Major banks' small print gives phishing victims fewer rights than the law, advisory committee finds

A number of Belgian banks impose stricter rules in their general terms and conditions than the law requires when customers lose money through phishing. That is the finding of an investigation by the Unfair Terms Committee of the FPS Economy into the terms of the country's six largest banks, VRT NWS reports, after De Tijd was first to report on it. The investigation was carried out at the request of Consumer Protection Minister Rob Beenders (Vooruit). The reports do not say which banks are concerned.

According to the committee, some banks add conditions and clauses that are not in the law, and apply a very broad interpretation of the concept of gross negligence. Examples cited include sharing a code with family or friends and leaving a bank card unattended. Business AM writes that some banks build in extra hurdles or reservations before refunding stolen money.

The legal framework is nonetheless clear, the reports show. About two weeks ago the European Court of Justice ruled that banks must refund unauthorised payments immediately, by the next working day at the latest. Only where fraud by the customer is suspected does that obligation not apply; where gross negligence is suspected it does, after which the bank can try to prove that negligence. The Court of Cassation also holds that gross negligence must be interpreted strictly.

Beenders calls it unacceptable that not all terms are in line with the law and warns that general terms must not become a way out of legal obligations. He wants to discuss the matter with Febelfin. It is not his first step on the issue: in April he had already asked all banks for the checklists they use to decide whether a customer was grossly negligent, according to the minister's website. He then cited ECB figures showing that consumers in Belgium bear 92 percent of losses from fraudulent transfers themselves, compared with a European average of 85 percent.