If you are the victim of online fraud, act on three tracks at once: report it to the police, contact your bank or payment platform immediately and, if you can identify the other party, consider a civil claim. If a fraudster made a payment from your account without your consent, your bank must in principle refund you under Article 7:528 of the Dutch Civil Code (BW); if you authorised the payment yourself after being deceived, the loss in principle stays with you.
Speed decides most cases. A receiving account can sometimes still be blocked in the first hours after a transfer, but almost never after that.
What forms does online fraud usually take?
Most cases follow a few patterns: a purchase paid for and never delivered, a phishing message leading to a bank login, a non-existent investment, an invoice with altered payment details, or a marketplace buyer who reverses a payment after receiving the goods. The response is the same in each case: a criminal, a financial and a civil track, run in parallel.
Should you report it to the police?
Yes. Fraud (oplichting) is a criminal offence, and many forms can be reported online via politie.nl. A report rarely recovers your money by itself, but banks and insurers usually ask for it, and it allows the police to connect cases with multiple victims.
File promptly and include the advertisement or message, the account number used, the correspondence, the transaction details, the URL and dated screenshots. Keep original files where you can; the header information of an email often identifies the sender.
Can you get your money back from your bank?
This is the track most likely to produce a result, and it is time-sensitive. Call your bank immediately: if a transfer was only just made, the receiving account can sometimes be blocked before the money moves on. If you paid by credit card, ask about a chargeback straight away, because card schemes set short deadlines.
The legal position depends on how the payment was made. If a fraudster gained access to your account and paid without your involvement, the payment is unauthorised and the bank must refund it immediately under Article 7:528 BW. Under Article 7:529 BW the bank can only pass the full loss to you if you acted fraudulently, intentionally or with gross negligence (grove nalatigheid), for example by handing over your security codes.
If you authorised the payment yourself after being deceived, for example by a fake invoice or a phone call from a fake bank employee, the loss in principle lies with you. The exception is a breach of the bank’s duty of care (zorgplicht), for instance where it ignored clear signals of unusual activity. If your bank rejects your claim, you can complain to the Financial Services Complaints Institute (Kifid).
Payment platforms and online marketplaces often run their own buyer protection schemes, each with its own deadline. Use them as soon as you notice the fraud; they are usually faster than any legal route.
When can you bring a civil claim?
If the other party is identifiable, you can claim repayment or damages. Claims up to €25,000 go to the subdistrict court (kantonrechter), where you do not need a lawyer.
The obstacle is rarely the legal merits; it is identification and enforcement. With a name and address a claim is realistic. With only an account number and a message, the practical route runs through your bank and the police first.
Can a fraudulent website or listing be taken down?
Yes. A takedown request to the website or platform can limit further damage and preserve evidence. Under the EU Digital Services Act (Regulation (EU) 2022/2065), hosting providers and platforms in the EU must offer a notice-and-action mechanism for reporting illegal content, including fraudulent listings and phishing pages.
How does invoice fraud work, and who bears the loss?
Invoice fraud hits businesses hard: an email that appears to come from a genuine supplier announces new bank details. The money goes to the fraudster, the debt to the real supplier remains, and the business may end up paying twice.
The dispute that follows is between the two legitimate parties and turns on who could most reasonably have prevented the error. An example to illustrate: a company pays an invoice to a new account after an email, apparently from its usual supplier, announced a change; the email came from a fraudster who had read the correspondence. Because the change was never verified, the paying company runs a real risk of bearing the loss.
What should you check as a private individual?
- Whether you authorised the payment yourself or a fraudster paid without your involvement.
- That you have called your bank and blocked your cards and online banking.
- That you have filed a police report and kept all original messages and statements.
- Which deadline applies to a chargeback or the platform’s buyer protection.
- Whether the bank’s refusal can be put to Kifid.
What should you check as a business?
- That changed bank details are always verified by phone, on a number you already know.
- Whether your email accounts have been compromised, and which correspondence the fraudster could read.
- Whether your cyber or fraud insurance covers the loss and what it requires from you.
- Whether you must report a data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours.
What can we do for you with internet fraud?
We assist individuals and companies after online fraud; more about our work is on our IT lawyer page.
- We assess whether your bank must refund you and draft the claim to the bank.
- We prepare a complaint to Kifid if the bank refuses.
- We send a takedown notice to the platform or hosting provider.
- We try to identify the other party and bring a civil claim or attachment.
- We advise on the dispute with your supplier or customer after invoice fraud.
Summary
- Report fraud to the police promptly and keep originals of all evidence, not just screenshots.
- Contact your bank or payment platform immediately; the first hours matter most.
- For an unauthorised payment the bank must refund you (Article 7:528 BW) unless you were grossly negligent; for a payment you authorised yourself, you bear the loss unless the bank breached its duty of care.
- A civil claim works best once the other party can be identified by name and address.
- For invoice fraud, always verify changed payment details by phone before paying.
Frequently asked questions
Does my bank have to refund me if I was tricked into paying?
Not in principle. If you authorised the payment yourself, the loss stays with you unless the bank breached its duty of care. If a fraudster paid without your involvement, the bank must refund you unless you acted with gross negligence.
Where can I complain if my bank refuses?
First use the bank’s own complaints procedure. If that does not solve it, you can submit the dispute to the Financial Services Complaints Institute (Kifid).
Do I need a lawyer for a civil claim?
Not for claims up to €25,000, which go to the subdistrict court. Above that amount you must be represented by a lawyer before the district court.
