For twenty years, banks have had to convince people to stop managing their banking affairs on paper and at a counter. I helped build that trust over the course of twenty years. I installed the first cash deposit machines, helped make bank branches a thing of the past, and expanded internet and mobile banking. Belgium became an international leader in secure banking apps. But the real achievement was that millions of people entrusted their money to pixels.
Access to banking apps is highly secure. Initially via the card reader, and later also via Itsme – a system developed by the banking sector – which, with 8 million users, is Belgium’s most widely used app.
But a secure front door is not enough. Banks must also monitor what happens to our money behind it. Because consumers and businesses are increasingly confronted with transactions they do not recognise, initiate or authorise. Last year, people reported nearly 10 million suspicious messages to Safe-on-web. That illustrates the scale of the problem. Artificial intelligence will only make fraud cheaper, more convincing and more scalable. ‘The customer must be more vigilant’ is therefore not a serious security model.
Go to the police first
Unauthorised transactions may involve a customer passing on codes or access details. The customer may also make a payment themselves after being misled. Equally, they may discover a payment or direct debit they do not recognise and dispute ever having authorised it. These are three different situations that are all too easily lumped together under the broad heading of ‘phishing’, with the underlying message being that the customer was not careful enough.
For example, a young saver recently lost a large portion of her savings in the space of a few days, shortly after her eighteenth birthday. She did not recognise the overseas transactions and disputed that she had carried them out. However, the focus immediately turned to what she might have done wrong. She had to go to the police first before the bank was willing to proceed with her case. That is a strange reversal: it is not the bank that has to prove how the money could have disappeared. The customer has to try to prove what they did not do. Making statements, gathering documents and sometimes waiting for months. Chatbots and hard-to-reach call centres sometimes make giving up the simplest solution.
The police are used as the first point of contact, even though they cannot reconstruct the transactions. Who can? The bank. It has access to the transaction log: payment behaviour, time, location, device and sequence. Moreover, it could have intervened itself in the event of unusual transactions. An extra check, a temporary block or a phone call from a human could have made all the difference.
Law and practice.
By law, a bank is obliged to refund an unauthorised payment immediately, or by the end of the next working day at the latest. Only a reasonable suspicion of fraud on the part of the customer themselves, reported in writing to the competent authority, can suspend that immediate refund. An allegation of gross negligence is therefore not sufficient. Correct card details or means of authentication do not in themselves prove that the customer actually gave consent.
The Antwerp Commercial Court recently applied this logic strictly: refund first, argue later. This concerns an enforceable but provisional order in summary proceedings, not a final judgment on the merits.
The issue is also before the European courts. Advocate General Athanasios Rantos stated in March 2026 that gross negligence only comes into play afterwards, at the stage of the final allocation of the loss. His opinion is authoritative, but the Court of Justice has not yet delivered a judgment on the matter. The Belgian Court of Cassation has, in the meantime, raised the burden of proof for gross negligence, but has not ruled on the immediate obligation to repay.
In practice, therefore, this order is too often reversed: first, the victim must go to the police, establish a prima facie case of innocence and go through the bank’s internal process. Only then does the bank decide on reimbursement. This is socially inefficient and conflicts with the protective rationale of the law.
Duty of care
It is true that banks already prevent a great deal of fraud. The sector also rightly points out that fraud often begins outside the bank: on social media, via telecoms channels or through deception. Technology companies, telecoms operators, the government, the police, the judiciary and members of the public all bear responsibility. Nevertheless, the banking sector’s response is not sufficient. Shared responsibility does not mean equal responsibility.
Users must remain vigilant. Passing on codes or being careless with suspicious phone calls carries risks. But banks must put the same effort into security as they once did when turning their branches into fortresses. Now that our relationship with money is digital, the protection must be just as robust.
Banks have access to unprecedented amounts of data, computing power and AI. They are more profitable than I have ever seen in a quarter of a century in banking. Healthy banks are essential. But that financial and technological clout creates a special duty of care. If banks wish to retain their customers’ trust, they must allocate more resources to joint real-time fraud detection and rapid assistance for victims. If social media companies are profiting from fraudulent adverts, swift action must be taken. Banks must therefore also collaborate closely with technology companies, telecoms operators, the police and the government.
I still believe in digital banking. The speed and convenience are a huge improvement on paper and branch counters. That is why this is so close to my heart: I see the seeds of a crisis of confidence. If we want to prevent this, we must protect the trust we have built up over the next twenty years. As the first line of defence for our financial records, banks cannot shirk that responsibility.
Geert Van Mol worked in the banking sector for 20 years. From 2016 to 2021, he was Chief Digital Officer (CDO) at Belfius. He turned the bank’s app into one of the best in Europe. In 2018, he was voted Chief Digital Officer of the Year. In October 2024, he published the book *Rebel Rebel – On Rock ’n’ Roll and False Notes in Digital*. In this book, he draws a comparison between the music world and the way in which companies need to innovate. The book was named Marketing Book of the Month by the Belgian Association of Marketing. Since then, he has also become a much sought-after speaker.
This opinion piece previously appeared in the financial newspaper ‘De Tijd’.
