Hacked bank card: what to do and who refunds you

If your card was hacked while it never left your pocket, you are in principle refunded in full, without even the EUR 50 excess. Block the card, report each line in writing, and the issuer must refund you by the next business day at the latest. The only real fight is over payments you approved yourself.

Has your card really been hacked?

Not always. A good share of the "fraud" disputes that landed on my desk in Liège were not fraud at all. Before you call, take two minutes to read the line.

In the files I handled, the most expensive mistake was ignoring the test. A EUR 1 debit under a meaningless name, which the cardholder let slide because the sum was trivial. Three days later the real series arrived.

What should you do in the first hour?

Block first, understand later. This is the order I gave cardholders on the phone, with no guarantee of outcome:

1. Block the card in your issuer's app, or through Card Stop, Belgium's central card-blocking service, on 078 170 170 (+32 78 170 170 from abroad), day and night.
2. Write down the exact time of the block. It is the first thing read in the file.
3. Take a screenshot of the statement showing the suspicious lines.
4. Write to the issuer the same day: each disputed line, its date, its amount, and the fact that the card was in your possession.
5. File a police report and keep the report number.
6. If a message or a fake website was the source, forward it to suspect@safeonweb.be, the address of Safeonweb, the federal cybersecurity awareness service.

Do not start by investigating how the number leaked. The file is read from the time of your report, not from your detective work. The article on Card Stop explains what blocking covers and what it does not.

Who pays if the card never left your pocket?

The issuer, in full, in principle. The rules are in Article VII.44 of the Code of Economic Law, Book VII (Belgium's law on payment and credit services), which transposes Article 74 of Directive (EU) 2015/2366, known as PSD2.

Two rules work in your favour after a hack, and people often confuse them with the EUR 50 excess. First: if you could not detect the misuse before the payment, the excess does not apply. A number copied while the card sits in your wallet falls squarely into that case. Second: a transaction made without strong authentication, with no PIN and no approval in the app, stays with the issuer unless you acted fraudulently. Belgian banking lawyer Laurent Frankignoul sums it up in a note dated 2 October 2025: in that case, "the solution is simple".

The fourth line is the only one truly in dispute. It is covered in depth in the article on gross negligence, in light of the Court of Cassation ruling of 29 June 2026.

Do you have to file a police report to be refunded?

No, it is not a legal condition. Yes, you should file one anyway.

Book VII does not make the refund depend on a police report. Issuers ask for one regardless. Buy Way says so in the Mastercard One user guide, September 2025 edition: for fraudulent use, the police report will be requested. A file that includes it from the first letter does not come back asking for documents. A file without it loses a week.

How fast is the refund, and what happens to the interest?

One business day. Article VII.43 requires the refund by the end of the first business day after your report. The issuer can only wait if it suspects fraud on your part and puts that in writing to the FPS Economy, the federal ministry for the economy. Your own deadline is thirteen months after the debit (Article VII.41), but every week you lose becomes an argument against you.

On a credit card, a hack carries a cost nobody mentions: interest. If the fraudulent line slips into the carried balance while the case is examined, it earns interest at the contract rate. Here are two cards with their three figures.

Take EUR 800 of fraudulent spending left three months on the credit line, at a 14.50% APR. It earns about EUR 27.50 in interest. Over twelve months, that would come to nearly EUR 116. These amounts are my own calculations, at the equivalent monthly rate, with no new purchases. They should never stay with you: Article 73 of PSD2 requires the value date of the refund to be no later than the date of the debit.

The brochure does not highlight this: on a deferred debit card, you have a window. The line appears on the statement before it leaves your current account. Write before the direct debit date, asking for the disputed lines to be removed from the amount collected.

Do contactless and online payments change anything?

They change things in your favour, as long as you approved nothing. Delegated Regulation (EU) 2018/389 allows contactless payments without a PIN up to EUR 50 each. The PIN becomes mandatory again after EUR 150 in total, or after five consecutive payments. Some issuers are stricter: Buy Way sets the running total at EUR 100. A payment made under those thresholds, without a PIN, is a payment without strong authentication. The loss falls on the issuer.

Online, everything turns on one question: were you asked to approve the payment in the app, through Visa's or Mastercard's 3-D Secure? If not, the same rule as contactless applies. If you did approve it, because a voice on the phone told you to, the file changes nature.

The issuer looks first at the authentication log: which channel, which device, what time. Ask for a copy in writing if the case drags on.

Where can you turn if the issuer refuses?

First to its complaints department, in writing, demanding the precise reason for the refusal. At Buy Way the published address is claims@buyway.be; at Fimaser, fimaser.sav@fimaser.be.

Then to Ombudsfin, the Belgian ombudsman for financial disputes. The procedure is free, entirely in writing, and open within a year of your complaint to the issuer. Its opinion does not bind the bank. It still carries weight: in the files I handled, the mere mention of a referral often reopened a closed case.

If the debits have dug a balance you can no longer repay while the case is examined, talk early to an accredited debt mediation service or to the CPAS, your municipality's public social welfare centre. This article does not replace advice suited to your situation.

Three numbers to note before you need them

Card Stop, 078 170 170. Your issuer's blocking line, for example 02 320 25 95 at Buy Way. And the address of its complaints department. Write them down somewhere other than on the card.

If the card was physically lost or stolen, the rules differ slightly: see the article on a lost or stolen card. To compare cards on what they cost, the ranking of Belgian credit cards, the comparison tool and the selection guide start from the same checked rates.

Sources, accessed on 9 October 2026. Allocation of losses, absence of strong authentication and undetectable misuse: Article VII.44 of the Code of Economic Law, Book VII, and Articles 73 and 74 of Directive (EU) 2015/2366; commentary by Laurent Frankignoul, 2 October 2025. Reporting deadline and refund by the first business day: Articles VII.41 and VII.43 of the same Code. Contactless thresholds: Delegated Regulation (EU) 2018/389, Article 11. Blocking: Card Stop. Reporting fraudulent messages: Safeonweb. Recourse: Ombudsfin. Mastercard One Buy Way: user guide, September 2025, accessed on 9 October 2026 (annual fee, APR, withdrawal, contactless, blocking, police report). Carrefour Visa: Fimaser comparison of credit forms, version 7 of 2026, accessed on 9 October 2026 (APR by bracket); annual fee checked at the issuer on 31 August 2026. Interest on EUR 800: author's calculation, 9 October 2026. No link in this article is paid for.