How to Recover Funds After a Bank Transfer (APP) Fraud in Italy (2026): Bank Liability, Refunds & Legal Steps

Bank transfer fraud italy claims have surged into sharper regulatory focus in 2026, driven by tighter scrutiny of how banks authenticate payments and by a line of court decisions that are reshaping bank liability for authorised push payment (APP) fraud. This guide gives victims, corporate finance teams, in-house counsel and litigators a practical, step-by-step roadmap for recovering diverted funds, from the first 48 hours through to provisional freezing measures, civil proceedings and cross-border enforcement. It sets out who to notify, what to preserve, what each stage broadly involves, how long it realistically takes and where the pitfalls lie. The regulatory and judicial developments of recent years make swift, well-documented action more valuable than ever.

Overview: What is APP (Authorized Push Payment) Fraud and How Transfers Are Processed in Italy

Authorized push payment fraud occurs when a payer is deceived into instructing their own bank to send money to an account controlled by a fraudster. Because the payment is technically “authorised” by the customer, it differs fundamentally from a classic unauthorised transaction where credentials are stolen and used without any involvement by the account holder. That distinction drives almost every question of bank liability for fraud and determines which legal route offers the best prospect of recovery.

Definition and common APP fraud scenarios

APP fraud typically presents in a handful of recurring patterns:

• Invoice manipulation (CEO/supplier fraud). A fraudster intercepts or spoofs supplier correspondence and substitutes their own IBAN on a genuine invoice, so a legitimate payment is pushed to the wrong account.
• Phishing and social engineering. The victim is tricked into disclosing credentials or approving a payment through a fake call, email or SMS impersonating the bank or a trusted counterparty.
• Account takeover. The fraudster gains control of online banking access and initiates transfers that the genuine customer did not authorise, straddling the line between APP and unauthorised transaction categories.

How transfers work in Italy

Most euro transfers run through the SEPA framework, with interbank clearing that can make funds available to a recipient quickly, and, in the case of instant credit transfers, within seconds. Once the money reaches a receiving account and is onward-transmitted, frequently to accounts outside Italy, practical recovery becomes far harder. This is why speed is the single most important factor in any bank transfer fraud italy matter: the window to freeze funds before they dissipate is often measured in hours, not days. The legal obligations of payment service providers across this chain are governed primarily by the revised Payment Services Directive (Directive (EU) 2015/2366, “PSD2”) and its Italian transposition (principally through amendments to Legislative Decree No.

11/2010 and the Consolidated Banking Act, Legislative Decree No. 385/1993).

Eligibility: Who Can Claim, Consumers vs Corporates, Banks vs Payment Institutions

Before choosing a recovery route, establish who you are in the eyes of the law, because the protections differ sharply.

PSD2 protections, consumer default rules vs corporate carve-outs

PSD2 sets reimbursement rules for unauthorised payment transactions and imposes strong customer authentication (SCA) obligations on payment service providers. Those protections are most generous to consumers. For business users, PSD2 permits the parties to contract out of several protective provisions, so corporate payment agreements frequently allocate more risk to the customer. In an APP scenario, where the customer did authorise the transfer, the analysis turns less on the unauthorised-transaction rules and more on whether the provider met its authentication and fraud-detection duties.

Practical difference for in-house finance teams

For corporates, the evidentiary standard is higher and contractual clauses matter enormously. In-house counsel should locate the online banking agreement, any liability-allocation terms and the internal authorisation workflow before deciding whether to argue breach of the bank’s duties or pursue the fraudster directly. Recent case law has in some instances scrutinised corporate carve-outs more closely, but outcomes remain fact-specific. Addressing a potential bank transfer fraud italy claim as a corporate claimant therefore demands careful reading of the contract alongside the regulatory baseline.

Step-by-Step: How to Pursue Recovery After Bank Transfer Fraud in Italy

The sequence below is designed to run several workstreams in parallel. Preservation, bank notification and provisional relief are time-critical; escalation and civil proceedings follow. Treat the first two days as decisive.

Step 1, Immediate operational steps (0–48 hours)

Act within hours. Contact the bank’s emergency fraud line immediately and ask it to attempt a recall of the SEPA transfer and to flag the beneficiary account. Internally, freeze any accounts or payment approvals that may be compromised, and instruct IT to preserve server logs, device access records and email headers before anything is overwritten. Collect the transaction unique identifiers, IBANs, amounts and precise timestamps. Every hour counts: the sooner the receiving bank is alerted, the better the chance the funds are still in the first-tier account.

Step 2, Bank complaint and formal refund request (48 hours–7 days)

Submit a formal written complaint to the bank’s complaints office (ufficio reclami). Companies should use certified email (PEC) to create a dated, legally valid record; individuals should use registered mail with acknowledgement of receipt. State the facts, attach the transaction evidence, request provisional credit or a refund for the fraudulent transfer, and set out the legal basis, including the bank’s authentication and fraud-monitoring obligations under PSD2 and its Italian implementation. Request the bank’s SEPA/SWIFT transaction file and set out the response you expect. Record every complaint reference number. Banks are generally required to respond to complaints within the timeframe set by applicable Bank of Italy rules.

Step 3, Escalate to the Ombudsman, conciliation and the Bank of Italy (after the bank’s response)

If the bank refuses or fails to resolve the complaint, escalate to the Arbitro Bancario Finanziario (ABF), the banking and financial ombudsman established within the Bank of Italy framework, or use available conciliation channels (including the Organismo di Conciliazione Bancaria / Conciliatore BancarioFinanziario for mediation). Before applying to the ABF, you must generally have first submitted a complaint to the bank and allowed the applicable period for a reply to elapse. ABF decisions are low-cost and comparatively fast, and while not directly enforceable like a judgment, non-compliance is published and carries reputational consequences for the bank. The Bank of Italy publishes the complaint and mediation channels available to consumers and businesses.

This route is particularly valuable in a consumer-facing bank transfer fraud italy dispute, and can also be relevant for smaller claims within the ABF’s monetary competence.

Step 4, File a criminal report (denuncia) and police cooperation

File a denuncia with the police (for example the Polizia Postale, which handles cyber and payment fraud) or the public prosecutor as early as possible. The criminal report serves two purposes: it triggers investigative powers that can trace and freeze criminally-controlled accounts, and it generates evidence, IP logs, beneficiary identity data, bank cooperation, that strengthens the parallel civil claim. A criminal report does not substitute for civil recovery, but it is often the fastest route to immobilising the stolen money while civil measures are prepared.

Step 5, Seek provisional relief (freezing order / interim measures)

Where there is a real risk the funds will be dissipated, apply for provisional measures without delay. The principal civil tool is the sequestro conservativo (conservative seizure), which freezes assets to preserve the position pending judgment, available where the applicant shows both a plausible claim (fumus boni iuris) and a risk to recovery (periculum in mora). Urgent relief under Article 700 of the Code of Civil Procedure and an ordine di esibizione (order for production of documents) can also be sought. In cases of genuine urgency and demonstrable risk of dissipation, courts can grant relief inaudita altera parte, with a confirmation hearing to follow.

For SEPA transfers that have crossed borders, consider the European Account Preservation Order (Regulation (EU) No 655/2014) and choose the forum carefully, since speed and reach vary. Provisional relief is frequently the decisive moment in any bank transfer fraud italy recovery effort.

Step 6, Start a civil claim against the bank or third party

If liability is denied, commence civil proceedings. The available legal theories typically include:

• Bank liability for inadequate authentication. The provider failed to apply strong customer authentication or to detect patterns that should have flagged the transaction as suspicious.
• Contractual breach. The bank breached express or implied duties under the banking contract or the regulatory framework transposing PSD2.
• Third-party recovery. Claims directly against the fraudster or the beneficiary, including unjust enrichment (arricchimento senza causa), where the recipient has no legitimate entitlement to the funds.

Pleadings are usually filed within weeks to months of instructing counsel, but a substantive hearing and judgment in ordinary proceedings can take from several months to years depending on the court and complexity.

Step 7, Enforcement and recovery (post-judgment)

A favourable judgment is only as good as its enforcement. Options include attachment of the defendant’s funds (pignoramento), recognition and enforcement of the Italian judgment in other EU member states under the Brussels I Recast Regulation (Regulation (EU) No 1215/2012), and tracing supported by forensic banking analysis to follow the money through layered accounts. Engaging forensic accountants early, ideally at Step 1, makes later tracing far more effective.

Required Documents and Evidence Preservation

Recovery stands or falls on the quality and completeness of the evidence assembled in the first days. Preserve electronic logs in their native format, keep contracts and authorisation records intact, and never edit communications, because metadata is frequently decisive. Engage a forensic provider quickly where account takeover is suspected, and obtain written confirmation from the bank of the identity and authentication checks it carried out. The table below sets out what to gather and why.

Timeline and Deadlines, Limitation Periods and Urgent Measures

Two clocks run in parallel: the short, practical clock governing fund dissipation and urgent relief, and the longer legal clock governing limitation periods.

• Civil limitation. Under the Italian Civil Code, the ordinary limitation period is ten years, but shorter prescription terms apply to particular causes of action (for example, the five-year period for tort/extra-contractual liability). The applicable period also depends on the specific duties invoked under the payment-services framework. Because the correct period is fact-specific and depends on how the claim is framed, instruct counsel to confirm the applicable prescription term for your claim rather than assuming the ten-year default applies.
• Notification of unauthorised transactions. Under the PSD2 framework, a payment service user who becomes aware of an unauthorised or incorrectly executed transaction must notify the provider without undue delay to preserve reimbursement rights. Check the exact position with counsel for your transaction type.
• Administrative and ABF deadlines. Escalation to the ombudsman and complaints are subject to their own procedural time limits; check the current ABF rules before relying on this route.
• Urgency. Provisional measures should be sought immediately where there is a risk the funds will be moved on. Freezing relief can be requested inaudita altera parte in appropriate cases, and delay is often the reason recovery fails.

The practical lesson in any bank transfer fraud italy case is that limitation rarely bites in time; dissipation does. Move on preservation and freezing first, and let counsel manage the prescription analysis in parallel.

Costs and Fees, What Recovery Realistically Involves

Budget for several cost components: external counsel, forensic IT and banking tracing, court filing fees (the contributo unificato, scaled to claim value), possible security or cauzione for provisional measures, enforcement costs, and translation or legalisation where the matter crosses borders. Many of these costs may be recoverable on success, but recovery is often partial, so plan on carrying them initially. The figures below are broad, indicative ranges only, actual costs vary significantly with claim value and complexity, and counsel’s fees should be agreed in writing in line with professional rules.

What Changes in 2026 for Bank Transfer Fraud Italy Claims

Several shifts define the current landscape. First, regulators continue to intensify scrutiny of how banks detect and respond to APP fraud, with renewed attention to the adequacy of strong customer authentication and real-time fraud monitoring. Second, the EBA’s guidelines and regulatory technical standards on payment services (including those on SCA and secure communication) set the expectations against which a bank’s conduct is measured, and reforms to the EU payments framework (the proposed PSD3 and a Payment Services Regulation) remain under negotiation at EU level and should be monitored.

Third, Corte di Cassazione jurisprudence has addressed the standard for bank liability in payment-fraud cases, including the allocation of the burden of proof and the diligence expected of a professional operator, in some instances holding banks accountable where authentication was deficient or where the fraud ought reasonably to have been detected.

The practical effect is that well-evidenced claims alleging authentication and monitoring failures can carry significant weight, and banks may face greater difficulty defending transfers that bypassed meaningful fraud controls. Claimants should frame their complaints and pleadings expressly against these authentication and monitoring duties. Where a specific Cassazione decision is relied on, confirm the case number and holding against the official text before citing it.

Comparison: Refund Routes for Bank Transfer Fraud Italy Recovery

Note the limited role of a chargeback here. Chargeback remedies apply to card-based payments, not to push credit transfers, so they are generally unavailable for classic APP fraud. Do not rely on a chargeback route for a transfer, pursue the bank refund, ABF escalation, criminal cooperation and civil claim instead.

Common Pitfalls and How to Avoid Them

• Late preservation of logs. Delaying IT preservation allows access records and metadata to be overwritten; secure them in the first hours.
• Inadequate complaint formality. Complaints sent by ordinary email instead of PEC or registered mail create evidential gaps; always use a dated, verifiable channel.
• Failing to seek provisional relief fast. Hesitating over a freezing application lets funds dissipate beyond reach; file urgently where risk exists.
• Overreliance on chargebacks. Chargeback remedies do not cover credit transfers; pursuing them wastes critical time.
• Ignoring contractual waiver clauses. Corporate banking contracts may allocate risk away from the bank; read them before choosing a theory of liability.
• Mishandling evidence. Editing emails or screenshots destroys metadata and undermines credibility; preserve originals untouched.

Practical Templates and Annexes

To support rapid action, prepare a standard PEC bank complaint letter, a police report (denuncia) checklist, a provisional-measures application checklist and an evidence preservation checklist. Having these ready-drafted removes hours of delay at the moment delay is most damaging.

Conclusion and Next Steps

Recovering money after bank transfer fraud italy is achievable, but only with disciplined, parallel action: preserve the evidence, notify the bank in writing by PEC, file the denuncia, seek provisional freezing relief where funds are at risk, consider ABF or conciliation, and instruct litigation counsel to pursue the civil claim and enforcement. The regulatory and judicial developments of recent years have strengthened the position of well-documented claimants against banks that fail their authentication and monitoring duties, but the advantage belongs to those who move fast and record everything. Treat the first 48 hours of any bank transfer fraud italy matter as the decisive window, and build the rest of the strategy from there.

For related guidance, see Litigation in Italy, judicial reform & case timetables. Supporting resources on freezing orders and precautionary measures, PSD2 and bank liability, internal fraud investigations, using the ABF to resolve bank complaints, and cross-border enforcement of Italian judgments form part of this cluster and will be linked as they are published.

Sources

1. EUR-Lex, Directive (EU) 2015/2366 (PSD2)
2. European Commission, Payment Services
3. European Banking Authority (EBA)
4. Bank of Italy, consumer protection & banking supervision
5. Arbitro Bancario Finanziario (ABF)
6. Normattiva, Italian legislation portal
7. Gazzetta Ufficiale
8. Corte di Cassazione, Supreme Court of Italy