Joris DeeneYes, generally speaking. According to Article 5.198 of the Civil Code, anyone who pays an invoice to an account number provided by a fraudster via email has not paid their supplier and remains liable for the invoice. The customer can only recover the loss from the supplier if they prove a specific error on the part of that supplier. The Court of Appeal in Mons confirmed this on October 5, 2026: a French company was required to pay 34,553.76 euros a second time to its Belgian supplier, plus liquidated damages, even though it had been the victim of a perfectly forged email. According to the court, the fact that the supplier may have been hacked was not sufficient to hold it liable for any fault.
In short:
- On October 5, 2026, the Court of Appeal in Mons ordered a customer who had deposited 34,553.76 euros into a fraudster’s British bank account to repay that amount to the supplier, along with statutory interest and liquidated damages of 1,901.84 euros.
- Even if it is established that the fraudster operated through the supplier’s computer system, the court held that this does not in itself prove any fault on the part of that supplier; the customer must demonstrate a specific act of negligence, and he failed to do so.
- A criminal complaint filed in France on June 20, 2023, could not stay the civil proceedings, because a complaint alone is not sufficient to initiate criminal proceedings.
The facts
On March 15, 2023, a Belgian supplier of construction and fire safety materials sent a pro forma invoice to a French customer. The agreement was simple: the customer would pay on the day of pickup. On May 9, 2023, an employee of the supplier sent an email stating that the order would be ready starting Monday, May 15. That morning at 10:17 a.m., a confirmation that the goods were ready was sent from the same email address.
That same day at 5:38 p.m., a second email arrived, this time from an address that looked like the real one but ended with a different domain: not “f(…).be” but “f(…)-be.com”. The email asked the customer to confirm receipt of new bank details: an account at a bank in the English county of Kent, with a British IBAN and a BIC from a bank in London. The customer replied on May 16 that he had forwarded the new details to the accounting department. On May 23, a reminder was sent from the fake address, with a strikingly informal salutation (“Bonjour à toi”). The following day, the customer confirmed that the payment had been processed.
The money never reached the supplier. In early June 2023, the supplier wrote that he could not be held responsible and offered to release the goods without prepayment, on the condition that the customer confirm that the supplier was not at fault and that he would pay the invoice within thirty days. The customer replied on June 5, 2023, stating that he committed to paying by the due date, and added that at that stage he did not know whether the supplier or he himself had been hacked. In the end, he did not pay.
On November 14, 2023, the supplier sent a notice of default for 45,172.65 euros in principal, interest, and liquidated damages, and on January 25, 2024, filed a lawsuit in the Hainaut Business Court, Tournai Division. On March 26, 2024, that court ordered the customer, in absentia, to pay 34,553.76 euros in principal, interest as provided by law for late payment, and a lump-sum compensation of 1,901.84 euros. The customer filed an appeal.
The ruling
The Court of Appeal in Mons upheld the judgment on all counts. It addressed three issues.
Whether the criminal complaint suspends the civil case
The client had filed a criminal complaint in France on June 20, 2023, and asked the court to await the outcome of that investigation. The court refused. Article 4 of the Prior Title of the Code of Criminal Procedure suspends the civil action until a final decision has been rendered in the criminal case, but only when there is a risk of conflicting decisions. This rule, known as “le criminel tient le civil en état,” is a matter of public policy because the criminal judgment has the force of res judicata regarding the issues common to both cases. The court based its decision on the Court of Cassation (Cass. March 19, 2001, S.00.0129.N; Cass. April 3, 2009, C.08.0111.N; Cass. December 6, 2012, C.11.0604.F).
However, the suspension presupposes that criminal proceedings have been initiated: either through a judicial investigation at the request of the public prosecutor’s office, through a complaint filed by a civil party, or through a direct summons (Cass. May 16, 2003, C.01.0473.N). A mere complaint or a criminal investigation is not sufficient. Because the customer could only file a complaint, the court of appeals ruled that there was no reason to wait.
The claim for payment of the invoice and the defense that the supplier had been hacked
The customer did not dispute that his payment into the fraudster’s account did not discharge his debt to the supplier. He did, however, argue that the supplier had been negligent by failing to adequately secure its computer system, and sought to offset his compensation against the invoice.
The court assessed that defense under the rules of evidence set forth in Book 8 of the Civil Code: Anyone asserting a claim must prove the facts on which it is based (Article 8.4), with a reasonable degree of certainty (Article 8.5), which, according to the legislative history, does not mean 100 percent certainty but rather a conviction that excludes all reasonable doubt (Parliamentary Series, House of Representatives 2018-19, No. 54-3349/001, p. 16). In case of doubt, the party bearing the burden of proof loses.
The origin of the fraud remained unclear. Both parties submitted a statement from their IT vendor. The customer’s statement (October 11, 2023) described a central antivirus system, an EDR solution, and a managed firewall, and reported no breach on the workstations. The supplier’s statement (September 27, 2023) stated that nothing unusual had been detected, that no other customer had received a fraudulent email, and that a new antivirus program had been installed as a precaution. The court found no evidence in the documents to support the customer’s claim that such a perfectly forged email could only have been sent through a breach at the supplier’s end. According to the court, the fact that the supplier replaced its antivirus software in September 2023 did not prove that the system was defective in May 2023.
The court went one step further. Even if it were established that the fraudulent emails resulted from a break-in at the supplier’s premises, that alone would not prove any fault or negligence on the part of the supplier. Without concrete evidence proving fault or negligence, the supplier could not be held liable. The judgment ordering payment of 34,553.76 euros therefore stood.
The claim for payment of the liquidated damages provision set forth in the general terms and conditions
Article 8 of the supplier’s general terms and conditions provided for a 15 percent surcharge on the invoice amount—with a minimum of 100 euros—in the event of “legally unjustified” nonpayment. The customer did not dispute that those terms were part of the contract, but argued that his failure to pay was justified: he had been the victim of fraud and had in fact paid, albeit to a fraudulent account.
The court did not agree with him. On June 5, 2023, the customer had agreed to pay on the due date, without any reservation regarding the supplier’s potential liability, and while admitting that he himself did not know the source of the fraud. Furthermore, several factors should have prompted him to be vigilant: the different email address, an account at a British bank even though the supplier had no connection whatsoever to the United Kingdom, an account number that did not match the one on the invoices or the website, and the tone of the second email. Ten days elapsed between the receipt of the fake bank details and the payment; a single phone call would have sufficed. The failure to pay was therefore unjustified, and the liquidated damages—reduced by the supplier itself to 1,901.84 euros—were due.
Legal analysis and interpretation
Why the rules about phishing and the bank don't help here
The customer in Mons used his own online banking credentials to pay the amount he wanted to pay into the account number he entered himself. Legally, this is a valid payment transaction. The protective provisions of Book VII of the Code of Economic Law (CEL), which require the bank to issue an immediate refund in the event of an unauthorized transaction, do not apply here. Professor Steennot noted this as early as 2021: invoice fraud and CEO fraud fall outside that regime because the victim personally authorized the transfer of funds to a specific account (R. Steennot, “Fraude in het betaalverkeer: waarom het slachtoffer in de kou kan blijven staan,” TPR 2021, vol. 2–3, 495, no. 3). The rules regarding the bank’s liability in cases of phishing, which we have outlined on our page about the bank and phishing do not provide therefore a solution for victims of invoice fraud.
The payer’s bank is also off the hook. Article VII.55/2 of the CEL stipulates that a payment order executed in accordance with the specified IBAN is deemed to have been executed correctly. In 2023, the bank was not required to verify the name “S.P.R.L. F.” next to a British account number. As we previously analyzed in our blog post on the question Who Bears the Risk in Invoice Fraud?, on December 18, 2025, the Business Court in Leuven dismissed a claim against the bank for that reason.
Since October 9, 2025, that landscape has changed somewhat. Regulation (EU) 2024/886 with regard to instant transfers, requires since than the payer’s bank to verify, prior to each transfer in euros, whether the beneficiary’s name matches the IBAN, and to alert the payer in the event of a discrepancy (Article 5 quater of Regulation (EU) No. 260/2012, as inserted by the 2024 regulation). Anyone who ignores the warning and makes the payment anyway bears the consequences themselves. However, in the case in Mons, that name verification would have made little difference: the regulation applies to transfers in euros between payment service providers located within the European Union, and the fraudster’s account was held at a British bank. Thus, the very foreign account that the court identified as a red flag remains, even today, outside the scope of the mandatory name verification.
Is a hacked supplier never liable? The dissenting voice from Brussels
The customer had a stronger argument than the one he presented. Article Section 5.198 of the Civil Code (CC) provides that a payment is effective only when it is made to the creditor or to a person authorized to receive it on the creditor’s behalf. Whoever pays another person pays twice: the classic saying “qui paie mal, paie deux fois,” which legal doctrine still takes as its starting point (S. Stijns, S. De Rey, and S. Declercq, Leerboek verbintenissenrecht. Boek 2, Bruges, die Keure, 2026, p. 127, no. 144). The same article provides an exception to this rule: a payment made in good faith to a sham creditor is, in fact, discharging. The question then is whether the customer could reasonably have regarded the fraudster as his supplier, and, according to most authors, whether the false impression created can be attributed to the actual supplier (the same authors, p. 129, no. 147).
The customer in Mons did not take that route: he explicitly admitted that his payment did not release him from liability. On May 2, 2024, the Business Court in Brussels did receive an appeal regarding the sham creditor and dismissed it, but nevertheless ruled that the damages should be split equally. As we previously analyzed in our blog post about Invoice fraud via a hacked email account, the court held the supplier strictly liable for having ignored warnings about suspicious login attempts and unusual email patterns, despite its own IT expertise. The hacked supplier was held liable for half of the 618,220.10 euros.
Do the courts in Mons and Brussels contradict each other? Not as much as it seems. Both courts apply the same standard: the supplier is liable only if he committed a fault—that is, if he did not act as a prudent and reasonable businessperson would under the same circumstances (for facts occurring before January 1, 2025, Article 1382 of the old Civil Code, today's article 6.6 of the Civil Code). In Brussels, the evidence of that error was right there on the table: ignored reports, a neglected email inbox. In Mons, there was nothing, except for the suspicion that a perfectly forged email must have come from somewhere. The court therefore does not say that a hack never constitutes a fault; it says that a hack in and of itself is not yet a fault. That distinction is correct. A breach can happen even to those who properly secure their systems, and a customer seeking damages must demonstrate what the provider reasonably should have done but failed to do.
The weak point lies elsewhere: in the customer’s ability to present evidence. Everything the customer would need to prove—the state of security, the log files, the notifications received by the supplier—is in the supplier’s possession. Article 8.4 of the Civil Code imposes a duty on all parties to cooperate in the presentation of evidence and allows the court, in exceptional circumstances, to reverse the burden of proof when the ordinary allocation would be manifestly unreasonable. The court of appeal did not examine that possibility, nor does the customer appear to have requested it. Anyone mounting a defense in such a case would be well advised to request the submission of the supplier’s technical documents before the closing arguments, rather than regretting afterward that the origin of the fraud remained undetermined.
The promise made on June 5, 2023, cost the customer the liquidated damages clause
After discovering the fraud, the customer had one chance to protect his position, and he let it slip by. When the supplier offered on June 5, 2023, to release the materials after all, on the condition that the customer confirm that the supplier was not at fault and would pay within thirty days, the customer replied that he undertook to pay on the due date. No reservations, no reference to a possible error on the supplier’s part, even though he admitted in the same email that he did not know who had been hacked.
That promise made little difference with regard to the principal amount: that was due in any case. It was decisive, however, with regard to the liquidated damages clause. A liquidated damages clause is a provision in which the parties agree in advance on a lump-sum compensation in the event that one of them fails to fulfill its obligation (Article 5.88 of the Civil Code). The supplier’s clause applied only in the event of a “legally unjustified” failure to pay. The customer attempted to find a loophole in this: someone who paid and was defrauded is not paying unjustifiably late. The court set a different standard. Justification presupposes that the customer had a serious reason to withhold payment at the time of the default. Anyone who first promises to pay without reservation and then tacitly fails to pay does not have such a reason.
On top of that comes the due diligence test. The court listed four red flags that should have alerted the customer and added a fifth: the ten-day period between receiving the new bank details and making the payment, during which a single phone call would have sufficed. This list reads like a checklist for any accounting department that receives a change in bank details. It also shows how the court takes the victim’s own carelessness into account, even when the supplier is not at fault: not in the principal amount, which is fixed, but in the incidental costs. Incidentally, the supplier had already reduced its penalty clause from 15 percent (over 5,000 euros) to 1,901.84 euros, which presumably explains why the court of appeals did not need to rule on a reduction under Article 5.88, § 2 of the Civil Code.
Specifically, what does this mean?
For businesses that pay invoices. A change to your bank information sent via email is only reliable after you’ve confirmed it through another channel: a phone call to a number you already know—never to the number listed in the email itself. Check the sender’s domain letter by letter, compare the account number with the one on previous invoices and on the website, and be wary of an invoice from a country where your supplier has no business. If you do pay a fraudulent invoice, you will still owe the amount. Never commit to payment without reservation afterward: if you wish to claim a supplier error, you must make that reservation starting with the very first email. If you’re unsure whether your supplier has made a mistake, the first thing we’ll do for you is determine which technical documents you can request from them and whether a setoff against the invoice is feasible.
For suppliers whose identities were misused. This ruling is good news: you retain your claim against the customer, and you do not have to prove that your systems were impenetrable. But don’t settle for a statement from your IT provider that “nothing unusual” was detected. Save the log files, document which security measures were in place and which alerts you received, and notify your other customers immediately. Anyone who ignores a warning, as in the Brussels case, loses half. Also, don’t make any concessions in the first emails following the fraud: the supplier in Mons offered a deferral but—rightly—linked it to an acknowledgment of its own innocence. A well-drafted liability clause in your general terms and conditions also ensures that you won't be left to cover the collection costs.
For those involved in such a dispute. A criminal complaint is useful for tracking down the fraudster and, in some cases, for having the funds frozen, but it does not stay the civil proceedings. Only when the public prosecutor’s office requests a judicial investigation, you file a civil claim with the investigating judge, or someone is directly summoned to court, can the judge adjourn the case. Filing a complaint abroad does not change this. So, if you want to buy time, you’re better off filing a criminal complaint with a civil claim, while realizing that this choice also involves costs and a period of investigation.
Frequently asked questions (FAQ)
Do I have to pay an invoice again after a fraud incident if I've already paid it using a fake account number?
Yes. A payment is only considered to have discharged the obligation once it reaches the supplier or the supplier’s authorized representative. Anyone who pays into a fraudster’s account remains liable for the invoice and must pay it again, plus interest. However, they can recover the amount paid from the fraudster, if the fraudster is found, and, in exceptional cases, seek compensation from a supplier who committed a specific error.
Is my supplier liable if his email account was hacked?
Not automatically. According to the Court of Appeals in Mons, a break-in in and of itself does not constitute negligence: you must prove that the supplier did not act as a prudent business would, for example, because it ignored warnings about suspicious activity or lacked basic Business Court in Brussels held a supplier liable for half of the damages because it had indeed ignored such warnings. So everything depends on the specific evidence.
Is my bank required to reimburse me in the event of invoice fraud?
Generally speaking, no. You provided the payment amount and account number yourself, so this is a valid payment transaction; the bank’s obligation to reimburse you in the event of phishing does not apply in this case. However, since October 9, 2025, when processing a transfer in euros within the European Union, your bank is required to verify that the beneficiary’s name matches the IBAN and to alert you if there is a discrepancy. This verification does not apply to accounts outside the European Union, such as those in the United Kingdom.
Can I have the civil case postponed because I have filed a criminal complaint?
Only if criminal proceedings have actually been initiated—through a judicial investigation, a complaint filed by a civil party, or a direct summons—and only if there is a risk of conflicting decisions. A simple complaint filed with the police or the public prosecutor’s office, whether in Belgium or abroad, is not sufficient. In that case, the judge may simply rule on the invoice.
Conclusion
The October 5, 2026, ruling by the Mons Court of Appeal reaffirms the strict stance of Belgian law regarding invoice fraud: a customer who pays a fraudulent invoice ends up paying twice, and can only shift the loss to a supplier if he can prove that the supplier committed a specific error. The fact that the fraudster perfectly imitated the supplier—and even that he may have operated through the supplier’s system—is not sufficient for this purpose. Furthermore, anyone who promises to pay without reservation after the fraud occurs also forfeits the right to defend against the liquidated damages clause.
ICT Legal Guide is the knowledge platform of the Intellectual Property, IT Law, AI Law, Data Protection, and Media Law department at Everest Attorneys, led by Joris Deene. Our attorneys assist companies that have fallen victim to invoice fraud or CEO fraud—whether on behalf of the client seeking to recover damages or on behalf of the supplier whose identity was misused—from the initial response following discovery through to proceedings before the business court.
Dutch 
English