In bank helpdesk fraud, whether you are compensated depends heavily on who carried out the payments and what you actually consented to. Did the fraudster carry out transactions without your consent? Then different rules apply than when you yourself transferred money to a so-called safe account. In 2026, Kifid, the Dutch Financial Services Complaints Tribunal, once again clarified this distinction. A bank may therefore not dismiss a claim solely by stating that your security codes were used.
Nederlands: Lees dit artikel in het Nederlands: Bankhelpdeskfraude: wanneer vergoedt de bank uw schade?
Türkçe: Bu makaleyi Türkçe okuyun: Banka yardım masası dolandırıcılığı: banka zararınızı ne zaman karşılar?
Written by Onur Arslan, attorney at Arslan Advocaten. Registered in the specialisation register of the Netherlands Bar for employment law and personal injury. Last updated: 17 September 2026.
Have you just been scammed? Call your bank on its official number, have your access and payment instruments secured and report which transactions you dispute. Ask immediately whether payments can be stopped or recalled. In addition, have it assessed which claim for damages fits your situation. Acting quickly can limit losses, but does not guarantee that the money is still available.
What is bank helpdesk fraud?
A scammer poses as an employee of your bank, a fraud department or another trusted organisation. The message is usually urgent: your account has supposedly been hacked or your savings are at risk. You are then given instructions that in fact give access to your money, such as installing an app, passing on a code or transferring an amount yourself.
The phone number on your screen may look convincing. The caller may also already know personal details. That does not prove you are speaking to the bank. If you suspect fraud, it is wise to end the call and contact the bank through a channel you have looked up yourself. Do not use a number the caller gives you.
The legal assessment then starts with the exact actions taken. Did you only enable access to a device? Did you confirm the registration of a device? Or did you yourself enter and approve a transfer order? For a victim these events may look similar, but under payment services law they can have different outcomes.
First limit the damage and secure the evidence
Ask the bank to secure your digital access, investigate the disputed transactions and, where possible, submit a recall request. Have the bank confirm in writing when you reported the fraud. Also check scheduled payments, new payees, changes to limits and linked devices. Ask the bank which security steps are needed in your situation.
Keep messages, phone numbers, screenshots and relevant emails. Shortly after the incident, write down a timeline: when were you called, what did the caller say, what actions did you take and what did you see on the screen? Make clear what you know for certain and what you are unsure about. An honest, incomplete memory is better than assumptions filled in later.
File a police report and keep proof of it. The criminal route and your civil claim against the bank can run side by side. A police report does not automatically lead to reimbursement by the bank. Conversely, a civil assessment need not always wait until a suspect has been found or convicted.
The key distinction for reimbursement
| Situation | Main legal question |
|---|---|
| The fraudster carries out the transactions without your consent | Are these unauthorised payments, and does a statutory exception to reimbursement apply? |
| You carry out the transfers yourself on the fraudster’s instructions | Are the payments authorised, and has the bank also breached its duty of care? |
| You only confirm a device or access | What exactly did your consent relate to, and who gave the payment orders? |
| The facts are still unclear | Which technical data and statements are needed to reconstruct the transactions? |
A correct PIN, app confirmation or other authentication does not make the question of consent superfluous. So ask the bank for more than the conclusion that the transactions were “properly authorised”. Have the bank explain which action, in its view, constitutes your consent to these particular payments.
If the fraudster made payments without your consent
The Dutch Civil Code (BW) contains a specific scheme for unauthorised payments. The bank must in principle reimburse, subject to applicable exceptions. Relevant factors include timely reporting, the security obligations and any fraudulent, intentional or grossly negligent conduct on the part of the account holder.
It is not enough to label every mistake by a victim automatically as gross negligence. The circumstances in which details were disclosed, the deception used and what the customer actually understood must be examined. Payment services law has a specific allocation of the burden of assertion and the burden of proof; this may not be replaced by a general reproach that you should have been more careful.
If your claim is rejected, ask which statutory exception the bank is invoking exactly and on which facts it is based. Challenge incorrect assumptions with your timeline and the available data. The separate article on unauthorised payments explains this route in more detail.
What changed in Kifid’s assessment in 2026
In ruling 2026-0022, the Kifid Appeals Committee (Commissie van Beroep) clarified the assessment of gross negligence. In that case, fraudsters had carried out the payments after gaining access through deception. A breach of a security rule was not in itself sufficient to set aside the statutory reimbursement obligation.
A central question in the assessment is whether the consumer was aware of the danger and acted nonetheless. The deception itself may explain why that awareness was lacking. The ruling therefore calls for a specific analysis of the course of events. It does not provide a general guarantee that every victim of telephone fraud will be compensated for all their loss.
Moreover, the procedural outcome of a case may be limited by what the parties challenged on appeal. Do not, therefore, use a news report or an amount of damages mentioned in it as an automatic calculation for your own claim. What matters is the legal rule, the factual similarity and the procedural position in your own file.
If you transferred money to a safe account yourself
An account that a fraudster calls “safe” is not a legal protective arrangement. When you yourself enter and confirm a specific transfer, the payment may be authorised within the meaning of payment services law, even if a scammer deceived you about its purpose. The scheme for unauthorised payments then does not automatically apply.
In ruling 2026-0026, the Appeals Committee rejected a claim in which the consumers had made the transfers themselves. In addition, the bank had contacted them about a payment and was then given a different explanation by the customer. The facts of such a phone call can therefore be essential to the assessment.
Even with payments you carried out yourself, it may be worthwhile to examine the duty of care. The question is then, for example, whether the bank was aware of specific signs of misuse and failed to respond adequately. That requires a different line of argument than simply stating that the destination turned out afterwards to be fraudulent.
When can the bank’s duty of care play a role?
A bank must act with due care within its role and the circumstances of the case. However, it is not automatically obliged to stop every unusual payment or to discuss it with the customer in advance. A payment account can also legitimately be used for large, new or foreign transactions.
What may be relevant is what the bank actually knew at the time it acted, which warnings or blocks were in place and which information you provided. Think of an account takeover that had already been reported, or specific indications that an account was being misused. A later discovery does not in itself make earlier knowledge plausible.
Make clear which specific measure you believe the bank should have taken and how that would have prevented the loss. Without that link, a complaint often remains too general. Read about this structure in the article on liability for breach of the bank’s duty of care.
What must the bank explain about the transactions?
Ask for an overview of times, payment orders, devices used, relevant confirmations and changes to limits. Also ask whether calls with you were recorded and request the personal data from relevant call recordings. Describe which facts you want to verify with them. This makes the request targeted and easier to carry out.
A log entry can show that a technical process was completed successfully, but often needs explaining. Who was able to operate the device? Was a code intended for a payment or for linking a new device? What text did the user see? Have technical terms translated into the actions alleged in your file.
You are not automatically entitled to the bank’s complete internal fraud detection software or to all data of other customers. That does not alter the fact that a rejection must be sufficiently transparent for you to be able to challenge the relevant facts. If the bank refuses, ask for a targeted explanation and a less intrusive way of providing the information.
A goodwill payment is a different route from a statutory right
Some banks have a policy for certain forms of bank helpdesk fraud. Conditions may attach to it, for example regarding the type of deception and the bank involved. Ask which policy applied on the date of the incident and why, in the bank’s view, your case does or does not fall under it.
A rejection under a goodwill scheme does not automatically decide on a statutory reimbursement obligation or a duty of care claim. Conversely, a goodwill payment does not necessarily mean that the bank accepts liability. Keep these legal bases separate in your complaint, so that not just one part is assessed.
Read any settlement agreement offered to you carefully. Check whether payment is linked to a full and final discharge and which transactions and parties it covers. An offer can be a practical solution, but the consequences for any remaining claims must be clear before you agree.
How do you calculate the damages claimed?
Start with a table of transactions showing the date, amount, destination, dispute and any amount received back. Deduct recalled amounts and other compensation where legally necessary to avoid double compensation. Keep the principal sum, interest and additional costs separate.
Not every additional burden is automatically recoverable. Costs must fit the applicable legal basis and be sufficiently connected with the failing you allege against the bank. Reasonableness and substantiation may also play a role. Keep invoices, therefore, and explain why the costs were necessary.
If you had to borrow money to pay fixed expenses, record the circumstances and terms. A payment problem may support urgency, but does not automatically prove liability. The same applies to stress and other non-financial consequences: they deserve attention, while compensation for them is subject to its own legal test.
Building a complaint in five parts
- Describe the events chronologically and without certainty added in hindsight.
- State for each payment why you dispute consent or which breach of the duty of care you allege.
- Ask the bank to examine the relevant technical data and communications.
- Specify the amount claimed and set off any amounts received in a transparent way.
- Ask for a reasoned final position and information about the options for further action.
Enclose the most important documents and refer to numbered annexes. A short, clear covering letter with a timeline and a table of transactions usually works better than an unstructured bundle of messages. Present unknown facts as questions; do not present them as proven actions of the bank.
Kifid and court proceedings
After the internal complaints procedure, a consumer can often turn to Kifid if the bank is affiliated and the case falls within its jurisdiction and time limits. Check whether the procedure is binding and what consequences that choice has. A binding decision can later be reviewed by the court only to a limited extent.
In court, factors such as the competent court, legal costs, evidence and any mandatory legal representation play a role. Urgent proceedings are not suitable in every damages case. Where interim relief is needed, the urgent interest must be made concrete.
Do not wait for legal advice until the bank has completed all its internal investigations if time limits are about to expire. A payment report, a complaint, a notice of liability and the interruption of the limitation period are not always the same thing. Have it established which step is needed to safeguard your rights.
Reconstruct the call without filling in the missing pieces yourself
After bank helpdesk fraud, victims sometimes remember events in fragments. Write down a timeline as soon as possible, therefore, but make clear which parts you know for certain and which you are unsure about. Note who called, which number was on the screen, which instructions were given and which action you then actually took. A later technical finding may supplement or correct your first recollection.
In the case of a home visit, what matters is what you handed over and what the visitor did. In the case of remote assistance, what matters is which application was installed and whether someone else could control the screen. Keep messages and screenshots insofar as it is safe to do so. If in doubt, ask for help in securing data; do not give a supposed recovery agent access to your online banking again.
Then make a separate entry for each payment. It may be that you carried out one transaction yourself and the fraudster another later. A single general label for the entire event can then obscure the legal difference. In addition to the amount and time, note on which device you believe the order was given and which confirmation you saw.
Do not change your statement to make it fit better with a compensation process. On the contrary, point out an error in an earlier answer explicitly and explain how you discovered it. A reliable reconstruction is more important than a seemingly perfect story. Ask the bank to preserve missing technical data, even if it has not yet been established which data it can provide to you. The final assessment must be based on the complete picture of the facts.
Frequently asked questions about bank helpdesk fraud
Will I always get my money back if my bank’s number was displayed?
No. The displayed number may be part of the deception, but it does not by itself determine the legal outcome. Who made the payments, what you consented to and how the bank responded are also relevant.
Is passing on a code always gross negligence?
No. The context and meaning of the code must be examined. In 2026 the Appeals Committee emphasised that a breach of a security rule does not in itself amount to gross negligence. That does not remove your own reporting and security obligations.
Can the bank recover money from the receiving bank?
Sometimes a recall request or a prompt fraud report can help, but success depends on factors such as whether the money is still available and the procedures involved. Ask for action immediately and for written confirmation. A request is no guarantee that the money will be returned.
Do I have to wait for the police before I file a complaint?
Usually not. Report the fraud immediately and raise your civil claims in good time. Give the bank the police report number as soon as you have it. A criminal investigation and the assessment of your claim serve different purposes.
Does the same apply to a business account?
Not always. In business payment relationships, contractual deviations and other complaint options may play a role. Have the account holder, the applicable terms and conditions and the statutory protection assessed separately. A consumer ruling cannot simply be applied to every business.
Which documents does Arslan Advocaten need?
The bank statements, complaint and rejection, your timeline, relevant messages, police report and any available explanation of the transactions are a useful start. With these, Arslan Advocaten can assess the payment services law route and any duty of care claim. The next steps and costs appropriate to your file are discussed in advance.
Sources and legal basis
- Kifid Appeals Committee 2026-0022 on unauthorised payments and gross negligence.
- Kifid Appeals Committee 2026-0026 on payments carried out by the customer.
- Kifid explanation on payments carried out by the customer in bank helpdesk fraud.
- Kifid regulations and articles of association.
Sources checked on 16 September 2026. Any specific compensation depends on the facts, the applicable terms and conditions, the legal basis and the procedural position.
