Belgian banks' phishing refund terms stricter than law, minister Beenders says

Terms stricter than the law

Belgian consumer protection minister Rob Beenders (Vooruit) said on Saturday, 31 October, that some banks set stricter rules in their general terms and conditions for refunding phishing victims than the law permits. He called on the banks to bring their terms into line with the legislation. In April, Beenders asked the Commission on Unfair Terms at the Federal Public Service Economy to examine the fine print of the banks on phishing. The review covered the terms of the six largest banks in the country, and it found that some add conditions that do not appear in the law.

“I note that the general terms and conditions do not match the law at all banks. That is unacceptable.”

The minister's concern is that these weaker terms reduce the protection phishing victims are entitled to. The law requires immediate compensation unless there are reasonable grounds to suspect the victim committed fraud. The review nonetheless confirmed that some banks attach extra conditions or reservations before they pay out.

Gross negligence and the court ruling

The review also found very broad readings of gross negligence in the terms. Some banks classify sharing a code with family or friends, or leaving a card unattended, as gross negligence. The Belgian Court of Cassation describes the concept as conduct that a reasonable, normally careful payer would never adopt, or never fail to adopt, so it has to be read strictly and banks cannot simply invoke it. About two weeks before the minister spoke, the Court of Justice of the European Union ruled that banks must immediately refund the amount of unauthorised payments to phishing victims, even where gross negligence is alleged. Under that ruling, customers should in principle get their money back first, and the bank can only afterwards try to prove serious negligence.

Febelfin and consumer rights

Beenders intends to take the matter up with Febelfin, the sector federation. He wants every consumer to know which rights apply when criminals withdraw money from an account. In his view, a phishing victim should not also have to work out which terms their bank applies in order to learn whether the money will come back. The minister said the legal protection must apply to everyone.

“A bank cannot limit consumers' statutory protection through its general terms and conditions.”

He added that banks must respect the rules and that general terms must not become a way to avoid their legal obligations.

What it means for victims

Because the review concerned the banks' general terms, the practical question for a victim is which set of terms applies. The minister argued that the answer should be the same at every bank, and that the statutory rule should decide the outcome rather than contract wording.