Bank fraud and phishing: what to do within the hour
A text from "your bank", a call from an "adviser" who knows your name, a message from a relative who has "changed number". Once the money has gone, every minute counts — and one distinction decides whether you will be refunded. Here it is, with the steps in order.
A notification, a link, a code: often that is all a fraudster needs.
The first hour, in order
Do not start by trying to understand what happened. Start by cutting off access to your money, then document.
📞
1. Block your cards: Card StopCall Card Stop on 078 170 170, day and night, or block the card in your bank's app. Note the time and the case number you are given: from that moment on, further transactions are no longer at your expense.
🏦
2. Call your bankOn the official number printed on the back of your card or on its website — never one from a text or an incoming call. Have online access blocked, registered devices revoked, and ask the bank to attempt a recall of the transfers that went out: on an instant transfer, that is often the only chance.
🔐
3. Cut off accessIf you installed an app at a stranger's request (remote control), uninstall it and disconnect the device from the internet. Change the passwords for your bank, your mailbox and your itsme account from another device.
👮
4. Report it to the policeDescribe the facts in order, with screenshots, calling numbers, links and transfer references. The police report is the document your bank will ask for.
📨
5. Report the messageForward the fraudulent email or text to suspect@safeonweb.be, run by the Centre for Cybersecurity Belgium. It will not get your money back, but it gets the link blocked before it traps someone else.
⏱️
Until you have reported the loss or theft, fraudulent transactions may partly remain at your expense. After the report they no longer do, unless you acted fraudulently. Hence the order: block first, understand later.
Refunded or not: the deciding distinction
Belgian payment services law draws a clear line, and it matters far more than the amount lost:
✅
A transaction you did not authoriseYour card was used, or someone approved a payment in your place. The bank must refund you immediately, at the latest by the end of the working day after your report — apart from a small statutory excess for what happened before the block. It can only refuse by proving fraud on your part or gross negligence.
⚠️
A transfer you approved yourselfA fraudster persuaded you to make the transfer: fake bank adviser, fake relative, fake investment. In the bank's eyes the transaction is authorised — you initiated and confirmed it. In principle it is then not obliged to refund you, even though you were deceived.
Between the two lies the most disputed zone: you passed on codes from your card or card reader, or confirmed in itsme a transaction that was presented to you as something else. Banks then invoke gross negligence; but they have to prove it, and the fact that their system recorded the transaction is not, on its own, enough. Each case is judged on its circumstances: a very convincing trap is not the same thing as obvious carelessness.
✍️
In your statement to the bank and the police, describe exactly what you were told and what you were made to do, in order, with screenshots. Do not write "I made a transfer" if you were made to "confirm a cancellation": what the fraudster led you to believe is precisely what tips the case.
The most common scenarios
📱
The fake text or email from the bankA link to a perfect copy of your bank's website, asking you to log in and then for "a confirmation". The link is the weapon: a bank never sends you a link to log in.
☎️
The fake bank adviserThey call, sometimes displaying your bank's real number, know your name and IBAN, and announce fraud in progress on your account. To "block" it, they get you to approve transactions or move your money to a "safe account". No safe account exists.
💬
The relative with a new number"Mum, I lost my phone, this is my new number" — followed by an urgent bill. Call your relative on their usual number before paying anything at all.
📦
The fake buyer on a classifieds siteThey want to pay you through a "secure payment" or delivery link that asks for your card details. To receive money, you never need to give your card codes.
📈
The fake investmentA high, guaranteed return, often a crypto or trading platform promoted by a celebrity on social media. Always check the company's name against the FSMA warning lists before sending a single euro — and reread our beginner's guide to ETFs: a real investment is never guaranteed.
If the bank refuses
A refusal is not the end of the case. Ask for it in writing, with reasons: the bank has to explain what your gross negligence supposedly consisted of. First file a complaint with the bank's own complaints department.
If the answer does not satisfy you, Ombudsfin, the financial sector's ombudsman service, examines disputes between customers and banks free of charge. Its opinion is not binding, but banks often follow it, and it rests on the precise circumstances of the trap. As a last resort, the courts remain open.
Check your insurance too: some family liability, home or credit card policies cover online fraud or identity theft. It is little known, and almost never claimed.
Spotting the scam beforehand
Almost every successful fraud rests on the same three levers: urgency, the authority of someone who seems official, and secrecy — "don't hang up", "don't tell the branch". When all three come together, that is the signal to stop.
🚫
Your bank will never ask youFor your secret codes, your card reader codes, to confirm a transaction in itsme to "cancel" something, to install a remote assistance app, or to move your money to a "security account".
👀
Read the confirmation screenitsme and banking apps show what you are confirming: an amount, a payee, a login. If what is displayed does not match what you think you are doing, refuse.
🔎
Use payee verificationSince October 2025, banks in the euro area check whether the payee's name matches the IBAN before a transfer. A "name does not match" warning is not a technical detail: it is often the last signal before the scam.
⏸️
Hang up and call backFaced with a worrying call, hang up, then call your bank yourself on its official number. A real adviser will never hold it against you.
What we do not put figures on
The amount of the statutory excess that can remain at your expense before the block, and the maximum deadlines for disputing a transaction: these values are not extracted from our sources, and we do not publish them. The mechanism is described above, and it does not change: reporting quickly reduces what stays at your expense, and gross negligence has to be proven by the bank.
For a large loss, a lawyer or a consumer association can help you build the case. And talk about it: victims often stay silent out of shame, while fraudsters target everyone, at every age.
🚨
Your bank will never call you to get you to move your money. If someone does, it is the fraudster — whatever number is displayed.
