{"id":102890,"date":"2026-06-03T18:17:05","date_gmt":"2026-06-03T17:17:05","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=102890"},"modified":"2026-06-03T18:22:08","modified_gmt":"2026-06-03T17:22:08","slug":"bank-phishing-refund","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/terugbetaling-phishing-bank\/","title":{"rendered":"Does the bank have to reimburse the customer first in the event of a phishing attack, even in cases of gross negligence?"},"content":{"rendered":"

Anyone who falls victim to phishing and suddenly finds money missing almost always gets the same response from the bank: you were grossly negligent, so we won\u2019t reimburse you. On May 26, 2026, the presiding judge of the Antwerp Business Court ruled in summary proceedings that this response is legally untenable. The bank\u2014in this case, Argenta Spaarbank\u2014must reimburse the amount of an unauthorized payment transaction <\/a>Reimbursement must come first; the discussion regarding gross negligence and liability should only take place in subsequent proceedings on the merits.<\/p>\n\n\n\n

The facts<\/h3>\n\n\n\n

A couple aged 90 and 93, customers of Argenta Spaarbank, fell victim to a phishing call on January 23, 2026. Someone posing as a bank employee called them while the man was in the process of making a transfer. That same day, it turned out that two transfers had been made to an unknown account in Portugal, totaling 49,958 euros.<\/p>\n\n\n\n

The son immediately notified the fraud hotline and Card Stop and filed a complaint with the police. After issuing a formal notice on March 5, 2026, the couple filed a lawsuit in summary proceedings on March 30, 2026, to obtain reimbursement. The bank refused: in its view, the transactions were authorized, or at the very least constituted gross negligence.<\/p>\n\n\n\n

The ruling<\/h3>\n\n\n\n

The presiding judge grants the claim for reimbursement of 49,958 euros, plus late payment interest from January 23, 2026, and orders the bank to pay the costs.<\/p>\n\n\n\n

The focus is on the relationship between two provisions of the CEL<\/a>, which constitute the implementation of the Directive 2015\/2366<\/a> (PSD2). Article VII.43 of the CEL requires the payment service provider to refund the amount immediately in the event of an unauthorized payment transaction, and no later than the end of the next business day. The text itself contains one exception to this obligation: when the bank has reasonable grounds to suspect fraud on the part of the payer, provided that it reports this in writing to the FPS Economy. Art. VII.44 CEL then regulates the final allocation of liability, including in cases of gross negligence.<\/p>\n\n\n\n

Based on this structure, the court derives the principle of \u201cpay first, argue later.\u201d The presiding judge answers two questions.<\/p>\n\n\n\n

First: must the judge in summary proceedings examine whether the transaction was authorized? No. If, in addition to the statutory presumption of fraud, he were to accept a presumption of authorization as grounds for not requiring repayment, he would be adding an exception that is found neither in the Directive nor in the CEL. Moreover, the examination of the transaction\u2019s permissibility is so extensive, both legally and technically, that it would invariably exceed the one-business-day deadline, thereby rendering the repayment obligation a dead letter. It is sufficient that the conditions of Art. VII.43 CEL are apparently met.<\/p>\n\n\n\n

Second: must the court determine whether the payer was grossly negligent? No, not at all. The court explicitly relies on the opinion of Advocate General Rantos dated March 5, 2026, in the pending case C-70\/25<\/a> before the CJEU. According to that opinion, the obligation to refund immediately also applies in cases of suspected gross negligence. Article 73 of PSD2 concerns reimbursement; Article 74 concerns the subsequent allocation of liability. An interpretation allowing the bank to refuse reimbursement based solely on a presumption of gross negligence would deprive Article 73 of its intended effect. The bank therefore wrongly criticizes the plaintiffs for not yet having initiated proceedings on the merits: it is precisely the legislature\u2019s intention to place the litigation risk on the payment service provider, not on the payer.<\/p>\n\n\n\n

Legal analysis and interpretation<\/h3>\n\n\n\n

A national court that preempts a preliminary ruling that has not yet been decided<\/h4>\n\n\n\n

The most striking aspect of this decision is the method used. The President bases his assessment of the second question directly on an opinion issued by an Advocate General in a case that had not yet been decided by the Court of Justice at the time of the ruling. An Advocate General\u2019s opinion is not binding on the Court and does not have the force of res judicata. The court does not use it here as a binding source, but as a persuasive guideline in interpreting a provision harmonized under EU law for which Member States have no margin of discretion.<\/p>\n\n\n\n

Such caution is justifiable in preliminary relief proceedings, where the court merely assesses the prima facie case and does not establish a definitive legal position. Nevertheless, it remains a precarious balance: if the CJEU were not to follow the opinion, the reasoning regarding the second question would rest on an outdated premise. The provisional nature of the ruling largely mitigates that risk, but it illustrates how heavily the judge currently relies on the expected European line.<\/p>\n\n\n\n

The emergence of Article VII.43 of the CEL as an independent legal basis<\/h4>\n\n\n\n

Traditionally, legal disputes regarding phishing have primarily centered on Article VII.44 of the CEL and gross negligence. The legal basis for the payment obligation itself\u2014Article VII.43 of the CEL\u2014often remained in the background. Legal doctrine even established that banks rarely, if ever, comply with this provisional repayment obligation, despite its crucial protective function (G. Straetmans and R. Steennot, Handbook on Consumer Protection and Market Practices<\/em>, Intersentia, 2023, p. 620).<\/p>\n\n\n\n

This ruling now explicitly places Article VII.43 of the CEL at the forefront: it creates an independent, provisional payment obligation that is separate from the question of liability. This reasoning aligns with a recent trend in case law that reevaluates the relationship between the two provisions and accepts Article VII.43 of the CEL as an independent basis for provisional repayment. For the bank customer, this shifts the focus: he no longer has to prove in summary proceedings that he was not guilty of gross negligence; it is sufficient that the transaction was apparently unauthorized.<\/p>\n\n\n\n

Urgency arising from the nature of the statutory deadline<\/h4>\n\n\n\n

From a legal perspective, it is interesting to note how the court derives the urgency from the statute itself. Because the legislature requires repayment to be made \u201cimmediately\u201d and \u201cno later than the end of the next business day,\u201d failure to comply with that obligation is, by its very nature, urgent. The plaintiffs\u201c age and financial dependence are only addressed \u201das a matter of course\u201d.<\/p>\n\n\n\n

This interpretation is not self-evident in legal doctrine. Urgency is, in principle, a matter of fact that falls within the exclusive discretion of the judge presiding over the preliminary relief proceedings. By linking urgency to the nature of the statutory deadline, the court makes urgency almost always present in this type of case\u2014which significantly lowers the threshold for phishing victims to seek summary proceedings.<\/p>\n\n\n\n

Specifically, what does this mean?<\/h3>\n\n\n\n

For victims of phishing.<\/strong> The order provides a quick and effective means of pressure. Anyone faced with a refusal to reimburse does not have to wait for lengthy proceedings on the merits: summary proceedings under Article VII.43 of the CEL may be sufficient to recover the amount on a provisional basis. It is important to provide a detailed and credible account of the fraud, supported by evidence of timely reporting (Card Stop, fraud hotline, police report). Keep all communications\u2014text messages, emails, screenshots\u2014and formally put the bank on notice before filing a summons. A prior complaint to Ombudsfin is free of charge and can strengthen your case.<\/p>\n\n\n\n

For banks and other payment service providers.<\/strong> The argument that \u201cgross negligence means no refund\u201d loses much of its weight in summary proceedings. Anyone wishing to suspend the provisional repayment may, in principle, do so only within the strict exception provided for in Art. VII.43 CEL: a reasonable suspicion of fraud on the part of the payer themselves, reported in writing to the FPS Economy. Anyone who refuses outside of that framework risks not only the principal amount but also default interest from the date of the fraud and the full legal costs. The correct course of action is to make the repayment and then, if necessary through proceedings on the merits, have liability and any gross negligence assessed under Article VII.44 of the CEL.<\/p>\n\n\n\n

Frequently asked questions (FAQ)<\/h3>\n\n\n\n

Is my bank required to reimburse me immediately after a phishing incident?<\/strong>
In the case of an unauthorized payment transaction, the bank must, in principle, refund the amount immediately, or by the end of the next business day at the latest (Art. VII.43 CEL). The only exception is a reasonable suspicion of fraud on your part, which the bank must report in writing to the FPS Economy. A mere allegation of gross negligence is not sufficient to suspend the refund.<\/p>\n\n\n\n

Can the bank refuse because I was allegedly grossly negligent?<\/strong>
Not to refuse the provisional reimbursement. According to this decision and the Advocate General\u2019s opinion in Case C-70\/25, the issue of gross negligence should be addressed at a later stage, pursuant to Article VII.44 of the CEL. The bank must first make the repayment and may then attempt to recover the amount in proceedings on the merits, in which it must prove gross negligence and causation.<\/p>\n\n\n\n

Do I need to file a lawsuit first to get my money back?<\/strong>
No. Precisely because the law imposes short deadlines, summary proceedings are sufficient. It is not up to you to first bring a full-fledged lawsuit: the law places the litigation risk on the bank, not on the customer.<\/p>\n\n\n\n

Conclusion<\/h3>\n\n\n\n

The decision of May 26, 2026, confirms a consumer-friendly interpretation of payment law: in the case of an unauthorized payment transaction, the principle of \u201cpay first, argue later\u201d applies. The judge in summary proceedings need not examine either the authorized nature of the transaction or possible gross negligence\u2014it suffices that the conditions of Art. VII.43 CEL appear to be met. The discussion regarding liability shifts to subsequent proceedings on the merits under Art. VII.44 CEL, in which the litigation risk lies with the bank. Whether the CJEU confirms this line of reasoning in Case C-70\/25 will determine the definitive scope, but the direction is clear.<\/p>\n\n\n\n

\n\n\n\n
\n
Have you been the victim of phishing and are now facing a bank that refuses to reimburse you because you are alleged to have been \u201cgrossly negligent\u201d? This recent court ruling shows that such a refusal often does not hold up in summary proceedings. Our lawyers specializing in phishing and consumer protection would be happy to review your case and determine the fastest path to reimbursement. Feel free to contact us for an initial consultation.<\/a><\/div>\n<\/div>\n\n\n\n