deep-link cloned bank site and OTP intercepted - because customer thought he was authenticating receipt, not payment.