A bank must immediately refund the amount of an unauthorized payment transaction resulting from phishing pursuant to Article VII.43 of the Code of Economic Law, even in summary proceedings and before the issue of gross negligence is addressed. This applies to transfers carried out by a fraudster using stolen card reader codes, but not to transfers that the victim confirmed themselves via itsme. The presiding judge of the Business Court in Antwerp drew this distinction on October 9, 2026, in a case against Argenta Spaarbank and ordered the bank to reimburse 46,857.10 euros to an 88-year-old couple. Attorney Joris Deene represented the consumers in this case.<\/p>\n\n\n\n
In short:<\/p>\n\n\n\n
On April 29, 2026, an 88-year-old retired couple received a phone call from someone posing as an employee of Card Stop, and then from someone claiming to work for Argenta\u2019s help desk. Under their guidance, a total of 61,822.10 euros was transferred from the couple\u2019s accounts to third-party accounts on April 29 and 30, 2026. That amount represented virtually all of their liquid savings: as of September 1, 2026, their three accounts at Argenta held a combined total of 1,992.41 euros.<\/p>\n\n\n\n
The money disappeared through two channels. Eleven transfers, totaling 46,857.10 euros, were authorized using the couple\u2019s debit card, a card reader, and the PINs generated by the card reader. Three other transfers, totaling 14,835 euros, were confirmed via an itsme account that the woman had installed on her own cell phone at the fraudster\u2019s instruction. According to Argenta, the couple\u2019s computer also had the AnyDesk software installed, which allows a third party to remotely control a computer.<\/p>\n\n\n\n
On April 30, 2026, the couple reported the fraud to Argenta, had the cards blocked, and filed a complaint with the police. Argenta confirmed receipt of the report by email the same day, but did not issue a refund. After a notice of default dated May 20, 2026, and a registered demand letter dated June 12, 2026, no response was received; on August 3, 2026, the bank did send an email, but not to the couple themselves and instead to an email address belonging to their son that he did not normally use. On August 31, 2026, the consumers filed a summons against Argenta in summary proceedings. They sought reimbursement of 61,507.81 euros\u2014the balance remaining after two small recoveries\u2014plus interest.<\/p>\n\n\n\n
Argenta defended itself on all fronts. According to the bank, the case was not urgent; the consumers had delayed action and would have been better off asking the trial court for preliminary measures. The transactions were permissible\u2014or at least the result of gross negligence\u2014and the bank was entitled to set off its debt to the couple against its own claim against them. In the alternative, Argenta requested the production of the WhatsApp messages with the fraudster and the history of the itsme account, a stay of proceedings until the criminal investigation was completed, and a deposit into escrow.<\/p>\n\n\n\n
The president referred to the text of the law. Article VII.43 of the Code of Economic Law<\/a> (CEL) requires the bank to immediately refund the amount of an unauthorized payment transaction\u2014no later than the end of the next business day\u2014and to restore the account balance with the debit date as the value date. The only exception is a reasonable suspicion of fraud on the part of the payer, reported in writing to the FPS Economy. The legislature thus assumed that delaying such a refund would entail serious disadvantages, so that, according to the chairperson, the claim is, by its very nature, urgent in principle.<\/p>\n\n\n\n According to the presiding judge, the claim was also urgently needed in this specific case. The couple lives on a joint pension of approximately 2,600 euros per month; at the age of 88, they will never be able to recover a loss of more than 61,500 euros; and they had to sell their securities portfolio at reduced prices in order to regain some financial reserves. The fact that the consumers did not prove they had no savings elsewhere did not count against them in the chairman\u2019s view: such negative proof cannot be required of them.<\/p>\n\n\n\n The president rejected the accusation of having delayed action. The couple had reported the incident and filed a complaint within a day, and had subsequently sent two written reminders without receiving a response from the bank, which made it difficult to determine a strategy. A four-month period between the fraud and the summons was not unreasonable for two 88-year-olds who were taking legal action against their own bank for the first time, with the assistance of their sons and an attorney, and during the holiday season. That they should instead have asked the trial court for provisional measures pursuant to Article 19, paragraph 3, of the Judicial Code<\/a>, was not self-evident for the presiding judge: that would require the matter to be addressed in brief debates during the preliminary hearing, to which the defendant could object. In this case, Argenta had also objected to immediate proceedings at the preliminary hearing on September 4, 2026, and had requested a deadline for submitting briefs.<\/p>\n\n\n\n A payment transaction is authorized when the payer has consented to the execution of the payment order, in the form and according to the procedure agreed upon with the bank (Article VII.32 of the CEL). Without such consent, the transaction is not authorized. A payment order is an instruction to the bank to transfer a specific amount to a specific account. If the payer denies having given consent, the bank must prove that the transaction was authenticated, correctly recorded, and posted; the recorded use of a payment instrument is not, in and of itself, necessarily sufficient proof of consent (Article VII.42 of the CEL).<\/p>\n\n\n\n The president applied that framework separately to the two types of transactions.<\/p>\n\n\n\n With regard to the eleven transactions made using the card reader, he ruled that Argenta had not demonstrated that the couple had given their consent. The fact that the consumers had provided a third party with information that allowed that third party to issue an order is not sufficient: this would only be different if that third party had been authorized to issue the order. Even a properly authenticated transaction may be unauthorized if it was not the payer but a fraudster who used the device and the codes. According to the president, a victim of phishing who discloses their security credentials over the phone or via a fake website did not personally issue the instruction to transfer a specific amount to a specific account; their credentials were simply stolen. The situation is different in cases of fraud where the payer is tricked into issuing the payment order themselves, such as in invoice fraud.<\/p>\n\n\n\n The text message alerts that Argenta allegedly sent for each response code did nothing to change that: on the face of it, it was the fraudster who entered the codes. At most, those alerts could be a factor in the subsequent discussion of liability. The AnyDesk argument also failed: the fact that the software was installed on the computer does not prove that it was used during the transfers, let alone that the couple could follow everything on their screen.<\/p>\n\n\n\n The president ruled otherwise regarding the three itsme transactions. The woman acknowledged that she had installed the itsme app herself on her own cell phone, and according to the itsme website<\/a> an account can only be accessed on one device. It was therefore implausible that the fraudster had confirmed those transactions. With reference to legal doctrine (R. Steennot, \u201cPayment Fraud: A Never-Ending Story?\u201d, TBH 2025\/1, 83) and to the Ombudsfin's 2025 Annual Report<\/a> the chairperson classified those payments as classic bank safe deposit box fraud: the couple themselves issued three orders to transfer a specific amount to a specific account and merely erred regarding the identity of the recipient. According to the presiding judge, this does not render the transactions unauthorized, so Article VII.43 of the CELcannot be applied to them.<\/p>\n\n\n\n According to the president, Argenta\u2019s invocation of set-off based on its General Regulations for Transactions misinterpreted the purpose of Article VII.44 of the CEL. Under that reasoning, the bank would almost always be able to invoke a non-due counterclaim against its customer and thereby oppose immediate repayment. To the extent that the general terms and conditions have such an effect, they are contrary to law: there can be no contractual deviation from Article VII.43 of the CEL. If the bank wants the money back because the payer was grossly negligent, it must assert that claim on its merits.<\/p>\n\n\n\n The presiding judge rejected the motion to stay the proceedings until the criminal investigation was completed: Argenta itself had not managed to recover anything immediately after the fraud, and it was not plausible that the couple would be able to do so after filing their complaint. The motion to produce the WhatsApp messages and the itsme chat history was without merit, given the prima facie findings. He also refused to order a deposit or other form of security, as that would amount to circumventing Article VII.43 of the CEL and would once again expose the couple to serious harm.<\/p>\n\n\n\n Argenta was ordered to credit the account with 46,857.10 euros, with value dates of April 29 and 30, 2026, respectively. Because the law mandates those value dates, the claim for interest was without merit. The bank shall bear the costs: 4,709.30 euros in litigation fees, 428.82 euros in summons costs, and 165 euros in court filing fees. The order is provisionally enforceable pursuant to Article 1039 of the Judicial Code.<\/p>\n\n\n\n This is the third time in five months that the presiding judge of the Business Court in Antwerp has ordered a bank to make a refund in summary proceedings. On May 26, 2026, the amount in question was 49,958 euros, which disappeared after a 90- and 93-year-old couple received a phone call from a fake bank employee; we discussed that decision in our blog post on the question of whether the bank must reimburse the customer first after a phishing incident, even in cases of gross negligence<\/a>. On September 1, 2026, the case involved 49,050 euros following a bank help desk fraud targeting a couple aged 80 and 87, in which the presiding judge rejected the set-off clause, the escrow arrangement, and the ongoing criminal investigation as grounds for postponement; See our blog post on the question of whether the bank may defer repayment until the case has been decided on its merits<\/a>. The decision of October 9, 2026, repeats those two points verbatim and adds one element: an explicit distinction based on the authentication method.<\/p>\n\n\n\n The common thread is always the same, and the president himself puts it this way: pay first, then argue. That common thread has since been confirmed at the European level. In the ruling Tukowiecka<\/a> (ECJ, October 15, 2026, C-70\/25), the Court of Justice ruled that a payment service provider may not refuse to immediately refund the amount of an unauthorized transaction on the grounds that the payer facilitated that transaction through gross negligence. The Court based this ruling on the text and legislative history of Article 73 of the Second Payment Services Directive<\/a>: the EU legislature deliberately accepted only one exception to immediate reimbursement\u2014the presumption of fraud\u2014and did not allow Member States to add any others. The ruling was issued six days after the Antwerp decision and therefore could not be cited in that case, but it is fully consistent with what the presiding judge had already ruled on three previous occasions. Any bank in Belgium that still argues it may suspend repayment because the customer was grossly negligent has, since October 15, 2026, been arguing against the Court of Justice\u2019s interpretation.<\/p>\n\n\n\n Two limitations do remain, however, and both are evident in this case. The first is procedural: immediate reimbursement is a substantive obligation of the bank, but anyone seeking to enforce it in summary proceedings must still demonstrate urgency. On June 10, 2026, the presiding judge of the Dutch-language Business Court in Brussels dismissed a similar claim on that point, as we explained in our blog post on the question of whether the obligation to reimburse is sufficient grounds to initiate summary proceedings<\/a>. The Antwerp president resolves this by first deriving the urgency from the statutory time limit itself and then determining it again on a case-by-case basis, using retirement, age, account balance, and the forced sale of the securities portfolio as supporting evidence. The second limitation is substantive, and that is the subject of the following point.<\/p>\n\n\n\n The couple received a refund of 46,857.10 euros, not 61,507.81 euros, and the difference is entirely attributable to the three itsme transactions. The president classified these as bank safe deposit box fraud, in which the payer enters and confirms the transfer themselves but is merely misled as to the reason for it. That classification is defensible, but it warrants a dissenting vote, because the distinction between a stolen card reader code and an itsme confirmation is less clear-cut than the decision suggests.<\/p>\n\n\n\n The counterargument comes from the very source cited by the president himself. In its 2025 annual report, Ombudsfin states that in recent vishing cases, it is usually not the victim who enters the transfer in their online banking environment, but the fraudster, who has somehow gained access to that environment; the victim then simply receives a confirmation prompt in their itsme app. Anyone who merely confirms a screen has not personally entered an amount or an account number. Whether the victim has consented to a specific amount being transferred to a specific account\u2014the essence of a payment order\u2014depends on what the confirmation screen displayed and what the fraudster had led the victim to believe. Ombudsfin itself concludes that these are \u201cmostly\u201d authorized transactions, because the itsme app usually specifies the amount and the payee. \u201cMostly\u201d does not mean \u201calways\u201d.<\/p>\n\n\n\n That counterargument is supported by case law. On September 3, 2025, the Antwerp Court of Appeal ruled\u2014also against Argenta\u2014that proof of proper authentication is not sufficient evidence of consent, that the preparatory work requires explicit consent, and that a customer who must prove a negative fact need only establish a likelihood that he did not consent (Antwerp Court of Appeal, September 3, 2025, 2024\/AR\/1289, NjW 2025, Issue 531, 808). The Court of Justice stated in its ruling Eurobank Bulgaria<\/a> (ECJ, July 11, 2024, C-409\/22) that the EU legislature did not intend merely to verify the formal correctness of the legal acts used: even a transaction that was confirmed in accordance with the agreed procedure may be invalid.<\/p>\n\n\n\n Does that counterargument hold up here? Probably not, and that is due to the facts as established by the presiding judge. He states that the couple issued three transfer orders via itsme to transfer a specific amount to a specific account and were merely mistaken about the recipient. If the couple knew the amount and the account number, consent is present even according to the legal doctrine cited by the presiding judge, and the mistake regarding the purpose is irrelevant. The weak link lies in the step before that: the presiding judge infers from the fact that the transactions were initiated from a single itsme device that the fraudster could not have confirmed them, and concludes from this that the couple initiated them themselves. However, the person who confirms is not necessarily the person who enters the data, and the ruling does not examine what the itsme screen displayed. For a judge in summary proceedings ruling on a prima facie basis, this is understandable. In the main proceedings, it is precisely that question\u2014who entered the three orders in the banking system and what the couple saw on the screen\u2014that will determine the fate of the remaining 14,835 euros.<\/p>\n\n\n\n The ruling deliberately does not establish anything definitively. With regard to the eleven card reader transactions, Argenta reserves the right to prove on the merits that the couple was grossly negligent, in which case the payer would bear the loss pursuant to Article VII.44 of the CEL. The text message alerts accompanying each response code and the potential AnyDesk session\u2014which the presiding judge set aside for the purposes of qualification\u2014will be revisited in that debate. The Court of Cassation has set the standard in its ruling of June 29, 2026<\/a> (C.25.0390.N): gross negligence is more than mere carelessness, and a judge may not base that determination on unproven intermediate steps, as we explained in our blog post on the question when a phishing victim is grossly negligent<\/a>. A bank that does not want to bear the burden of that procedure has its answer in this ruling: that burden lies with the bank, not with the customer.<\/p>\n\n\n\n For victims of phishing or bank help desk fraud.<\/strong> Report the fraud the same day, have the cards blocked, and file a complaint; in this case, those three steps helped establish that the couple had not delayed in taking action. Keep track of which actions you performed yourself and which were carried out by the fraudster: entering codes from a card reader is different from entering a transfer yourself in your banking app and confirming it via itsme, and the ruling treats both differently. Save screenshots of every confirmation prompt in itsme or in the banking app, because what that screen displayed determines whether the transaction is considered authorized. Also gather the documents that demonstrate the urgency of your situation: your income, the balance of your accounts after the fraud, and the costs you incurred to regain access to your funds. If you\u2019re unsure whether the bank is required to reimburse you after a phishing incident, the first thing we\u2019ll do for you is assess each individual transaction.<\/p>\n\n\n\n For banks and payment service providers.<\/strong> The exception in Article VII.43 of the CEL is limited to a substantiated suspicion of fraud on the part of the customer, reported in writing to the FPS Economy. Gross negligence, a set-off clause in the general terms and conditions, an ongoing criminal investigation, and a request for escrow have been rejected as grounds for postponement in three consecutive Antwerp decisions, and the Tukowiecka ruling also invalidates the first argument at the European level. Anyone wishing to challenge the classification of a transaction must demonstrate, for each transaction, who entered the order and what the customer confirmed; a general reference to authentication is not sufficient.<\/p>\n\n\n\n For anyone who is opening a phishing case.<\/strong> Consider filing for preliminary relief, but base the urgency on two grounds: the statutory deadline under Article VII.43 of the CEL and the client\u2019s specific financial situation. Break down the claim by means of authentication and anticipate the \u201citsme\u201d issue, so that a partial dismissal does not come as a surprise. Explicitly request the exclusion of the escrow; the presiding judge granted it in this case.<\/p>\n\n\n\n Yes, if it involves an unauthorized payment transaction. Article VII.43 of the CEL requires the bank to refund the amount immediately, no later than the next business day, with the debit date serving as the value date. On October 15, 2026, the Court of Justice confirmed that gross negligence is not a valid reason to refuse such a refund. However, the bank may subsequently invoke your gross negligence on the merits to reclaim the funds.<\/p>\n\n\n\n A payment is considered authorized if you personally consented to the transfer of a specific amount to a specific account. If you gave a fraudster the codes from your card reader and he used them to make transfers, then, according to the Antwerp court president, that is not considered an authorized payment. However, if you entered a transfer yourself and confirmed it via itsme because the fraudster led you to believe it was a secure account, the same judge considered that to be a valid payment.<\/p>\n\n\n\n Not necessarily. The decision of October 9, 2026, merely found, on a prima facie basis in summary proceedings, that those transactions are not subject to the immediate repayment obligation. In a trial on the merits, what matters is who entered the transfer in the banking system and what the confirmation screen displayed. If it turns out that the fraudster entered the order and you merely confirmed a screen that did not show an amount or a payee, then classifying the transaction as unauthorized remains defensible.<\/p>\n\n\n\n There is no fixed time limit, but anyone seeking summary proceedings must demonstrate the urgency of the matter in the summons and in the judgment. In this case, the presiding judge did not consider the four-month period between the fraud and the summons to be unreasonable, because the couple had reported the incident and filed a complaint within one day, had sent two demand letters, and the bank had not responded. Do not wait for a response from the bank to compile your case file.<\/p>\n\n\n\n The presiding judge of the Business Court in Antwerp has confirmed for the third time in five months that a bank in Belgium must immediately reimburse the amount of an unauthorized payment transaction resulting from phishing\u2014even in summary proceedings and before the issue of gross negligence is addressed\u2014 and that a set-off clause, a criminal investigation, or a deposit into escrow may not delay this. A new development is the distinction based on the authentication method: codes obtained by a fraudster result in an unauthorized transaction, whereas a transfer confirmed by the victim themselves via itsme does not. Six days after the decision, the Court of Justice, in the Tukowiecka ruling, provided a European legal basis for this approach.<\/p>\n\n\n\n ICT Legal Guide is the knowledge platform of the Intellectual Property, IT Law, AI Law, Data Protection, and Media Law department at Everest Attorneys, led by Joris Deene. Our attorneys assist victims of phishing and bank help desk fraud in determining the nature of each disputed transaction, issuing a notice of default to the bank, and pursuing a claim for immediate reimbursement through summary proceedings or on the merits.<\/p>\n\n\n\nThe distinction between an authorized and an unauthorized payment transaction<\/h4>\n\n\n\n
Settlement, escrow, documents, and criminal investigation<\/h4>\n\n\n\n
Legal analysis and interpretation<\/h3>\n\n\n\n
Three rulings from Antwerp in a row, and six days later, the Court of Justice<\/h4>\n\n\n\n
Is a payment that the victim confirms themselves via itsme always permitted?<\/h4>\n\n\n\n
What remains to be discussed on the merits<\/h4>\n\n\n\n
Specifically, what does this mean?<\/h3>\n\n\n\n
Frequently asked questions (FAQ)<\/h3>\n\n\n\n
Does the bank have to reimburse me immediately after a phishing incident, even if it says I was grossly negligent?<\/h4>\n\n\n\n
When is a payment following a phishing attack permitted, and when is it not?<\/h4>\n\n\n\n
Has a transfer that I confirmed myself via itsme been lost?<\/h4>\n\n\n\n
How soon should I go to court after falling victim to phishing?<\/h4>\n\n\n\n
Conclusion<\/h3>\n\n\n\n
\n\n\n\n