Credit card security in Belgium

A Belgian credit card used without you costs its holder 50 euros at most, and usually nothing. Book VII of the Code of Economic Law has organised that split since the second European payment services directive was transposed, and it holds up better than its reputation. It has one blind spot. Belgian fraud has settled there.

Contents:

• Who pays for a transaction you did not authorise
• The cases that bring the deductible to zero
• The transfers victims make themselves
• Fraudstop and blocking online banking
• The Belgian fraud figures
• The habits that hold up
• Your remedies when the bank refuses

Who pays for a transaction you did not authorise?

You do, up to 50 euros, and only for transactions made before you warned your bank or the blocking service. After that notification the issuer bears the whole loss. The FPS Economy, the Belgian federal economy department, places these rules in articles VII.38 to VII.45 of the Code of Economic Law.

One point of vocabulary governs everything else, and it is almost always skipped. An authenticated transaction is not an authorised transaction. Authentication establishes that the payment instrument and the security data were used; authorisation establishes that you consented. The FPS Economy puts it plainly: entering the correct PIN does not prove the holder agreed. It is for the bank to show the transaction was properly authenticated, recorded and booked, and for you to make it plausible that it was not authorised. Two burdens of proof, running in opposite directions, and neither matches what refusal letters imply.

The regime assumes you met three duties: using the card in line with the contract terms, keeping your security data safe, and notifying without delay as soon as you learn of a loss, theft or unauthorised use. The bank, for its part, must give you a free means of notifying at any time and must prevent any use after notification. The legal nature of the card, revolving credit facility or deferred debit, does not shift that split by a millimetre: it is described in our guide to how credit cards work in Belgium, and the terms used here are defined in our glossary of the basics.

An example puts numbers on it. A fraudster spends 480 euros with your card while you are still looking for your phone: 50 euros stay with you, 430 go back to the issuer. The same fraudster spends 480 euros an hour after your call: you owe nothing, and the discussion ends there.

The deductible falls to zero as soon as the fraud was undetectable

The 50 euro deductible has exceptions, and the first one covers most of what happens to Belgian cardholders today.

It disappears when you could not detect, before the payment, the loss, theft or misappropriation of your payment instrument. The FPS Economy points here at phishing, hacking and theft of security data, in cases where the card is still in your wallet. It also disappears when the loss stems from an act or omission of a bank employee or one of its subcontractors. It disappears, finally, when the bank does not require strong customer authentication, or when the payee or the payee's bank does not accept it. In those cases reimbursement can be refused only if you acted fraudulently yourself.

The consequence runs wider than the sector's own pages admit. The FPS Economy writes that the law provides no gross negligence exception where the payer could not detect the fraud. In a clear phishing file, in other words, the bank cannot invoke gross negligence to refuse reimbursement. It can only try to establish that at the time you knew, or should have known, that it was a scam. The gap between those two arguments decides most files, and it is rarely explained at the counter.

My view on this is settled, and I would rather write it flatly than smooth it over: for online fraud on a Belgian credit card, the 50 euro deductible has become largely theoretical. Strong authentication has been the rule since 2019, the card stays in the holder's pocket, and the first two exceptions almost always overlap. An issuer that bills you those 50 euros after a fraudulent online payment owes you an explanation of which of the three exceptions it is ruling out, and why.

The most exposed entry points remain online purchases, covered in our guide to buying online with a credit card, contactless, whose mechanics are set out in our article on contactless payment in Belgium, and subscriptions, where a virtual card confines the exposure to a single disposable number.

The Code does not cover transfers the victim makes personally

Here is the limit, and the administration states it in plain words: the rules in articles VII.38 to VII.45 do not apply to frauds in which victims transfer money themselves while the fraudster impersonates someone else. Invoice fraud, fake bank adviser, fake supplier, CEO fraud: those schemes fall outside the protective regime.

The problem fits in one sentence. Febelfin observes that fraudsters increasingly succeed in persuading their victims to carry out the transfer themselves. Fraud has therefore migrated to the one category Belgian law does not cover, and that move is no statistical accident: it is the rational answer of a criminal industry to a legal protection that works everywhere else.

For a credit card, the boundary turns on a single gesture. A payment you confirm yourself through a banking notification or a 3D Secure code, because someone manipulated you on the phone, is an authorised transaction under the Code. It then shifts from the legal regime to the contractual regime of the card schemes, that of chargeback, with its own reason codes, its own evidence and a far shorter deadline. Our guide to chargeback in Belgium sets out that second route and the reasons the Worldline portal accepts.

Acting fast still helps outside the legal regime: funds can sometimes be recovered in the first few hours, and Febelfin reports that banks detect, block or recover three quarters of the transfers resulting from phishing. The annual cost of a card changes nothing about this protection, as our pillar on how much a credit card costs in Belgium shows item by item.

What did Fraudstop change when it launched on 22 June 2026?

Before that date, 078 170 170 only blocked cards. To cut off access to your online banking and mobile app you had to reach your bank's fraud desk separately, during office hours, while the fraudster kept working. Since 22 June 2026 the same number does both. Febelfin logged more than 6,700 Fraudstop calls in the first month, around 200 a day.

I opened the FPS Economy page on phishing and unauthorised payment transactions on 31 August 2026. It carries the note « dernière mise à jour 11 avril 2023 », last updated 11 April 2023, and never mentions Fraudstop. The page that carries authority on your rights therefore predates by three years the emergency service banks now ask you to use. That gap bothers me, because it leaves the country's most reliable source incomplete on the most urgent step.

The order of the steps, within the hour:

1. Call 078 170 170. Ask for both the cards and the online banking access to be blocked. Write down the file number the operator gives you, it timestamps the notification.
2. Warn your bank and have the date and time of your notification confirmed in writing.
3. Read back the last 48 hours of your account and list the disputed transactions with amounts and times.
4. For a credit card, file the dispute form on macarte.be. The FPS Economy puts that step fifth in its list on ConsumerConnect, and I found it mentioned on no consumer-facing page of a Belgian issuer as at 31 August 2026.
5. File a complaint with your local police and forward the suspicious messages to suspect@safeonweb.be.

What follows, card replacement, the PIN sent separately, a temporary card at a branch, is set out in our guide to a lost or stolen credit card. The specific case of a card blocked while travelling is covered in our article on a card blocked abroad.

The Belgian fraud figures, taken from source

None of these sources separates credit card fraud from payment fraud as a whole. The figure I would like to publish here, the annual amount stolen on Belgian credit cards, exists in no publication available as at 31 August 2026, and I would rather say so than build an estimate. The techniques themselves are listed in our guide to credit card fraud, and disposable virtual cards answer one of them.

Which habits hold up, and which are useless?

The iVOX survey run for Bancontact Company and published on 25 June 2026 overturns a common assumption: faced with a fake bank call asking for a code received by SMS, only 50% of 12 to 17 year olds would react correctly, and just 35% know when and how to use Card Stop, against 83% of adults. Among French-speaking teenagers, 45% would not dare tell their parents, against 30% on the Dutch-speaking side. Shame delays reporting, and delay costs money.

The control points that actually change something:

• Save 078 170 170 in your phone contacts, before you need it.
• Turn on payment notifications at the lowest threshold the app allows. Beobank Alert is free but only notifies from 150 euros: on a credit card, that threshold lets through exactly the small amounts a fraudster uses to test a stolen card.
• Never call back a number received in a message or read out by a caller. Dial the number printed on the back of the card yourself.
• Bring your limits down to what you actually use, which most apps do in seconds. Our guide to the credit limit gives the room for manoeuvre by issuer.
• Keep your credit card and your debit card physically apart, so that a lost wallet never leaves you without any means of payment.

The RFID-blocking sleeve is not on that list, and that is a deliberate choice. Contactless is capped per transaction and asks for the PIN again beyond a cumulative amount, while the 49 million euros Febelfin recorded in 2024 came from phishing, not from a remote read on the metro. Buying a sleeve means protecting yourself against the risk that does not materialise.

Your remedies when the bank refuses, step by step

A refusal should be requested in writing, with reasons. A bank that suspects fraud on your part and refuses immediate reimbursement must send its reasons in writing to the FPS Economy: that duty exists, it is seldom recalled, and mentioning it in your letter often changes the tone of the reply.

The chain runs in order. You first go to your institution's complaints department, which is a mandatory step. Failing a solution within a reasonable time, you turn to the Financial Services Mediation Service, boulevard du Roi Albert II 8 box 2 in 1000 Brussels, free of charge and in writing. In parallel, the Economic Inspectorate takes reports through its contact point, and a listing at the Central Individual Credit Register following an unpaid balance born of fraud is contested separately, as our article on CCP listing explains.

Out of 2,164 files handled in 2025, the mediator found 781 well founded, so 36%, across all financial services. The report breaks the figures down neither by institution nor by type of dispute, which rules out deriving a success rate for card disputes. The price lists of Belgian issuers stay comparable line by line on our comparison tool.