{"id":9300,"date":"2023-01-16T09:10:14","date_gmt":"2023-01-16T08:10:14","guid":{"rendered":"https:\/\/droitbancaire.be\/?p=9300"},"modified":"2026-07-27T21:12:19","modified_gmt":"2026-07-27T19:12:19","slug":"phishing-recent-case-law-belgium","status":"publish","type":"post","link":"https:\/\/droitbancaire.be\/en\/phishing-recent-case-law-belgium\/","title":{"rendered":"Phishing: Where Recent Belgian Case Law Now Stands"},"content":{"rendered":"

Our earlier articles set out the principles applicable to phishing<\/a>. A consistent line of recent Belgian case law now applies those principles and has curbed the assumption \u2014 long held by many fraud victims \u2014 that a bank must automatically reimburse sums stolen through phishing.<\/p>\n

The picture that emerges from the last few years is clear. Where a customer has disclosed personalised security data, or validated transactions using a card reader or step-up SMS codes, Belgian courts overwhelmingly find gross negligence and leave the loss with the customer.<\/p>\n

The governing standard<\/strong><\/p>\n

The starting point is Article VII.38 CDE: the payment-instrument user must use the instrument in accordance with its terms of issue, notify the bank without delay of any loss, theft, misappropriation or unauthorised use, and take all reasonable steps to protect the instrument and its personalised security data.<\/p>\n

Crucially, gross negligence is assessed against the conduct of a normally prudent and diligent payment services user placed in the same external circumstances. The user\u2019s personal characteristics \u2014 age in particular \u2014 are not taken into account. In its judgment of 5 November 2020, the Antwerp Court of Appeal held that an 89-year-old customer who used the bank\u2019s electronic payment services was to be measured against any other “normal” user; a cluster of red flags (an email without the bank\u2019s logo, a follow-up call repeated on a Saturday for a non-urgent matter) should have drawn his attention.<\/p>\n

A consistent line of decisions<\/strong><\/p>\n

Across the recent rulings, the same reasoning recurs: the disputed transaction could only have been carried out with the customer\u2019s own participation \u2014 by disclosing codes to the fraudsters or by entering them on their instructions \u2014 and the many public warnings about phishing mean that ignoring the warning signs is itself gross negligence.<\/p>\n

Illustrative rulings<\/strong><\/p>\n