Phishing and internet fraud: when must your bank refund you?

Phishing and internet fraud are criminal offences under Dutch law. A fraudster who tricks you into handing over login details or transferring money commits fraud (oplichting) under article 326 of the Dutch Criminal Code, and often unauthorised access to a computer system (computervredebreuk) under article 138ab as well. If money has left your account without your consent, your bank must in principle refund it under article 7:528 of the Dutch Civil Code. The main exception: the bank does not have to pay if it can show you acted fraudulently or with gross negligence. Speed matters, so report the incident to your bank and file a police report as soon as you notice it.

What counts as phishing under Dutch law?

Phishing is deception in which a criminal poses as an organisation you trust to obtain your credentials or money. Dutch law does not use the word phishing, but it punishes the conduct behind it.

The fraudster may pretend to be a bank, a payment provider, a delivery company or the Dutch tax authority (Belastingdienst). The aim is to obtain login credentials, payment card details, a verification code or a signature in a banking app. The medium varies: an email, an SMS message (smishing), a phone call from someone claiming to be from the bank’s fraud desk (vishing), a message on WhatsApp or LinkedIn, or a cloned website behind a sponsored search result.

Several provisions of the Dutch Criminal Code (Wetboek van Strafrecht) can apply at once:

• Posing as a bank to move someone to hand over money or data is fraud under article 326.
• Logging into an account with credentials obtained that way is unauthorised access under article 138ab.
• Using another person’s identifying data to cause harm or gain an advantage is punishable under article 231b.
• Forging documents or a digital record falls under article 225.
• Misusing payment cards or the data behind them falls under article 232.
• Where an attack ends in encrypted files and a ransom demand, article 350a (altering or destroying data) and article 317 (extortion) come into play.

What counts as internet fraud?

Internet fraud is the wider category: any deception carried out through an online channel. Legally, most forms run through the same provision, article 326 of the Criminal Code.

Internet fraud covers webshops that take payment and never ship, fake rental listings and investment scams built around cryptocurrency. It also covers invoice fraud, in which a supplier’s bank details are silently changed, and CEO fraud, in which a finance employee receives an urgent payment instruction that appears to come from a director. The core is always the same: a deceptive act that moves someone to part with money, goods or data.

The practical difference between phishing and the wider category is where the loss arises. In a phishing case the money usually leaves a payment account without your consent. That brings the payment services rules in Book 7 of the Civil Code into play. In a webshop or investment scam you transfer the money yourself. Recovery then becomes a civil matter against the fraudster and, sometimes, against the platform or the bank that received the funds.

How do you recognise a phishing message?

Look at what the message asks you to do, not at its spelling. Modern phishing messages are well written and often personalised, so the old advice about spelling mistakes is no longer enough.

Three signals remain reliable:

• The message creates time pressure. It tells you an account has been blocked or a payment will be reversed unless you act now.
• It steers you away from the channels you normally use. It asks you to click a link or call a number, rather than open your own banking app.
• It asks for something a bank never asks for: a verification code, a signature in your banking app for a transaction you did not start, or permission to install remote access software on your device.

Can you get your money back from the bank?

Usually, yes. If you did not consent to a payment, the bank must in principle refund it immediately, unless you acted fraudulently or with gross negligence.

A payment transaction to which the payer did not consent is an unauthorised transaction within the meaning of article 7:522 paragraph 2 of the Dutch Civil Code. Article 7:528 paragraph 1 then obliges the payment service provider to refund the amount immediately and restore the account to the state it would have been in. The starting point, in other words, is that the bank carries the loss.

The exception sits in article 7:529 paragraph 1. The bank does not have to refund if the account holder acted fraudulently, or intentionally or with gross negligence failed to meet the duties in article 7:524. Those duties require you to use the payment instrument in line with the applicable conditions and security measures. Gross negligence is a high bar. It is judged on all the circumstances, not on the fact of the loss alone. The law adds a further protection: where the bank did not require strong customer authentication, you in principle bear no loss unless you acted fraudulently.

What can you do if the bank refuses to pay?

As a consumer, you can take the dispute to the Financial Services Complaints Institute (Klachteninstituut Financiële Dienstverlening, Kifid) or to the civil court. Kifid will only deal with your complaint after you have completed the bank’s internal complaints procedure.

Business account holders are in a different position. They fall outside most of the consumer protections and depend largely on their contract with the bank and on general liability rules. That makes a company’s internal payment controls all the more important.

Can you claim damages from the fraudster or a negligent organisation?

Yes. Where the perpetrator is identified, you can recover the loss as an unlawful act (onrechtmatige daad) under article 6:162 of the Civil Code. A claim against an organisation whose poor security made the fraud possible runs through the same article.

Against the perpetrator, this most often happens inside the criminal case. Under article 51f of the Dutch Code of Criminal Procedure you can join the criminal proceedings as an injured party (benadeelde partij) and ask the criminal court to award compensation. That is usually cheaper and faster than a separate civil claim. The court will only deal with a claim that does not place a disproportionate burden on the criminal proceedings. Your loss must therefore be documented and straightforward to calculate.

A second route is a claim against an organisation whose security fell short. Think of the employer whose mailbox was compromised, the platform that allowed a seller to operate without any verification, or the processor that leaked a customer database. The standard applied is what a careful organisation should have done, given the state of the art and the sensitivity of the data. The rights of victims of cyberattacks sets out how notification duties, compensation and insurance interact in those cases. Proof is usually the hard part; our article on how to prove digital deception deals with the evidence that carries weight.

What does the GDPR require of organisations hit by phishing?

A successful phishing attack on a company almost always produces a personal data breach. The organisation must then report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay and, where feasible, within 72 hours.

Article 32 of the GDPR requires controllers and processors to take appropriate technical and organisational security measures. Article 33 contains the duty to report a breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the people concerned. Where the risk to those people is high, article 34 adds a duty to inform them directly. The Autoriteit Persoonsgegevens then asks what preceded the attack, such as multi-factor authentication and limited access rights. Who is responsible after a data breach works through how liability is allocated.

Which reporting duties apply under the Cyberbeveiligingswet?

Since 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet), which implements the NIS2 Directive, applies alongside the GDPR. Organisations within its scope must report significant incidents in stages: an early warning within 24 hours, a notification within 72 hours and a final report within one month.

Organisations that fall within the Act must also register with the National Cyber Security Centre (NCSC). They must take measures under a duty of care covering risk management, supply chain security and incident handling. The board must approve those measures, oversee their implementation and follow training, so cybersecurity is a management responsibility and not only a matter for IT.

The two regimes overlap but are not the same. A phishing incident that compromises a mailbox may trigger a GDPR notification to the Autoriteit Persoonsgegevens and a separate incident report under the Cyberbeveiligingswet, on different deadlines and to different authorities. Work out in advance which regime applies to your organisation, and who makes the call at three in the morning. Our guide on cybersecurity incident reporting duties sets the deadlines side by side.

What if the fraudster or the money is abroad?

File a police report (aangifte) in the Netherlands anyway. An offence directed at a victim in the Netherlands is generally treated as committed here, so the Dutch police and prosecutor are the right starting point even when the perpetrator is abroad.

Evidence from another state is obtained through established channels. Within the EU, the European Investigation Order lets a Dutch prosecutor request account data or the freezing of funds in another member state; beyond the EU, the Budapest Convention on Cybercrime of 2001 provides for mutual assistance.

For you as a victim, this has a practical consequence. Recovery of the funds usually depends on how quickly the receiving bank can be alerted, because money moved through a mule account is dispersed within hours. Reporting to your own bank immediately, so it can attempt a recall, is more likely to produce a result than any later legal step.

What should you check as a private account holder?

Check first whether you gave consent to the payment yourself, because that decides whether Articles 7:528 and 7:529 of the Dutch Civil Code apply. Then work through these points:

• Did you call your bank’s official fraud number and ask for a recall on the same day?
• Did you sign or approve the transaction in your banking app, or did money leave without any action on your side?
• Has the bank given a written refusal with reasons, so you can start its internal complaints procedure?
• Have you kept the original message, call log and transaction references?
• Have you filed a police report (aangifte), which most insurers and any later injured-party claim require?

What should you check as an organisation?

Check whether your payment controls and security measures would stand up to scrutiny by the Autoriteit Persoonsgegevens, which looks at what preceded the attack. A business account falls largely outside the consumer protections, so prevention carries more weight:

• Is multi-factor authentication active on every account that can reach company data?
• Is every change to supplier bank details verified by telephone, on a number you already had on file?
• Can one person both create and release a payment, or is there a four-eyes check?
• Is there a written first-hour plan: who isolates the account, preserves the logs and contacts the bank?
• Do you know whether you fall under the Cyberbeveiligingswet and must report within 24 hours?
• Has staff training been repeated in the last year with realistic simulated phishing messages?

What should you do if you have been targeted?

Contact your bank first, then secure your accounts, preserve the evidence and report to the police. Act in this order:

1. Contact your bank through its official fraud number and ask for the transaction to be blocked or recalled.
2. Change the credentials of the compromised account and of any other account using the same password.
3. Preserve everything: the original message with its headers, screenshots, transaction references and the times at which you noticed each step.
4. File a police report. Most insurers require one, and it is the basis for any later claim as an injured party.
5. If personal data of others has been exposed, assess the notification duties under the GDPR and, where applicable, the Cyberbeveiligingswet before the deadlines run out.

What can we do for you with phishing and internet fraud?

Our criminal lawyers and IT law team (see our Dutch IT law guides) act for victims and for organisations after an incident:

• We review the bank’s refusal against Articles 7:528 and 7:529 of the Civil Code and draft your complaint to the bank.
• We prepare and file your complaint with Kifid once the bank’s internal procedure is completed.
• We draw up a documented injured-party claim (vordering benadeelde partij) for the criminal case under Article 51f of the Code of Criminal Procedure.
• We assess within 72 hours whether a data breach must be reported under the GDPR and, if applicable, the Cyberbeveiligingswet.
• We draft liability claims against a platform or organisation whose security fell short.

Summary

• Phishing and internet fraud are punishable in the Netherlands, mainly as fraud (article 326 Criminal Code) and unauthorised access (article 138ab).
• For a payment you did not authorise, the bank must in principle refund you immediately (article 7:528 Civil Code), unless you acted fraudulently or with gross negligence (article 7:529).
• If the bank refuses, consumers can go to Kifid after the bank’s internal complaints procedure, or to the civil court.
• Organisations hit by phishing must assess a GDPR notification within 72 hours and, if within scope, report under the Cyberbeveiligingswet (24 hours, 72 hours, one month).
• Call your bank immediately and file a police report: speed is often decisive for recovering the money.

Frequently asked questions