Solaris SE faces escalating legal scrutiny after taking over ADAC credit card issuance in September 2024, as numerous cardholders report unauthorized transactions on their monthly statements. According to reports by anwalt.de, affected customers face mounting charges—including a February 2025 case totaling roughly 4,130 euros—while the digital bank maintains that its systems properly authenticated the payments.
The dispute centers on conflicting interpretations of technical security protocols and statutory liability under German consumer protection law. While Solaris points to automated risk assessments and 3-D Secure verifications, legal experts note that automated computer logs do not automatically prove customer negligence when transactions are contested.
Disputed Transactions and the Burden of Proof Under German Law
When cardholders dispute a transaction, Section 675w of the German Civil Code (Bürgerliches Gesetzbuch) dictates that the bank must prove the transaction was authorized, rather than requiring the customer to prove their innocence. Solaris frequently relies on 3-D Secure protocols to assert that transactions were properly authorized or classified as low risk. Alternatively, the fintech has argued that customers fell victim to external phishing attacks via fraudulent replicas of ADAC login pages.
German courts have established strict precedents regarding how banks utilize automated system logs. In a ruling on January 26, 2016 (Case No. XI ZR 91/14), the Federal Court of Justice (Bundesgerichtshof) held that a clean transaction log does not inherently establish gross negligence on the part of the customer. However, courts can apply a prima facie evidence standard if the security system is proven to function correctly without known flaws, shifting the evidentiary burden back to the consumer to provide a plausible alternative explanation.
The SIM-Swap Defense Against Automated Protocols
To counter the bank’s reliance on system logs, legal representatives for affected cardholders have introduced SIM-swap scenarios as an alternative explanation for unauthorized charges. In a SIM-swap attack, bad actors gather basic personal details—such as a victim’s name, address, and date of birth—to obtain a replacement SIM card or port the victim’s mobile number to a new carrier. Once executed, two-factor authentication SMS messages and app confirmations route directly to the perpetrator without the cardholder ever interacting with a phishing website.
Recent court decisions illustrate how judges weigh these competing arguments. Regional courts, including the Higher Regional Court of Frankfurt on September 22, 2023 (Case No. 3 U 84/23) and the Higher Regional Court of Munich on September 4, 2023 (Case No. 19 U 1508/23e), previously found customers grossly negligent when they actively surrendered transaction authentication numbers or login credentials. Conversely, rulings such as a January 21, 2025 decision by the Munich Local Court (Case No. 222 C 15098/24) highlight that courts closely scrutinize how authentication data reached perpetrators when phishing claims lack direct evidence of customer interaction.
Consumer Protection Challenges and Legal Recommendations
Parallel legal actions from consumer advocacy groups are compounding regulatory pressures on the digital bank. The Consumer Protection Center of Baden-Württemberg (Verbraucherzentrale Baden-Württemberg) initiated legal proceedings against Solaris at the Berlin II Regional Court (Case No. 97 O 83/25) to challenge the practice of demanding disputed payments under threat of card cancellation. A prior related action dismissed by the Berlin II Regional Court on November 25, 2025 (Case No. 103 O 49/25) is currently moving through appellate review at the Berlin Higher Regional Court (Case No. 5 U 2/26).
Legal counsel advising affected consumers urge patience before accepting settlement offers. Attorneys emphasize that standard bank protocols only confirm that a device authorized a payment, not necessarily whose device executed the command. Accepting early settlement agreements can permanently forfeit valid claims that hold greater financial value upon closer judicial inspection.
Frequently Asked Questions
- What immediate steps should cardholders take after discovering unauthorized charges? Consumers must dispute the transaction in writing immediately via the official reclamation form, secure written delivery confirmation, preserve all transaction logs and correspondence, and file a formal police report.
- How do investigators determine if a SIM-swap occurred rather than a phishing attack? Affected individuals who notice their mobile device losing network connectivity for an extended period should contact their mobile carrier directly to verify whether an unauthorized replacement SIM card was activated or their phone number was ported.
- Why do legal experts advise against accepting early settlement offers from Solaris? Attorneys note that automated bank records alone do not definitively prove the customer’s identity during authentication, meaning preliminary settlement proposals often undervalue the merits of the consumer’s case.
Next Court Dates and Procedural Timelines
The ongoing appeal regarding card cancellation threats during disputed transactions remains pending at the Berlin Higher Regional Court under Case No. 5 U 2/26.
