Phishing

Phishing is a form of Internet fraud in which criminals attempt to obtain personal information by posing as a trusted agency or person. Usually this is done via email, text message, phone or messages on social media.

How phishing works:

• Deception: You receive a message that appears to come from your bank, government, telecom operator or other trusted company.

• Urgent request: The message often asks you to take immediate action, such as clicking a link, updating passwords or confirming account information.

• Fake links or websites: Clicking on the link takes you to a forged website that closely resembles an organization's official site.

• Stealing data: Once you enter your information, criminals gain access to your bank account, email or other personal accounts.

The criminal sanctioning of phishing in Belgium

When is phishing punishable?

Phishing is usually criminally prosecuted as a violation of Article 504quater of the Criminal Code (computer fraud).

Computer fraud occurs when a person (i) with fraudulent intent, (ii) seeks to obtain an unlawful economic advantage for himself or another, (iii) by introducing, altering, deleting or changing by any other technological means (the normal use) of data stored, processed or transmitted by means of a computer system into a computer system.

The perpetrator of computer fraud (and thus phishing) can be sentenced by the correctional court to six months to five years in prison and with a fine of 26 euros to 100,000 euros (to be multiplied x 8) or with either of those penalties alone.

Attempting to commit computer fraud is punishable by imprisonment from six months to three years and by a fine from 26 euros to 5,000 euros (amounts to be multiplied X 8) or by either of those penalties alone.

Civil liability : repayment of the amounts misappropriated.

The perpetrator

If the perpetrator can be identified and convicted of phishing, the victim can ask the court to order the perpetrator to pay restitution for the amounts stolen.

The bank

If the perpetrator cannot be identified or the perpetrator is found to be incapacitated, then under certain conditions, the victim can also appeal to his or her bank to repay the stolen amounts. If the bank refuses to do so, the customer can initiate legal proceedings against his or her bank in the Court of First Instance.

Read more about bank liability in the case of phishing here.

What can a lawyer do for you?

The criminal complaint

In order to prosecute the perpetrator of phishing, a criminal investigation must be initiated. This can be done either on the prosecution's (the prosecutor's) own initiative or through a complaint filed by the victim. A criminal complaint can be filed in two ways:

• either to the police who then forward the complaint to the prosecutor's office. The downside is that for reasons of expediency, the prosecution may decide not to investigate and dismiss the case.
• or through a complaint with civil action before an investigating judge. The advantage is that an investigating judge is required to investigate. The disadvantage is that the investigating judge does require bail.