Online fraud and phishing: how do you prove it under Dutch law?

Online fraud and phishing are proven in the Netherlands with digital evidence: messages, e-mail headers, screenshots, bank records and login data that show the offender deceived you on purpose. Under Article 326 of the Dutch Criminal Code (Sr), fraud (oplichting) requires deception by a false name or capacity, a cunning trick or a web of lies; phishing that only steals a password is usually charged as computer intrusion or misuse of identity data instead.

This article explains which offences apply, which evidence decides these cases, how to report fraud, and how you can get your money back through your bank, the criminal case or a civil claim. See also our pages on phishing and internet fraud and fraud in the Netherlands.

Which criminal offences cover online fraud and phishing?

Several offences in the Criminal Code apply, and a phishing case is usually charged under more than one. The core offence is fraud under Article 326 Sr, which carries a maximum of four years’ imprisonment or a fifth-category fine.

For fraud, the Public Prosecution Service (Openbaar Ministerie) must prove that the suspect used a false name or capacity, a cunning trick or a web of lies; that this moved the victim to hand over property, provide a service, make data available or incur a debt; and that the suspect aimed at unlawful gain. A single lie is often not enough.

Other offences often apply in phishing cases:

• Computer intrusion (computervredebreuk), Article 138ab Sr: intentionally and unlawfully entering a computer system, for example with a stolen password; maximum two years.
• Misuse of identity data, Article 231b Sr: using another person’s identifying data to hide or misuse an identity; maximum five years.
• Theft using false keys, Article 311(1)(5°) Sr: emptying an account with captured login data.
• Money laundering, Article 420bis Sr: for example by “money mules” who make their bank account available; culpable money laundering (Article 420quater Sr) applies if the person should reasonably have suspected the criminal origin.

What do fraudsters typically do?

Most cases follow a few patterns: impersonation, time pressure and an urgent request for money or data. Fraudsters pose as a bank, the Dutch Tax and Customs Administration (Belastingdienst), a parcel service such as PostNL, or a family member with a “new phone number” on WhatsApp.

Investment scams promise high returns on crypto or trading platforms and allow small withdrawals first to build trust. Romance scams build a relationship over weeks before asking for money. Account takeover and SIM swapping give criminals access to your accounts and security codes. Deepfake audio and video make impersonation more convincing; see our article on AI and criminal law.

Which evidence decides these cases?

A case stands or falls with evidence secured early. Under Article 163 of the Dutch Code of Criminal Procedure (Sv) you can file a report (aangifte) orally or in writing, and what you can hand over at that moment often determines whether the case is investigated.

Collect and keep, in their original form where possible:

• The messages, e-mails and their headers, with dates and times.
• Screenshots of fake websites, profiles and payment requests, including the URL.
• Bank statements and transfer details, including the receiving account number (IBAN).
• Crypto wallet addresses and transaction hashes.
• A written timeline of what happened, made as soon as possible.

How do investigators trace the offender?

Investigators link messages, logins and payments to a person. They request data from banks, telecom providers and crypto exchanges, which must identify their customers under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft).

Forensic copies of devices, IP addresses, device identifiers and login times build a timeline. Under Article 125k Sv, investigators can order someone who knows how a system or encryption works to give access, but Article 125k(3) Sv states that this order may not be given to the suspect.

Evidence must be obtained lawfully. If you as a victim hack the fraudster’s account to collect proof, you may commit computer intrusion yourself.

Where do you report online fraud?

Report to the police first, online via politie.nl or at a police station. Under Article 161 Sv anyone who knows of a criminal offence may report it, and your bank and insurer usually ask for a copy of the report.

• Your bank: immediately, to block cards and accounts and to request a refund or recall of the payment.
• The Fraud Help Desk (Fraudehelpdesk): for advice and registration of the scam.
• The Central Identity Fraud Disclosure Office (CMI): if your identity documents or data have been misused.
• ConsuWijzer of the Authority for Consumers and Markets (ACM): for misleading online shops.
• The European Consumer Centre Netherlands: if a company in another EU country is involved.

Victim Support Netherlands (Slachtofferhulp Nederland) provides practical help with the report and the criminal case. Serious fraud involving businesses can also be investigated by the Fiscal Information and Investigation Service (FIOD). See our guide on how to file a police report.

How do you get your money back?

There are three routes: your bank, the criminal case and a civil claim. They can be combined, and speed matters in all three.

When must your bank refund you?

For an unauthorised payment, your bank must refund you no later than the end of the next business day under Article 7:528 BW. You must report the transaction without delay and at the latest 13 months after the debit date (Article 7:526 BW).

If you deny authorising a payment, Article 7:527 BW requires the bank to prove that the transaction was authenticated and correctly recorded. You bear the loss yourself only if you acted fraudulently, or intentionally or with gross negligence failed to protect your security details (Article 7:529 BW).

The difficult cases are payments you made yourself under deception, for example after a call from a fake bank employee. Legally these are authorised payments, so Article 7:528 BW does not apply. Banks then assess the case under their own policies, and a complaint can go to the Financial Services Complaints Tribunal (Kifid).

Can you claim damages in the criminal case?

Yes. Under Article 51f Sv anyone who suffered direct damage from a criminal offence can join the criminal proceedings as an injured party (benadeelde partij) and claim compensation.

This is a low-cost route, but it only works if a suspect is prosecuted. The criminal court only awards claims that are simple enough to decide in the criminal case; complex claims are referred to the civil court.

Can you sue the account holder?

Yes. If you know the IBAN that received your money, you can claim against the account holder under tort law (Article 6:162 BW), including a money mule who made the account available. A bailiff can attach the account (conservatoir beslag) to secure your claim once the court has given leave under Article 700 Rv.

Under Article 194 of the Dutch Code of Civil Procedure (Rv) you can request data about a legal relationship from whoever holds it, if you have a sufficient interest. See also our article on the reformed right to inspect evidence.

What should you check as a victim?

• Have you called your bank and blocked cards and accounts the same day?
• Have you reported the unauthorised transactions within 13 months of the debit date?
• Have you filed a police report and kept a copy?
• Have you saved all messages, headers, screenshots and transaction details?
• Do you know the receiving IBAN or wallet address for a civil claim or attachment?
• Have you changed passwords and checked recovery e-mail addresses and phone numbers?

What should you check if you are accused?

• Which offences are in the summons: fraud (Article 326 Sr), computer intrusion (Article 138ab Sr) or money laundering (Article 420bis or 420quater Sr)?
• Did you knowingly make your bank account or identity available, or were you misled yourself?
• How was the digital evidence obtained, and can it be linked to you personally?
• Which claims has the injured party filed under Article 51f Sv?
• Remember that you have the right to remain silent and to consult a lawyer before the police interview.

What can we do for you with online fraud and phishing?

Our criminal lawyers assist victims and suspects in online fraud cases; see also our page on cybercrime.

• We help you prepare the police report and the evidence file.
• We draft your claim as an injured party under Article 51f Sv.
• We challenge a bank’s refusal to refund and prepare a complaint to Kifid.
• We claim damages from the account holder and request leave for an attachment.
• We defend you if you are suspected of fraud, computer intrusion or money laundering.

Summary

• Fraud under Article 326 Sr requires a specific means of deception; phishing is often charged as computer intrusion or identity misuse as well.
• Secure messages, headers, screenshots and payment data immediately.
• Report to your bank and the police at once; unauthorised payments must be reported within 13 months (Article 7:526 BW).
• Payments you authorised yourself under deception are not covered by the statutory refund rule.
• You can claim damages in the criminal case (Article 51f Sv) or from the account holder in a civil case.

Frequently asked questions