Belgium's draft anti-phishing bill would tighten proof rules but leave some reimbursement disputes open.
Why it matters: The proposal could shift more proof onto payment-service providers, but it does not clearly promise reimbursement whenever a customer enters a code or confirms an Itsme request. Consumers and providers may still contest whether the customer authorized the payment or was deceived.
- The Council of Ministers approved the draft in first reading on October 16, 2026, and sent it to the Council of State for advice.
- The government's published summary says providers would have to prove authorization, not merely technical authentication.
- Where providers have objectively justified grounds to suspect fraud, intentional misconduct or gross negligence, they would have 15 working days to reimburse the customer or issue a reasoned refusal.
- The published summary does not say that every customer who enters a code or confirms an authentication request for a fraudulent payment must be reimbursed.
Belgium's proposed anti-online-fraud bill would clarify that a payment is not authorized when a third party initiated or modified it without the user's consent, according to the federal government's published summary. The Council of Ministers approved the draft in first reading on October 16, 2026, and sent it to the Council of State for advice.
The material cited here identifies the measure as the draft anti-online-fraud bill but does not provide a formal title or proposal number. The summary says payment-service providers would have to prove authorization, rather than showing only that a transaction passed technical authentication. Existing Belgian consumer guidance says, “Authentication does not automatically prove your consent.”
That distinction matters for scams in which a customer enters a code or confirms an Itsme authentication request while believing they are stopping fraud, updating security settings or receiving help. Het Laatste Nieuws reported that such customers may still face a dispute over authorization.
The published summary, as described above, does not state that every such confirmation requires reimbursement. That is an analysis of what the summary does not say, not a definitive interpretation of the bill.
The 15-working-day period is presented as applying when a provider has objectively justified grounds to suspect fraud, intentional misconduct or gross negligence. In those cases, the provider must reimburse the customer or issue a reasoned refusal and identify complaint bodies. Existing consumer guidance allows refusal where a provider proves gross negligence or knowing, voluntary participation in fraud, subject to rules for phishing victims.
The Council of State's review concerns the draft's legal and legislative quality. It will not itself resolve how Itsme confirmations are treated; that issue remains subject to the final text and later interpretation or dispute resolution.
By the numbers
- 15 working days - proposed deadline to reimburse or issue a reasoned refusal in cases involving objectively justified suspicion
- October 16, 2026 - date the Council of Ministers approved the draft in first reading
Yes, but: The government's published summary is not the draft text and does not provide a formal proposal number in the material cited here. The reimbursement treatment of customer-confirmed authentication requests therefore remains subject to the final legislation and later interpretation.
What's next: The Council of State is expected to review the draft's legal and legislative quality. The final text and subsequent complaint or dispute proceedings will determine how authentication confirmations are treated.