Belfius taken to court for failing to refund phishing victim

State-owned bank Belfius will appear before a criminal court in Brussels in November for allegedly failing to immediately reimburse a customer who lost €100,000 in a phishing scam.

According to De Tijd and L’Echo, it is the first known time a bank has faced criminal prosecution in a phishing case.

The case concerns a French-speaking woman who was defrauded last year by someone posing as a Card Stop employee. After the money was stolen, Belfius refused to repay the amount, prompting the victim to launch civil proceedings.

Under the law, banks must immediately refund payments that a customer did not authorise. They may only try to recover the money later by going to court and proving that the customer was grossly negligent.

In practice, however, banks rarely make provisional repayments in phishing cases. They often argue that the customer authorised the transaction or acted with gross negligence.

How Brussels became a French-speaking city

The rise of Bancontact: How Belgium found itself at the forefront a new digital payment era

Belgium’s debt drift: Is the country's luck to run out?

In recent months, several courts have nevertheless ordered banks in similar cases to make immediate repayments while the customer’s responsibility is still being examined. Case law has also increasingly held that consent exists only when a customer knowingly transfers a specific amount to a clearly identified account.

The woman has now also summoned Belfius before the criminal court. A lesser-known provision of the law makes payment service providers criminally liable if they fail to follow the rules in fraud cases.

Belfius in principle faces a fine, but the broader significance lies in the precedent a criminal conviction could set.

The case is due to open on 30 November before the French-speaking criminal court in Brussels.