Belgian Banks Face Scrutiny Over Phishing Refund Rules

Some banks in Belgium may be using stricter rules than the law allows when deciding whether to refund customers who lose money to phishing scams.

An investigation by Belgium’s Ministry of Economy found that certain banks include conditions in their general terms that could reduce the legal protection customers are supposed to receive.

The investigation was carried out by the Ministry’s Unfair Contract Terms Commission at the request of Consumer Protection Minister Rob Beenders of the Vooruit party.

The minister wants banks to follow the law and stop using additional conditions that could limit consumers’ rights.

Investigation Finds Stricter Rules at Some Banks

The commission reviewed the general terms and conditions of Belgium’s six largest banks to examine how they handle phishing cases and refund requests.

It found that some banks may be applying stricter requirements than those set out in the law.

The findings come shortly after the European Court of Justice clarified the rules on refunds for unauthorized bank payments.

Under EU payment rules, banks must generally refund unauthorized transactions immediately and no later than the end of the next business day.

There are exceptions. For example, a bank may delay a refund if it has reasonable grounds to suspect fraud by the customer and reports those concerns to the relevant authorities.

However, simply accusing a customer of gross negligence does not automatically allow a bank to refuse a refund.

The bank must be able to prove that the customer acted with gross negligence.

What Counts as Gross Negligence?

One of the main concerns raised by the commission is that some banks appear to use a broad definition of gross negligence in their general terms.

Belgium’s Court of Cassation has described gross negligence as behavior that a reasonably careful person would not normally engage in, or a failure to take precautions that such a person would normally take.

This means banks should not use the term too broadly when deciding whether customers deserve compensation.

Examples of actions that some banks may consider gross negligence include:

•  Sharing a PIN or security code with family members or friends.
• Leaving a bank card unattended or in an unsafe place.

However, the commission believes that some contractual conditions may go beyond what the law allows.

Each case must be assessed based on the circumstances. Banks cannot automatically treat every mistake as gross negligence.

Consumer Protection Minister Calls on Banks to Follow the Law

Consumer Protection Minister Rob Beenders said some banks’ general terms do not appear to comply with legal requirements.

He stressed that banks cannot use their own contractual conditions to reduce the protection consumers receive under the law.

Beenders also wants to discuss the findings with Febelfin, the Belgian banking federation, to make sure banks understand their legal obligations.

He said customers should not have to study complicated banking conditions just to find out whether they can recover money stolen through phishing.

What Does This Mean for Bank Customers in Belgium?

The findings could be important for anyone who uses online banking in Belgium.

If criminals access your account and make payments without your permission, you generally have the right to request a refund from your bank.

Under EU rules, the bank must normally return the money by the end of the next business day after being notified of an unauthorized payment.

If the bank believes you acted with gross negligence, it must provide evidence to support that claim. Its own general terms cannot automatically override your legal rights.

Customers who discover suspicious transactions should contact their bank immediately, report the unauthorized payments and keep records of all communication.

The key message is clear: Belgian banks must follow the law when handling phishing complaints, and customers should not lose their legal protection because of stricter conditions in a bank’s contract.