{"id":101930,"date":"2026-01-05T22:30:52","date_gmt":"2026-01-05T21:30:52","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=101930"},"modified":"2026-01-05T22:45:31","modified_gmt":"2026-01-05T21:45:31","slug":"is-the-bank-liable-for-phishing-if-private-funds-are-stolen-via-a-professional-account","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/is-de-bank-aansprakelijk-bij-phishing-als-privegeld-via-een-professionele-rekening-wordt-gestolen\/","title":{"rendered":"Is the bank liable for phishing if private funds are stolen from a professional account?"},"content":{"rendered":"

Phishing remains a huge problem, with fraudsters becoming increasingly inventive in their methods. A complex issue arises when fraudsters first transfer private funds to the victim's company account and then steal them. Can the bank then hide behind the less stringent rules for companies? According to a judgment<\/a> of the Dutch-speaking Enterprise Court of Brussels of 13 March 2025 the answer is clearly no. As long as the fraud starts in the private sphere, you enjoy consumer protection and the bank must reimburse you, unless it can prove gross negligence.<\/p>\n\n\n\n

The facts: a complex fraud circuit<\/h2>\n\n\n\n

In this case, the victims, who were also directors of a private limited company (BV), were confronted with large-scale fraud.<\/p>\n\n\n\n

Suspicious transactions took place between August 1 and August 4, 2021. The modus operandi was specific: the fraudsters first transferred \u20ac40.000<\/strong> from the victims' private accounts to their own professional company accounts. The money was then siphoned off from those company accounts to third parties.<\/p>\n\n\n\n

The bank (KBC) refused to compensate for most of the damage (\u20ac37,766.12). The bank argued that the actual theft took place from the business account, which meant that the victims should be considered professionals rather than consumers. In addition, the bank accused the victims of \u201cgross negligence\u201d because the transactions had been signed using the app.<\/p>\n\n\n\n

The court's decision<\/h2>\n\n\n\n

The court ruled entirely in favor of the victims and ordered the bank to repay the full amount, plus interest and costs<\/sup>.<\/p>\n\n\n\n

The judge based his decision on three elements:<\/p>\n\n\n\n

    \n
  1. The origin of the money matters:<\/strong> Although the money effectively disappeared via the company account, the court ruled that the fraud began in the private accounts. At that time, the victims were acting as consumers. The fact that the money was transferred via their company does not change their status.<\/li>\n\n\n\n
  2. No exclusion of liability:<\/strong> Because the victims were classified as consumers, the bank could not invoke contractual clauses limiting liability (as is often the case in B2B relationships).<\/li>\n\n\n\n
  3. No evidence of gross negligence:<\/strong> The bank failed to prove that the victims had shared their codes or clicked on a phishing link. Mere log data from the bank showing that the app was used is not sufficient evidence of gross negligence.<\/li>\n<\/ol>\n\n\n\n

    Legal analysis and interpretation<\/h2>\n\n\n\n

    This judgement is important for case law concerning Article VII.44 of the Code of Economic Law (CEL).<\/a> This article regulates liability for unauthorized payment transactions<\/a>.<\/p>\n\n\n\n

    Consumer vs. professional (Art. VII.29 CEL)<\/h3>\n\n\n\n

    In banking law, the distinction between consumers and professionals is important. In the case of professional clients (B2B), Article VII.29 CEL allows parties to contractually deviate from the strict liability rules. In fraud cases, banks often try to shift the case to the professional sphere in order to circumvent strict consumer protection.<\/p>\n\n\n\n

    However, the court sees through the fraudsters\u201c \u201dconstruction.\" The judge looks at the economic reality: the loss affected private assets. The court thus confirms that the protection of Article VII.44 CEL is mandatory when the damage originates in the private sphere, regardless of the technical route taken by the money.<\/p>\n\n\n\n

    The burden of proof for gross negligence (Art. VII.44, \u00a74 CEL)<\/h3>\n\n\n\n

    The ruling reaffirms the heavy burden of proof that rests on banks. According to Article VII.44, \u00a74 CEL, the bank must prove that fraud or gross negligence has occurred.<\/p>\n\n\n\n

    The court strictly applies article 8.4 of the Civil Code<\/a> : in case of doubt, the party bearing the burden of proof (the bank) is found to be in the wrong. The bank's argument that the installation of the app necessarily requires the use of the card reader and secret code, and that there must therefore be negligence, is considered insufficient. Without concrete evidence of an active act (such as passing on a code to a third party), gross negligence cannot be assumed.<\/p>\n\n\n\n

    What this specifically means for you<\/h2>\n\n\n\n

    This judgement has important consequences for victims of bank fraud:<\/p>\n\n\n\n