Credit Card Online Shopping in Belgium

Three out of four Belgians shop online, according to Statbel data. Average basket sizes keep climbing, foreign websites multiply, and scams follow. In 2024, card-not-present (CNP) fraud accounted for nearly 80% of card-related losses in the EU and EEA — over one billion euros, according to the joint EBA-ECB report. The good news: in Belgium, a credit card remains the best-protected payment method for online shopping, provided you understand how it works.

Why is a credit card safer than Bancontact for online shopping?

Three mechanisms set credit cards apart from Bancontact debit cards when buying online.

The first is chargeback. If a merchant fails to deliver, ships a defective product or debits the wrong amount, you can dispute the payment through your bank within 120 days on Visa and Mastercard. The bank recovers the funds via the payment network, whether the merchant agrees or not. Bancontact does not offer this mechanism — for disputes, you're left with direct negotiation or the justice of the peace. A full chargeback guide details the procedure bank by bank.

The second is the credit buffer. In case of fraud, the debited amount comes from your credit line, not your current account. Your cash flow isn't affected during the refund process, which can take 30 to 90 days. With a debit card, the money disappears from your account immediately.

The third is international coverage. Visa and Mastercard networks are accepted on virtually every online store worldwide. Bancontact remains limited to Belgium and a few European partners via Bancontact Pay. For purchases on Amazon.de, Zalando or an American website, a credit card is often the only option. A credit vs debit comparison explores these differences further.

How does 3D Secure work in Belgium?

3D Secure — branded "Visa Secure" by Visa and "Mastercard Identity Check" by Mastercard — is the strong authentication protocol mandated by the PSD2 directive since 2019. During an online purchase, your bank asks you to confirm the transaction via a second factor: a push notification in the banking app, an SMS code or biometric verification (fingerprint, facial recognition).

The protocol relies on Strong Customer Authentication (SCA), which requires combining two elements out of three: something you know (PIN, password), something you have (smartphone, card) and something you are (biometrics). Without this dual verification, the transaction should normally be rejected.

Exemptions exist. Banks may bypass 3D Secure in five cases: transactions below 30 euros (capped at a cumulative 100 euros or five consecutive transactions), recurring payments with a fixed amount (Netflix, Spotify subscriptions), beneficiaries added to your trusted list in the banking app, transactions deemed low-risk by the bank's behavioural analysis (TRA, Transaction Risk Analysis), and transfers between your own accounts.

If 3D Secure is not applied and fraud occurs, the bank bears 100% of the losses — not the consumer. This is a core PSD2 protection: liability falls on the entity that decided to skip strong authentication.

What are your rights if something goes wrong with an online purchase?

Belgian and European law provides three layers of protection for credit card online purchases.

The withdrawal right (14 days). Article VI.47 of the Belgian Code of Economic Law grants you 14 calendar days from receiving the product to cancel any online purchase, without reason or penalty. The merchant must refund within 14 days of your notification. This right, derived from EU Directive 2011/83/EU on consumer rights, applies to any seller targeting the Belgian market, including foreign websites. Exceptions: personalised goods, perishable items, digital content already downloaded, event tickets and hotel bookings.

PSD2 fraud protection (13 months). If a transaction appears on your statement without your authorisation, Article VII.44 of the Code of Economic Law protects you. Your maximum liability is 50 euros for transactions before the card was blocked. If the bank did not require strong authentication, it bears the full amount. You have 13 months to report the transaction. Our credit card fraud guide details the Card Stop procedure.

Visa/Mastercard chargeback (120 days). For commercial disputes — non-delivery, non-conforming product, double charge — chargeback lets you recover the payment through your bank. This is not a legal right but a contractual obligation of the card networks. The procedure is free for consumers.

These three protections can be combined. For a product that never arrived, start with the withdrawal right, then escalate to chargeback if the merchant doesn't refund.

Which card should you choose for online shopping in Belgium?

The best choice depends on your shopping profile. Here are the options ranked by use case.

For maximum security: Revolut. The app offers up to 20 active virtual cards and a disposable card whose number renews after each transaction. If you're buying from an unknown website, the disposable card is the best protection available in Belgium. Cost: free on the Standard plan. Details in our virtual card guide.

For international purchases without conversion fees: Wise or Revolut. Both apply the real interbank exchange rate with no markup. A traditional Belgian bank card typically adds 1.5 to 2% in conversion fees on purchases outside the eurozone. On a 500-euro purchase from an American website, that's a difference of 7 to 10 euros.

For cashback on online purchases: Beobank Extra Mastercard. The card offers 1% cashback on all purchases. Traditional Belgian banks don't offer significant cashback on online purchases — cashback remains dominated by neobanks (Revolut up to 1% depending on the plan).

For simplicity with local support: ING, KBC or Belfius. If you prefer a Belgian banking app with French and Dutch support and primarily buy from European websites in euros, a Visa or Mastercard from a traditional bank works well. 3D Secure and chargeback function identically regardless of the issuer.

How to avoid hidden fees on international online purchases?

Two traps await Belgian shoppers on foreign websites.

DCC (Dynamic Currency Conversion). When a foreign website detects that your card is Belgian, it may offer to charge you in euros instead of the local currency. The exchange rate includes a margin of 3 to 5%, sometimes more. Amazon.de, Booking.com and many other sites display this option by default. The rule is simple: always decline DCC and pay in the merchant's currency. Your bank will apply its own conversion rate — usually better. With Wise or Revolut, this rate is the real interbank rate with no margin.

Your bank's conversion fees. Every purchase in a currency other than euros triggers conversion fees. At ING, KBC and Belfius, expect 1.5 to 2% of the amount. At BNP Paribas Fortis, the surcharge is around 1.6%. With Revolut (Standard plan), conversion is free on weekdays at the interbank rate, with a 1% markup on weekends. With Wise, the interbank rate applies with transparent conversion fees starting from 0.33%. For full details, see our hidden fees guide.

The surcharge ban. Since August 2018 (Act of 19 July 2018), Article VII.30 of the Code of Economic Law prohibits merchants in Belgium from charging extra fees for consumer Visa or Mastercard payments. If a European website adds "card transaction fees", it's illegal. Report it to the FPS Economy via pointdecontact.belgique.be.

How to protect yourself against fraud when shopping online?

Six habits reduce the risk to near zero.

Use a virtual or disposable card. For any purchase on a website you don't know, create a virtual card through Revolut, N26, Wise or Bunq. The number stays isolated from your main card. Revolut offers disposable cards whose details expire after each use — the best option for one-off purchases.

Check for the HTTPS padlock. The absence of HTTPS means your card number travels unencrypted across the network. No serious website accepts payments without an SSL certificate in 2026.

Enable real-time notifications. All Belgian banking apps (ING, KBC, Belfius, BNP, Beobank) and neobanks send a push notification for every transaction. If a payment appears that you didn't initiate, block the card in the app and call Card Stop (078 170 170).

Never enter your PIN online. No online store, no bank and no payment network will ever ask for your PIN code for an online purchase. If a form requests it, it's a scam. 3D Secure works through the banking app or an SMS code, never through the merchant's website.

Check Safeonweb.be. The Centre for Cybersecurity Belgium (CCB) publishes current alerts. Forward any suspicious message to suspect@safeonweb.be — in 2025, the service processed over 9.9 million reports and identified 176,000 fraudulent URLs.

Monitor your statements. Article VII.44 of the Code of Economic Law gives you 13 months to dispute a fraudulent transaction, but the sooner you act, the faster the resolution. Check your statement weekly, paying special attention to small amounts — fraudsters often test a card with a 1 or 2 euro charge before striking harder.

Is contactless smartphone payment safe for online purchases?

Apple Pay and Google Pay add a security layer to online purchases and in-app payments. Instead of transmitting your real card number, these wallets use tokenisation: a unique token replaces your card number for each transaction. Even if the merchant suffers a data breach, the intercepted token cannot be reused.

In Belgium, Apple Pay is compatible with ING, KBC, Belfius, BNP Paribas Fortis, Beobank, Argenta, Crelan, Revolut, N26 and Wise. Google Pay is available at BNP Paribas Fortis, KBC, Belfius, ING, Crelan, Revolut, N26 and Wise. Details are in our Apple Pay and Google Pay guides.

For purchases on mobile or in apps (Uber, Deliveroo, Bolt), Apple Pay and Google Pay are safer than manually entering a card number: biometrics (Face ID, fingerprint) replace standard 3D Secure, and the real card number is never shared with the merchant.

FAQ

Answers to frequently asked questions about online credit card purchases in Belgium are detailed in the FAQ section above.