{"id":102574,"date":"2026-04-01T12:05:08","date_gmt":"2026-04-01T11:05:08","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=102574"},"modified":"2026-04-01T12:07:53","modified_gmt":"2026-04-01T11:07:53","slug":"who-bears-the-risk-in-invoice-fraud-the-debtor-the-creditor-or-the-bank","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/wie-draagt-het-risico-bij-factuurfraude-de-schuldenaar-de-schuldeiser-of-de-bank\/","title":{"rendered":"Who bears the risk in invoice fraud: the debtor, the creditor or the bank?"},"content":{"rendered":"

Invoice fraud is a persistent and growing problem for businesses, with fraudsters intercepting payment transactions and manipulating bank data<\/sup>. If you as a customer unknowingly pay into a scammer's forged account number, you basically bear the financial risk yourself<\/sup><\/sup><\/sup><\/sup>. Both the unpaid supplier and the performing bank go free in the vast majority of cases, unless there are very specific grounds for exception<\/sup>.<\/p>\n\n\n\n

The facts and legal context<\/h3>\n\n\n\n

In a recent case before the Leuven Enterprise Court, the judges, in a judgment dated December 18, 2025, dealt with a typical case of invoice fraud between two companies, BV S.S. (the contractor) and BV C. (the principal). Between the two parties, after disputing the initial billing, it had been agreed that the principal would pay an advance of 15,000 euros before the contractor would perform repair work.<\/p>\n\n\n\n

Shortly before the scheduled payment, the client received fraudulent emails from third parties<\/sup><\/sup><\/sup><\/sup><\/sup>. These fraudsters sent emails from an address very similar to that of the contractor, saying that payment should be made to a new account number at AION Bank<\/sup><\/sup><\/sup><\/sup><\/sup><\/sup>. The principal executed the 15,000 euro transaction almost immediately<\/sup>. Later, this account number was found to belong to an unknown third party, after which the funds disappeared without a trace<\/sup><\/sup><\/sup>.<\/p>\n\n\n\n

The principal claimed that she had paid in discharge by this transfer and refused to pay the outstanding debt to the contractor<\/sup>. Secondarily, she held her own bank (KBC) liable for the damages suffered<\/sup>.<\/p>\n\n\n\n

The decision and the law<\/h3>\n\n\n\n

The court rejected the client's argument and ruled in favor of the contractor and the bank<\/sup><\/sup><\/sup><\/sup>. The decision rests on two main legal pillars:<\/p>\n\n\n\n

First, based on article 1239 (old) Civil Code, the court ruled that a payment is valid only when made to the actual creditor or his agent. A payment to a fraudster does not constitute a payment to the creditor. The severe penalty for this is \u201cqui paie mal, paie deux fois\u201d (whoever does not pay to the right person does not pay in discharge and must pay again). Consequently, the risk of this fraudulent request is borne entirely by the debtor.<\/p>\n\n\n\n

Second, the claim against the bank was dismissed under Article VII.55\/2 of the Code of Economic Law (CEL)<\/a>. This provision states that a payment service provider (the bank) is not liable for the execution of a transaction as long as it is done in accordance with the \u2018unique identifier\u2019 entered by the customer, being the IBAN account number. The bank is not legally required to verify that the name of the payee is correct with the IBAN number provided.<\/p>\n\n\n\n

Legal analysis and interpretation<\/h3>\n\n\n\n

This ruling illustrates a strict application of contract law combined with modern banking law. The court ruled that objective carelessness in the payment process lies exclusively with the debtor. The fact that the debtor could or could not have reasonably seen through the fraud is, in itself, the court finds irrelevant to the allocation of risk.<\/p>\n\n\n\n

There is only one escape route for the duped debtor: the trust theory. Under this theory, a payment can exceptionally count as dischargeable if the creditor (for example, through a compromised IT system or extreme negligence) contributed to the creation of an appearance. In that case, the debtor must have gained a legitimate expectation that he was paying correctly. Here, however, the court dismissed this argument: the supplier had always provided the correct bank details on its invoices and could not be held responsible for third-party emails. The mere fact that the supplier did not immediately respond to an email chaining the wrong account number does not create a legitimate expectation.<\/p>\n\n\n\n

Also read our blog : Who pays for the damage when invoice fraud occurs via a hacked mailbox?<\/a><\/p>\n\n\n\n

Regarding the financial institution, the court confirms the supremacy of the European PSD2 Directive<\/sup><\/sup>. This directive aims at a fully harmonized and contained liability regime for payment service providers<\/sup><\/sup><\/sup><\/sup>. A party cannot invoke a bank's \u2018general duty of care\u2019 to override these strict European and national provisions<\/sup><\/sup><\/sup><\/sup>.<\/p>\n\n\n\n

What this specifically means<\/h3>\n\n\n\n