What should a company in the Netherlands do when an employee's company card is used fraudulently?

If a company card has been used without authorization, treat it as an incident and act promptly:

1. Contact the card issuer immediately. Ask them to block the card and any linked digital-wallet tokens, report the transactions as unauthorized, and explain how to dispute them. Keep the bank’s case/reference number. Issuer procedures vary; for example, ING asks corporate-card customers to contact its customer service immediately about suspected fraud. (ingwb.com)
2. Contain and preserve evidence. Secure the card or device, change related account credentials if they may be compromised, and save transaction records, receipts, alerts, emails, and a timeline. Avoid deleting messages or making assumptions about who is responsible.
3. Notify the right people internally. Inform the cardholder’s manager and the company’s finance, security, or incident-response contact. Limit access to the details while the facts are checked.
4. Consider a police report. A company representative can report on the organisation’s behalf; the Dutch police advise calling 0900-8844 to arrange an appointment. Ask the issuer whether it needs the report or report number for the dispute. (politie.nl)
5. Check whether personal data was exposed. Card misuse alone does not automatically mean there was a reportable personal-data breach. If personal data was accessed or disclosed, assess the risk and document the incident. Where GDPR requires notification, report it to the Dutch Data Protection Authority (AP) within 72 hours of discovering the breach; affected people may also need to be informed. (business.gov.nl)
6. Keep a written record and follow up. Track the bank’s dispute, replacement card, any refunds, and steps taken to prevent recurrence. Don’t deduct the loss from an employee’s pay or accuse an employee based only on the cardholder being associated with the card; get Dutch employment-law advice before taking disciplinary or recovery action.

If the employee is the one reporting the misuse, they should notify the company’s designated contact and card issuer immediately, and keep copies of the report and reference numbers. This is general guidance; the issuer’s terms and the facts of the incident matter.

Short answer: Block the card first, dispute the charges with the card issuer, file a police report, and keep evidence. Then handle the employee side separately, carefully, and preferably with legal advice.

1. Block the card immediately. Call the card issuer's fraud line or block the card through internet banking. The bank blocks the card directly, and once it is blocked, no one else can use it. As employer, you can usually manage the business card yourself, without needing to involve the employee.

2. Dispute the transactions with the issuer. A card payment cannot simply be reversed by you. A chargeback is requested through the card issuer, which assesses the claim against the card network's rules and recovers the amount from the merchant's bank. In cases of fraud, the amount is often provisionally credited back in the meantime. Dispute every unknown transaction, including small amounts. Check small amounts and reservations as well.

3. File a police report (aangifte). The police say you must always file a report, even if the card company or bank compensates the damage. Reimbursement processes may also depend on it. A police report helps you recover money quickly from the card company, which has a standard fund for this. Online filing is possible at politie.nl or by phone on 0900-8844.

4. Report to the Fraudehelpdesk. Companies can register fraud there. On its website, choose the option for reporting on behalf of your company. Any form of fraud, or even suspicion of it, can be passed to the Fraud Help Desk, choosing 'I report on behalf of my company'.

5. Act quickly and keep evidence. Report the unauthorised transactions as soon as possible. For consumer payment accounts, the statutory deadline is 13 months after the debit date, but the duty to report promptly applies independently of that deadline. Check your card agreement for the business-specific rules, since they may differ from consumer protections. Keep statements, report confirmations, emails, and a timeline of card use. Also keep evidence of when you first became aware of the payment.

6. Handle the employee side carefully. This is general Dutch employment-law practice rather than something I verified in these sources:

• Establish the facts before drawing conclusions. The employee may be the culprit, a victim of phishing or card theft, or someone else may have used the card.
• Do not deduct the loss from wages on your own initiative. Dutch law restricts wage deductions, and this is a common mistake.
• Any claim against the employee for damages, or any dismissal, needs a sound legal basis and proper procedure. Get advice from an employment lawyer before acting.
• Limit any investigation of the employee's data or communications to what is necessary and lawful under GDPR and works council or privacy rules where they apply.

7. Review controls afterwards. Tighten card limits, approval workflows, and monthly statement checks, so the company is better protected next time.

When a company card in the Netherlands is used fraudulently, the appropriate response depends on whether the fraud was committed by an external party (e.g., card theft, skimming, or phishing) or by an employee (misuse of company funds).

1. If the fraud is by an external party (e.g., Stolen Card/Identity Theft)

• Block the card immediately: Contact your bank or credit card provider without delay to cancel the card and prevent further unauthorized transactions.
• Report to the bank: Follow the bank’s specific procedures for reporting fraudulent transactions to initiate a chargeback or dispute process.
• File a police report: If the card was stolen or used in a criminal act (e.g., identity fraud), you should file a report (aangifte) with the Dutch police. This is often required by insurance companies or banks to process your claim.
• Monitor accounts: Check for other unauthorized activity and update security credentials (passwords, PINs) if necessary.

2. If the fraud is committed by an employee

If you suspect an employee has misused their company card, you must handle the situation with extreme care to remain compliant with Dutch employment and privacy law.

A. Investigation Phase

• Gather evidence: Collect documentation such as transaction logs, expense reports, receipts, and any relevant digital communication. Ensure that your methods of gathering evidence (e.g., checking company emails or IT logs) comply with the GDPR and your company’s internal privacy policy.
• Proceed with caution: You may choose to conduct a discreet investigation first. Avoid publicizing the investigation to other colleagues to protect the employee’s reputation in case the suspicion proves unfounded.
• Suspend with pay (if necessary): If the suspicion is strong and immediate action is required to prevent further damage, you may suspend the employee. Important: This should be a paid suspension pending investigation. Always document the reasons for the suspension to avoid legal repercussions for unfair treatment.

B. Due Process

• Hoor en wederhoor: Before taking any disciplinary action, you are legally required to give the employee an opportunity to respond to the allegations (hoor en wederhoor). Failure to do so can invalidate a subsequent dismissal.

C. Disciplinary Action

• **Summary Dismissal (Ontslag op staande voet):** Fraud or theft is a serious violation of the employment contract and can be grounds for summary dismissal under Article 7:678 of the Dutch Civil Code.
  • Urgency: The dismissal must occur "without delay" (onverwijld) once the facts are established.
  • Communication: You must clearly communicate the reason for the dismissal to the employee at the moment it occurs.
• Damages and Fines: Depending on the employment contract and the severity of the act, you may be able to claim damages or impose a contractual fine. Note that an employee is generally only liable for damages caused during work if the damage was the result of intent (opzet) or deliberate recklessness (bewuste roekeloosheid).

Recommended Next Steps

1. Consult a lawyer: Because Dutch employment law is very strict regarding dismissal procedures, consult an employment law specialist before making any move toward dismissal. A procedurally incorrect dismissal can lead to significant severance payments and legal costs.
2. Contact your insurance: If the company has fraud insurance, notify them immediately to understand what documentation is required.
3. Document everything: Maintain a meticulous record of all evidence, investigation steps, and communications with the employee. This documentation is essential should the matter proceed to court.

Disclaimer: I am an AI, not an attorney. Dutch labor law is complex and highly fact-specific. Please consult with a legal advisor or HR professional in the Netherlands before taking disciplinary action against an employee.

If a Dutch company card has been used fraudulently, act quickly to limit further loss and preserve evidence:

1. Call the card issuer immediately. Block the card and any related credentials, report the suspected unauthorised transactions, and ask how to dispute them and what deadlines or documentation apply. Follow up in writing and keep the case reference. Some business-card terms require prompt notice and a police report, so check the terms for your particular issuer and card. ⁸

1. Secure related access. Revoke or replace the card, PIN and digital-wallet or account credentials where relevant. Review recent transactions and check whether other cards or accounts may be affected.

1. Preserve the facts. Save statements, receipts, alerts, emails, invoices and relevant access records. Record when the company discovered the transactions, when it notified the issuer, and any steps taken. Avoid altering or deleting potentially relevant records.

1. Report suspected fraud to the police. In the Netherlands, contact the police on 0900-8844 or visit a police station; call 112 only for an emergency. The Dutch government also points businesses to the Fraud Help Desk for fraud reports and advice. ¹⁷

1. Handle any employee involvement carefully. A fraudulent transaction does not by itself establish that the cardholder—or another employee—was responsible. If there is a concrete reason to investigate, use a narrow, proportionate approach, respect privacy and data-protection rules, and give the employee an opportunity to respond before deciding on disciplinary action. Get Dutch employment-law advice before suspending or dismissing anyone; summary dismissal requires sufficient evidence and careful handling. ³⁴¹²

1. Reconcile and prevent recurrence. Notify finance, record the disputed amount appropriately, and review card limits, alerts, approval rules and access controls. Ask your accountant or adviser how to treat the disputed transactions and any recovery in the company’s books.

This is general guidance, not legal advice. Sources: ¹ Dutch government, Fraud, disputes, or complaint: Who to contact?; ³ KVK, What can you do if you suspect your employee of theft or fraud?; ⁴ Dutch government, Taking action against internal crime; ⁷ Dutch police, Report a crime; ⁸ ABN AMRO/ICS Business Card terms; ¹² Dutch Data Protection Authority, Conditions for monitoring employees.