Landmark Belgian Ruling Forces Banks to Repay Phishing Victims

In a groundbreaking decision that will reshape consumer protection in Belgium, the Court of Cassation has ruled that banks must reimburse phishing victims unless they can prove “gross negligence” — a standard now defined so narrowly that most victims will qualify for repayment. The ruling follows a six-year legal battle by Stijn Gansemans, a 57-year-old entrepreneur from Oud-Heverlee who lost €25,000 to scammers at KBC bank.

The Case That Changed Everything

On January 23, 2020, Gansemans received a fraudulent SMS claiming he had an outstanding tax debt of €89. He clicked the link, which led to a fake KBC payment portal, and unwittingly gave fraudsters access to his accounts. Overnight, criminals transferred €24,852.15 in dozens of small transactions to foreign accounts, as reported by Het Laatste Nieuws.

KBC refused to reimburse him, arguing he had been “grossly negligent.” Gansemans sued, winning in the first court in March 2021. But KBC appealed, and the Brussels Court of Appeal only heard the case in mid-2025, overturning the ruling. Undeterred, Gansemans took his fight to Belgium’s highest court.

The Landmark Ruling

On June 29, 2026, the Court of Cassation delivered its verdict. For the first time, it defined “gross negligence” in the context of phishing as “conduct that a reasonable, normally careful payer would never engage in or never omit.” The court established that:

• The threshold for gross negligence is exceptionally high
• The bank bears the full burden of proof
• Simply clicking a link to a convincingly fake payment portal does not constitute gross negligence
• Courts must review gross negligence claims as a question of law, not fact

Legal expert Joris Deene of Everest Advocaten told ICT Rechtswijzer that the ruling confirms gross negligence is “a high, verifiable threshold” that cannot be based on unproven assumptions.

A Victory for All Victims

The ruling applies retroactively to all pending and future phishing cases in Belgium. Gansemans’ lawyer, Tom De Smet of LM&DS, explained the significance: “The Court of Cassation has — once and for all — determined what should be considered ‘gross negligence.’ Almost all phishing victims now have a very solid basis to litigate and win against their bank.”

Gansemans himself said his fight was never just about the money: “The battle with my former bank KBC has already cost me a lot of money. But that hasn’t been the point for a long time. It’s about justice.”

Legislative Action Follows

Minister of Consumer Protection Rob Beenders (Vooruit) is using the Cassation ruling as the foundation for new legislation, presented to the Council of Ministers on July 17, 2026. The proposed law, detailed by HLN, will clearly define authorized versus unauthorized payments, require banks to publish Ombudsfin advice, and mandate upfront reimbursement within one business day.

“By consistently waving the term ‘gross negligence,’ banks have created the atmosphere that phishing is almost always the customer’s fault,” Beenders said. “That is not correct.”

The Scale of the Problem

Phishing in Belgium has reached epidemic proportions. Criminals stole approximately €93 million through phishing in 2025 alone, up from €50 million in 2024. Before this ruling, banks systematically invoked “gross negligence” to refuse reimbursement, forcing victims into costly legal battles. An HLN investigation from 2021 revealed that banks were systematically leaving victims out in the cold.

What Happens Next

Gansemans has not yet received his money back. The case has been referred to the Antwerp Court of Appeal, with a decision expected in 2027. Meanwhile, the new law is expected to pass by the end of 2026, ahead of anticipated EU-wide legislation in 2028.

For Gansemans, the mission is already accomplished: “I have been able to show that as an ordinary citizen, it is not impossible to win against a big bank. It is even possible for an individual to change an unfair system. I hope that inspires others and gives them the courage to continue their own fight.”