Phishing and payment fraud in Belgium: who refunds, who proves what, what to do?

This post is also available in:

Updated 16 October 2026.

A text message from “the bank”, a fake adviser on the phone, a link to a page that looks exactly like the usual banking app. Minutes later, the account is empty. The first question is always the same: will the bank pay it back?

The answer depends on three things: whether the payment was authorised, how the customer behaved, and what each side can prove. This guide sets out the Belgian rules and links to our detailed analyses on each point.

Phishing, vishing, spoofing: which frauds are we talking about?

Phishing is a fake message (e-mail, text, WhatsApp) designed to obtain login details or codes. Vishing is the phone version: a fake bank employee calls and guides the victim. Spoofing means using the bank’s real phone number or e-mail address, which makes the contact highly credible.

Other frauds work differently. In invoice fraud, the IBAN is replaced and the customer knowingly pays the wrong account. In investment fraud (“boiler rooms”), the victim transfers savings to a fictitious firm. These distinctions determine which rules apply.

Which rules apply to payment fraud in Belgium?

The rules are in Book VII of the Belgian Code of Economic Law (CEL), which implements the second Payment Services Directive (PSD2):

• Article VII.32: a payment is authorised when the payer consented in the form and under the procedure agreed with the bank;
• Article VII.38: the customer’s obligations (use the payment instrument as agreed, keep security credentials safe, report loss, theft or misuse without delay);
• Article VII.41: a disputed payment must be reported without undue delay and no later than thirteen months after the debit;
• Article VII.42: burden of proof;
• Article VII.43: immediate refund of an unauthorised payment;
• Article VII.44: final allocation of the loss.

These rules are mandatory for consumers. For businesses, some of them can be varied by contract.

Authorised or unauthorised: where everything starts

Only an unauthorised payment gives a right to a refund. If the payment was authorised, the bank in principle owes nothing, even if the customer was deceived about where the money was going.

The law provides that use of the payment instrument (card, code, itsme, card reader, app) is not necessarily sufficient in itself to prove authorisation. It does not say that it is never sufficient. And a disputed payment is not unauthorised for that reason alone.

In vishing cases, the fraudster often has the customer confirm a transfer in the app himself. Several Belgian courts have held that a customer who confirms a payment through the agreed procedure authorises it, even when deceived. We support this objective view of consent.

Further reading:

• CJEU C-70/25: “refund first” before the Belgian courts
• Phishing: recent Belgian case law

Must the bank refund a phishing victim immediately?

Yes, if the payment was unauthorised. The bank must refund by the end of the next business day.

The only exception is a suspicion of fraud by the customer, reported in writing by the bank to the Federal Public Service Economy. Gross negligence does not fall under this exception: it is dealt with at a later stage.

The Court of Justice confirmed this on 15 October 2026 (C-70/25). The bank refunds first and may then claim the loss back through legal proceedings. The judgment says nothing about when a payment should be treated as unauthorised, which is where most disputes are now fought.

Refunding first does not mean paying for good.

Further reading:

• CJEU C-70/25: refund first
• Banking phishing: is the bank the temporary financier of uncertainty?

Who bears the loss in the end? Gross negligence

Before reporting, the customer’s share is in principle capped at 50 euros, subject to statutory exceptions. After reporting, the customer in principle bears no further loss, unless he acted fraudulently.

The customer bears the entire loss if he acted fraudulently or failed, intentionally or through gross negligence, to meet his obligations under Article VII.38. The law gives two examples: writing down codes in an easily recognisable form, and failing to report loss or theft without delay.

On 29 June 2026, the Court of Cassation defined gross negligence as conduct that a reasonable and normally prudent payer would never have adopted, linked to a specific obligation under Article VII.38. The Court did not hold that the customer in that case was not grossly negligent: it quashed reasoning it found insufficient and referred the case to the Antwerp Court of Appeal.

Courts have found gross negligence where the customer gave codes to a stranger on the phone, went ahead with a transaction he himself found suspicious, ignored a bank notification about a new device being activated, or chose a PIN based on his phone number. In 2020, the Antwerp Court of Appeal held that the victim’s age is not taken into account.

Further reading:

• The bank is not an automatic insurer against phishing
• Does the client’s age matter?
• Ignoring public warnings is negligent
• Lost bank card: who is liable?

Who has to prove what?

When the customer denies authorising a payment, the bank must prove that it was authenticated, accurately recorded and entered in the accounts, without technical breakdown (Article VII.42 CEL).

The customer cannot simply claim to be a victim. The Mons Court of Appeal held that this would impose on the bank a virtually impossible proof. A sworn statement, even with a police complaint, is not enough.

In practice, cases turn on the technical records: device, channel, timing, messages shown to the customer. An account that does not match those records rarely convinces a court.

Victim of fraud: what to do, and how fast?

• Block your cards immediately through Card Stop (+32 78 170 170) and your banking app through your bank’s channel.
• Notify your bank straight away and dispute the transactions in writing. The legal maximum is thirteen months, but late reporting can itself amount to gross negligence.
• File a police report and keep everything: messages, numbers, screenshots, times.
• Forward suspicious messages to suspect@safeonweb.be.
• If the bank refuses, contact its complaints department and then, if needed, Ombudsfin.

Summary proceedings or proceedings on the merits?

On 26 May 2026, the President of the Antwerp Enterprise Court, sitting in summary proceedings, ordered a bank to provisionally refund nearly 50,000 euros, inferring urgency from Article VII.43 itself. We consider this reasoning open to criticism: urgency must be shown on the facts.

The Brussels presidents did not follow. On 9 and 10 June 2026, the French- and Dutch-speaking Brussels Enterprise Courts held that a large loss does not in itself establish urgency.

Another route is an interim measure from the court hearing the merits (Article 19(3) of the Judicial Code). Case law is divided: some courts refuse to decide provisionally what is the very subject of the dispute, others grant an interim payment once the unauthorised nature of the payment is made plausible. The bank can always raise gross negligence on the merits, if need be by counterclaim.

Businesses: the same rules?

Not entirely. With a non-consumer, the bank may agree to disapply certain rules, including those on burden of proof and liability. Businesses should check their account terms first. In CEO fraud or invoice fraud, the business usually gave the payment order itself.

Fake invoice or investment scam: when the customer issued the transfer

A customer who sends a transfer to a fraudulent account in principle authorises the payment. The bank executes it on the basis of the IBAN.

Since 9 October 2025, Verification of Payee (IBAN check) is mandatory in the euro area. The bank compares the name entered with the account holder and warns the customer of a mismatch. A customer who confirms despite the warning bears the risk.

For investment scams, the bank acts as a payment service provider, not an adviser. The French Court of Cassation held on 25 March 2026 that the bank has no duty to warn about the investment itself.

Further reading:

• IBAN check: confirm despite the warning, and the loss is yours
• No duty to warn on investment transfers (French Cass., 25 March 2026)

What will the new EU Payment Services Regulation (PSR) change?

Political agreement on the PSR was reached on 27 November 2025, and the Council published the compromise text on 23 April 2026. On 21 October 2026, the Council adopted its first-reading position, which reflects that compromise. The European Parliament still has to approve it at second reading before signature and publication in the Official Journal. The regulation will apply 21 months after entry into force, probably in 2028.

It adds authorised but refundable payments: bank impersonation using the bank’s own channels, failure of Verification of Payee, and failure of transaction monitoring. For impersonation fraud, the bank will have fifteen business days to refund or give reasons for refusing, which it can only base on the consumer’s fraud or gross negligence.

Telecom operators and very large platforms receive new obligations but are not made liable to victims.

Further reading:

• Payment fraud: the PSR’s layered liability
• Are social media platforms and telecom operators liable?

All our articles on payment fraud

• CJEU C-70/25: refund first (October 2026)
• Platforms and telecom operators (October 2026)
• IBAN check (October 2026)
• The PSR’s layered liability (October 2026)
• Not an automatic insurer against phishing (July 2026)
• The bank as temporary financier of uncertainty? (June 2026)
• No duty to warn (French Cass., 25 March 2026) (April 2026)
• Phishing: recent case law (January 2023)
• Lost bank card and liability (November 2021)
• Client age and perception (May 2021)
• Ignoring public warnings (December 2020)

This guide is general information, not legal advice. Every fraud case depends on its facts and evidence.