Credit Card Online Shopping in Belgium

Three out of four Belgians bought something online at least once in 2024: 76% exactly, against a 71.8% average across the EU, according to the digital economy barometer published by the FPS Economy, the Belgian federal ministry for economic affairs. Fraud follows volume. In 2024, card-not-present payments (CNP) accounted for close to 80% of card losses in the EU and the EEA, more than one billion euros, in the joint EBA-ECB report.

A credit card will not stop you from running into a dishonest merchant. It changes what you can do once the payment has left.

Chargeback is what separates a credit card from a Bancontact card

A Bancontact card debits your account and the matter ends there. If the parcel never arrives, if the product arrives broken, if the merchant takes 149 euros instead of 49, your only counterparty is the merchant — and if he stops answering, the local justice of the peace.

With a Visa or a Mastercard, you open a dispute with your bank, which pulls the money back from the merchant's account through the network, with or without his agreement. The standard window runs 120 days from the transaction, or from the promised delivery date when that falls later. Your bank will almost always want proof that you contacted the seller first: a dated email is enough, but it has to exist. Our chargeback guide covers the procedure bank by bank.

Something the comparison sites tend to skip: chargeback is not a legal right, it is a private rule of the card networks. No article of the Belgian Code of Economic Law lets you demand it. If your bank refuses to open the file, you do not take it to the FPS Economy; you go to Ombudsfin, the Belgian financial sector ombudsman, whose opinions are not binding on banks. The protection is real and fragile at the same time, and I would rather say so up front.

The gap widens elsewhere too. Money debited fraudulently comes out of your credit line, not your current account: during the 30 to 90 days a refund procedure takes, your rent and your energy direct debit still go through. With a debit card the hole is immediate, and the overdraft is yours to manage.

Then there is the dull question of acceptance. Bancontact only works in Belgium and with a handful of European partners through Bancontact Pay. On Amazon.de, Zalando or any American merchant, Visa and Mastercard are often the only methods on offer. Our credit versus debit comparison goes through the differences line by line.

What exactly does your bank do when it asks you to confirm a payment?

It applies 3D Secure, sold under the name "Visa Secure" by Visa and "Mastercard Identity Check" by Mastercard. This is the strong authentication protocol required by the PSD2 directive since 2019.

The rule fits in one sentence: the bank has to combine two elements out of three, something you know (a code, a password), something you have (the phone, the card), something you are (a fingerprint, a face). Most of the time that means a push notification in the app, an SMS code or Face ID. Without that double check, the transaction should be declined.

The list of exemptions is long. A bank may skip authentication below 30 euros, with a cumulative cap of 100 euros or five consecutive transactions. It may skip it on fixed-amount subscriptions, Netflix or Spotify for instance, on merchants you added to your trusted list, on transfers between your own accounts, and on payments its risk engine considers safe (TRA, Transaction Risk Analysis).

There is one exemption nobody discusses, and it explains the geography of fraud: PSD2 only applies when both banks, yours and the merchant's, are established in the EEA. A site whose acquiring bank sits in the United States, China or the United Kingdom will trigger no 3D Secure at all, whatever your Belgian bank does. That is mechanically where the CNP fraud counted by the EBA and the ECB concentrates, and no setting in your banking app can force an authentication the merchant never requests.

When the bank skips strong authentication although it was required, and fraud goes through, it carries 100% of the loss. Not you. That is the pillar of PSD2: whoever decides not to authenticate, pays.

And this is where the reasoning turns against you. A transaction you approved yourself, in your own app, with your own fingerprint, counts for the bank as an authorised operation. The 50-euro liability cap in Article VII.44 no longer applies, because there is no unauthorised operation within the meaning of the text. The dominant scenario in 2026 looks like this: a phone call, a fake adviser who already knows the last four digits of your card, a notification to confirm "to block a suspicious operation", and you authenticate the theft with your own hand. No comparison site puts that line in its security column.

Apple Pay and Google Pay move the problem one step away. Instead of sending your card number to the merchant, these wallets pass a unique token (tokenisation) that is useless anywhere else. If the site is breached, the intercepted token is worth nothing. In Belgium, Apple Pay works with ING, KBC, Belfius, BNP Paribas Fortis, Beobank, Argenta, Crelan, Revolut, N26 and Wise; Google Pay covers BNP Paribas Fortis, KBC, Belfius, ING, Crelan, Revolut, N26 and Wise. The setup steps are in our Apple Pay and Google Pay guides.

When a purchase goes wrong, everything hinges on dates

Fourteen calendar days from the moment the parcel reaches you, no reason required and no penalty: that is the withdrawal right in Article VI.47 of the Belgian Code of Economic Law, which transposes Directive 2011/83/EU. The merchant refunds within 14 days of your notification, using the same payment method you used to buy, and he may hold the money until the return arrives. Return shipping stays at your expense unless he failed to tell you before the order. The right covers any seller targeting the Belgian market, foreign sites included. It falls away for personalised goods, perishables, digital content already downloaded, event tickets and hotel bookings.

Article VII.44 of the same code works on different ground, that of the unauthorised operation. You have thirteen months to report it to your bank, and your liability is capped at 50 euros for anything preceding the card block. After the block you owe nothing, barring gross negligence.

Chargeback runs on 120 days and covers the commercial dispute: parcel never delivered, product not as described, double charge, subscription still debited after cancellation. Free for the cardholder.

Three deadlines, three distinct legal bases, and they stack.

For a parcel that never arrived, start with the withdrawal right, which is enforceable before a judge, and keep chargeback for the case where the merchant misses the refund deadline.

What I do not have, and it bothers me: the success rate of chargeback claims, bank by bank, in Belgium. No issuer publishes it, the National Bank of Belgium does not aggregate it in its payment statistics, and Test Achats, the Belgian consumer organisation, keeps no long series on it. I can tell you the procedure is free and governed by network rules. I cannot tell you how many files succeed at BNP Paribas Fortis rather than at Belfius, and anyone quoting that figure made it up.

Which card should you reach for, depending on the site?

The choice follows the buying context, and the same wallet can hold two answers.

Unknown site, one-off purchase: Revolut. The app allows up to 20 active virtual cards and a disposable card whose number renews after every transaction. Free on the Standard plan. Our virtual card guide compares the issuers available in Belgium.

Purchase outside the eurozone: Wise or Revolut. Both apply the real interbank rate. A standard Belgian bank card adds 1.5 to 2% in conversion fees. On 500 euros spent with an American merchant, that is a 7 to 10 euro gap.

Recurring online spending: Beobank Extra Mastercard. 1% cashback on every purchase, the highest rate I found at a traditional Belgian issuer in the official pricing conditions in force on 1 August 2026.

French or Dutch support and a branch you can walk into: ING, KBC or Belfius. 3D Secure and chargeback behave in exactly the same way whichever the issuer; what changes is who picks up the phone when a file stalls.

My own call, and it is not the consensus one: above 200 euros with a merchant I do not know, I pay with the credit card from my Belgian bank rather than with a Revolut disposable. The disposable protects a card number. The dispute gets settled with a human, and when it drags on for three months, a branch in Brussels that answers weighs more than a chat whose first tier is automated. For 30 euros on a Chinese marketplace, I do the opposite.

Then comes currency conversion, which often costs more than everything else combined. When a foreign site detects a Belgian card, it offers to charge you in euros rather than in its own currency. The rate on display carries a 3 to 5% margin, sometimes more, and the merchant or his provider pockets it. Decline it every time: your bank will apply its own rate, almost always better. Amazon.de and Booking.com present this option by default.

Your own bank's conversion fees come on top, on any purchase outside the euro. Budget 1.5 to 2% at ING, KBC and Belfius, around 1.6% at BNP Paribas Fortis. Revolut on the Standard plan converts free of charge on weekdays at the interbank rate and adds 1% at weekends; Wise starts at 0.33%, shown before you confirm. Our hidden fees guide sets out the full grid.

One last item, and it gets overlooked. Since the Act of 19 July 2018, Article VII.30 of the Code of Economic Law forbids a merchant established in Belgium from charging a supplement for a consumer Visa or Mastercard payment. "Card transaction fees" on a Belgian or European site are illegal and can be reported to the FPS Economy contact point. Outside the EEA the ban does not apply, and some merchants take advantage of it.

The one habit everyone repeats that no longer filters anything

Check for the HTTPS padlock. It is the advice on every prevention page, and it no longer separates good sites from bad ones. An SSL certificate has been free since Let's Encrypt and takes three minutes to obtain; scam sites have one, obviously. The padlock guarantees your card number travels encrypted, it says nothing about the merchant's honesty.

What does filter is the company number. A merchant selling in Belgium must show a physical address and a company number in its terms and conditions. Check it against the Crossroads Bank for Enterprises, the Belgian company register, at kbo-bce.fgov.be. A missing number, or one pointing to a struck-off company, settles the question in thirty seconds. The BeCommerce label, now Safeshops.be, adds an audited code of conduct, but it covers only part of the Belgian market and its absence proves nothing.

Turn on transaction notifications in your banking app. They mainly help you catch small test debits: a fraudster often runs 1 or 2 euros through to validate a number before going for three figures. If an unknown payment shows up, block the card in the app, then call Card Stop, the Belgian national card blocking line, on 078 170 170. Our fraud guide sets out the full procedure, from blocking the card to filing a police report.

No merchant, no bank and no network will ever ask for your PIN for an online purchase. A form requesting it is a scam, without exception, and 3D Secure never runs through the merchant's own website.

For everything else, forward doubtful messages to suspect@safeonweb.be. The Centre for Cybersecurity Belgium handled 9,929,354 of them in 2025 and flagged 176,183 malicious URLs, according to its 2025 key figures. The service also publishes ongoing phishing campaigns; it is the only free Belgian source kept current on the subject.

Card Stop answers 24 hours a day on 078 170 170. Write the number down somewhere other than the phone you will lose at the same time as the card.