After a landmark ruling by the Court of Cassation, banks in Belgium may more often have to compensate victims of online fraud because the country’s highest court has set a very strict test for what counts as “gross negligence.”
According to De Tijd, the Court of Cassation last month overturned a judgment by the Brussels Court of Appeal, which had ruled in 2025 that a man had been grossly negligent after falling victim to online banking fraud.
In January 2020, the KBC customer received a text message about an “outstanding tax debt.” He clicked on the link and completed a procedure using his bank card and card reader.
By doing so, he unknowingly installed the banking app on a fraudster’s mobile phone. He also ignored two warning text messages from KBC.
The phisher then stole €24,850.
The Court of Cassation said those facts alone were not enough to amount to gross negligence.
The significance of the ruling lies mainly in the precedent it sets. Under the law, if a payment was not authorised by the customer, the bank must refund the money unless it can prove that the customer acted with gross negligence.
In phishing cases, banks have almost always relied on that exception.
However, the law does not define gross negligence, which has led to widely differing outcomes in court cases.
The Court of Cassation has now defined it as “conduct that a reasonable, normally careful payer would never engage in, or would never fail to engage in.”
In practice, that means a victim is only at fault if a normal bank customer would under no circumstances ever have acted in the same way.
The Cassation court’s interpretation is effectively binding on all lower courts and tribunals, which risk having their judgments overturned if they depart from it.
