Do you see a payment that you did not authorise? Report it to your bank immediately and dispute the transaction in writing. In the case of an unauthorised payment, the bank must in principle refund the amount immediately, and no later than the end of the following business day after it became aware of it or was notified of it. There are exceptions, including cases of fraud by the payer and certain breaches of security obligations.
Nederlands: Lees dit artikel in het Nederlands: Niet-toegestane betaling: wanneer krijgt u geld terug van de bank?
Türkçe: Bu makaleyi Türkçe okuyun: Yetkisiz ödeme: bankadan paranızı ne zaman geri alırsınız?
Written by Onur Arslan, attorney at Arslan Advocaten. Registered in the specialisation register of the Netherlands Bar for employment law and personal injury. Last updated: 17 September 2026.
A technically correct login or a security code that was used does not in itself prove that you consented to the payment. The bank must investigate the relevant facts. Your own account of the incident, the type of transaction and the technical data are all important in that respect. The refund rules differ from those that apply to an ordinary complaint about a purchase that you did pay for yourself.
When is a payment unauthorised?
A payment is authorised if the payer has consented to its execution in the agreed form and in accordance with the agreed procedure. If that consent is missing, the transaction is in principle unauthorised. Think of a transfer made by someone who gained access to your online banking without permission, or card use to which you did not consent.
Not every unwelcome outcome makes a payment unauthorised. You may knowingly pay for a product that is then never delivered. You may also transfer money yourself because a fraudster has deceived you. In that case, consent to the specific payment order may exist, while there is a separate dispute about the purchase or the deception.
So first establish exactly what you agreed to. Permission to link a device is not necessarily consent to every payment that someone else subsequently makes. Conversely, entering and confirming an amount and a payee yourself may well amount to consent to that payment.
Authentication and consent are separate questions
Authentication concerns the verification of, for example, a user, a payment instrument or a security credential. Consent concerns agreement to the payment order. The two concepts are related, but they are not the same. A fraudster can use security credentials without the account holder having given them permission to transfer money.
Article 7:527 of the Dutch Civil Code (BW) contains rules on evidence where a user denies having consented. Authentication, recording and the absence of technical failures, among other things, are then relevant. The mere recorded use of a payment instrument is not necessarily sufficient to prove consent or fraudulent, intentional or grossly negligent conduct.
Therefore ask the bank which specific action, in its view, proves your consent. Was it a confirmation on your own phone, an order via a device linked later, or an action by an authorised representative? The answer must relate to the transaction you are disputing, not merely to the general security of the banking system.
What to do immediately after discovery
Contact the bank via an official number or the secure online banking environment. Report which payments you do not recognise and, where necessary, ask for the payment instrument or digital access to be blocked. State when you discovered the incident. Ask for a case number and confirmation of your report.
Check whether any orders are still pending and whether contact details, linked devices or limits have been changed. Follow your bank’s security instructions via a verified channel. Preserve relevant data before you wipe devices or delete apps, insofar as this can be done safely and does not hinder the investigation.
Draw up an overview of the disputed transactions. For each payment, note the booking date, the amount, the description and why you deny consent. Also report transactions for which you do not yet know all the details. You can supplement an initial report later; waiting for a perfect file may create unnecessary risks.
How does the refund deadline work?
The main statutory rule for unauthorised payments is a prompt refund. In principle, the bank must also restore the account to the state it would have been in had the transaction not taken place. This may be relevant to the value date and the consequences of a wrongly reduced balance.
The AFM (the Dutch Authority for the Financial Markets) explains an exception: if there are reasonable grounds to suspect fraud by the payer, the payment service provider must report this to the AFM. That is something different from merely establishing that an unknown third party may have committed fraud.
The relationship between a preliminary investigation, a refund and reliance on the payer’s liability sometimes requires legal assessment. If the refund is delayed, ask which statutory ground the bank is relying on. A general statement that an investigation is still ongoing does not in itself give the bank unlimited freedom to suspend every refund for months.
When may you still have to bear the loss?
Article 7:529 of the Dutch Civil Code governs, among other things, the consequences of fraudulent conduct and of failing, intentionally or through gross negligence, to comply with certain security obligations. The bank must substantiate any reliance on this with the relevant facts. Not every mistake or act of carelessness reaches that high threshold.
Which obligation are you said to have breached? What did you know at the time? Which warning did you actually see? Had your device been taken over, or did you believe you were speaking to a genuine bank employee? The answers matter for the legal classification. General security terms and conditions do not replace that factual assessment.
The moment of reporting and the use of strong customer authentication may also affect how losses are allocated. Have the applicable statutory provisions and exceptions assessed together. Do not adopt amounts for an excess from foreign websites without checking them: national implementation and the specific situation may differ.
The current approach to bank helpdesk fraud
In Kifid 2026-0022, the Appeals Committee of Kifid, the Dutch Financial Services Complaints Tribunal, emphasised that deception by a supposed bank employee is relevant to the assessment of gross negligence. A victim who breaches security rules has not thereby automatically knowingly accepted the risk. The specific circumstances remain decisive.
The outcome may be different for payments the customer carries out personally. In Kifid 2026-0026, transfers confirmed by the customer were not treated as unauthorised transactions. Reliance on the special refund scheme therefore failed.
This distinction is decisive for your complaint. Do not simply put “I have been scammed” at the top of your letter; describe who gave which order. The article on bank helpdesk fraud and compensation also discusses the possible duty of care and goodwill routes.
The thirteen-month period is not a waiting period
Article 7:526 of the Dutch Civil Code requires you to inform the bank without undue delay after discovery. In addition, an absolute deadline of thirteen months after the value date applies in principle. Special rules apply if the bank has not correctly provided certain information about the transaction.
This does not mean that you can calmly wait thirteen months after discovery. The obligation to report promptly applies independently. So also keep evidence of the moment you first became aware of the payment, such as a message from the bank or an account statement you received at that time.
Nor is this reporting period the same as a deadline for complaining to Kifid or a civil limitation period. For older transactions, have all relevant deadlines assessed separately. A timely fraud report does not automatically keep every conceivable damages claim alive indefinitely.
Direct debits, credit card payments and transfers each need attention
| Payment method | Additional point of attention |
|---|---|
| Transfer | Who gave and confirmed the order |
| Card payment | Use of the card, token, device and relevant authentication |
| Direct debit | Existence and scope of the mandate and the applicable reversal rules |
| Payment via a payment service | Role of the account-servicing bank and any payment initiation service provider |
For certain authorised direct debits, a separate right to a refund exists. That is something different from claiming that you never gave a mandate. Ask the bank to explain which route it is handling. Moreover, a reversal does not automatically remove any underlying payment obligation towards the supplier.
A credit card scheme for disputed purchases or a chargeback may offer additional options, but it has its own conditions. A defective product or an undelivered order does not become an unauthorised payment merely because the word “fraud” is used. Frame your complaint on the basis of the facts and the appropriate payment or consumer law.
Which documents help with the assessment?
Keep statements, report confirmations, relevant emails and messages from the bank. Add a timeline of the use of your phone, card and online banking. If someone else had lawful access, state their authority and which actions, in your view, fell outside that authority.
Ask for relevant log data and an understandable explanation. A collection of technical codes without explanation does not make the events clear. Indicate which points you want checked, for example the linking of a new device or a change of phone number shortly before the transfers.
A fictitious example: the bank claims that the customer approved three payments, but the customer says they only confirmed one notification for device registration. In that case, the screen text, times and subsequent orders are essential. The number of codes used does not by itself answer the question of consent.
What if a family member or authorised representative made the payment?
A payment made by someone you know is not automatically authorised or unauthorised. What matters are the account terms, any power of attorney and the scope of the consent. Sharing access may also play a role in relation to security obligations, even if you did not want the specific amount to be transferred.
With a joint account, both account holders may have independent powers. A disagreement about where money went may then mainly be a dispute between the account holders. That must be distinguished from unauthorised access by a third party or use after a power of attorney has ended.
Therefore record who the account holder is, which authorisations existed and when changes were reported to the bank. A relationship conflict or suspected financial abuse deserves careful analysis. Do not assume that the bank must reverse every disputed family transaction without investigation.
Business payment accounts may be different
The protection of consumers and that of businesses is not the same in every respect. With non-consumers, the parties may, within the scope permitted by law, agree to deviate from certain payment law rules and deadlines. The agreement and the capacity of the account holder are therefore important.
A sole proprietorship does not automatically turn business use into consumer use. With mixed use too, it must be examined which relationship and which service are in dispute. In an initial assessment, state whether the account is in a personal name or in the name of a business, and what it is used for.
Also check the complaints options. Kifid does not handle every business banking dispute. The existence of a route for certain small business financing does not mean that every business payment fraud claim falls under it. If in doubt, access to that route must be examined before substantive proceedings.
Challenging a rejection in a targeted way
Ask for a final reasoned position in which the bank states whether it considers that consent was given or whether it is relying on an exception. That difference determines your response. Where consent is at issue, the focus is on the order and agreement; with gross negligence, it is on the alleged obligation, the circumstances and the evidence.
Identify inconsistencies specifically. If, for example, the bank writes that you added the payee yourself, while its earlier message referred to a new unknown device, ask how those data relate to each other. Avoid allegations about missing systems that you cannot substantiate.
Ask for the right outcome: a refund and restoration of the account, compensation for demonstrable additional loss, or a fresh assessment. Specify amounts and any reversals received. This avoids discussion about the scope of your request while the legal basis is still being examined.
Multiple transactions require multiple assessments
A rejection sometimes refers to a single successful login or confirmation and thereby deals with all disputed payments at once. Check whether that reasoning matches the specific transactions. An authenticated session does not in itself explain who gave each order and what consent was given for. Ask the bank to link its explanation to the date, amount, payee and confirmation method used.
A fictitious example: you approve one small payment and later see three much larger transfers. Your consent to the first payment is not general consent to every later amount. At the same time, the difference in amounts does not in itself prove that the other orders were given without authority. For that, the actual course of events and the available technical data are needed. So do not just describe that you were scammed, but also which specific orders you are disputing.
Also ask for clarity about recovered money. If part of an amount comes back, that reduces your remaining financial loss. Check which case and which payment the reversal relates to. A recovery attempt may fail without your legal claim against your own bank having been assessed. Conversely, a provisional credit does not always mean that the bank definitively accepts liability.
If you want to reach a settlement with the bank, record which transactions and heads of loss are included. Check whether a discharge clause also covers a separate dispute about registration, blocking or costs. Accepting a payment as an advance is something different from signing a final settlement. Have unclear wording clarified before you agree, especially if some of the facts are still under investigation. Afterwards, keep both the agreement and the bank statement showing that it has been carried out.
Frequently asked questions about unauthorised payments
Can the bank refuse because my PIN was used?
The use of the PIN is relevant information, but does not in itself prove every condition required for a refusal. The bank must carefully assess the question of consent and any exception to the refund obligation.
Do I have to file a police report before calling the bank?
No. Report the payment to the bank immediately so that access can be secured and any further loss limited. If you suspect a criminal offence, also file a police report and add the available information to the bank’s file.
Does the refund by the next business day always apply?
That is the main statutory rule for unauthorised payments, subject to the applicable conditions and exceptions. If the bank refuses or delays, ask which ground it is relying on. The mere existence of fraud by a third party does not answer that question.
What if I did pay but the seller delivered nothing?
Then the payment is not unauthorised for that reason alone. Examine the agreement with the seller and any purchase or chargeback protection. Make clear to the bank exactly whether you are disputing the order or the performance of the purchase.
Can I complain and have a recovery request made at the same time?
Yes, these actions can run in parallel. A recovery request focuses on available money and practical means of recovery. A complaint determines whether the bank is legally obliged to refund or compensate the loss, even if recovery fails.
How does Arslan Advocaten help with a payment dispute?
Arslan Advocaten can assess the payment order, the bank’s response, the terms and conditions and your evidential position. A targeted complaint, a letter holding the bank liable or proceedings can then be prepared. Bring the list of transactions, your report and the rejection; costs and possible next steps are discussed in advance.
Read also
- Right of withdrawal for online purchases: return within 14 days
- Product broken after purchase: what can you demand from the shop?
- Investment fraud or a fake platform: can the bank be liable?
Sources and legal basis
- Kifid 2026-0122 with provisions of payment services law.
- Kifid 2026-0022 on unauthorised payments and gross negligence.
- Kifid 2026-0026 on transfers carried out by the customer.
- AFM on the reporting obligation where fraud by the payer is suspected.
Sources checked on 16 September 2026. Relevant provisions include Articles 7:522 and 7:524 to 7:529 of the Dutch Civil Code; applicability and the scope for deviation must be established for each payment relationship.
