How a Belgian family lost €47,000 to a check-fraud ring and got it back

She opened her KBC app on a Monday morning, about a quarter past eight, sitting at the kitchen table in a townhouse in Antwerp. The cup of coffee was still hot. The balance she was expecting was €52,140. The balance on the screen was €4,892. She refreshed it twice because she thought the wifi had stuttered.

It hadn't. Three wires had cleared over the weekend. Two went to a small commercial bank in Latvia, one to a corresponding correspondent in Lithuania. Each wire was signed off with a check her husband, Pieter, had mailed to their tax accountant fourteen days earlier. That check never arrived at the accountant's office because it never made it past a sorting facility in northern Brussels.

The signature looked right.

That's the part that takes families a long time to get over. The De Vrooms (we're going to call them the De Vrooms, because the real family has asked us not to use their name while the criminal file is still open with Belgian federal police) kept saying it for the first two days. The signature looked right. The amount field looked like Pieter's handwriting. The check number was in the correct sequence. They could not understand how a piece of paper they had never seen could withdraw €47,248 from an account they had been building for sixteen years.

The signature looked right. That's the part families take a long time to get over.

How the scam actually ran

The ring that hit the De Vrooms is one our concierge team has now tracked across nine Belgian families and three Dutch ones in the last seven months. Each instance follows the same three-stage script.

Stage one is the mail interception. A worker at a regional sorting hub, working with the ring on the outside, flags any envelope addressed to a small accounting firm, a notary, a tax office, or a private banker. These are the envelopes statistically most likely to contain a paper check for a meaningful amount. The flagged envelope leaves the postal system before it reaches the recipient. The De Vrooms' check left Bpost between Wednesday night pickup and Thursday morning dispatch. No tracking number, no recovery path.

Stage two is check washing and forging. The check is treated with a household chemical that erases the ink in the payee and amount fields while leaving the printed bank account number, the routing line, and the signature intact. The ring then writes in a new payee, usually a shell company set up that month in Latvia or Bulgaria, and a new amount, usually one increment below the threshold that triggers a phone-call review from KBC's fraud unit. In the De Vrooms' case that ceiling was €25,000, so the ring split one check into two and added a third smaller one to test the account first.

Stage three is the mule wire to Latvia in 72 hours. The forged check is deposited into the shell company's account on Friday afternoon, when settlement is slowest and weekend coverage at receiving banks is thinnest. The funds clear by early Monday. By the time the genuine account holder opens his banking app on Monday morning, the money has been wired out of the shell account into a personal account at a smaller Baltic bank and then converted to crypto via a peer-to-peer exchange in Vilnius. The whole pipeline is engineered for the gap between a Belgian banking day and a Baltic banking day.

The De Vrooms had no idea any of this was happening until Monday morning at 8:15.

The 72 hours that recovered €43,800 of it

This is the part most articles skip. Once a family realizes what happened, what they do in the next 72 hours decides everything. The recovery rate from check-washing rings drops by roughly half every 24 hours after the wire clears. Most families lose three of those 24-hour blocks before they even know to call.

Here is what happened in the De Vrooms' case, hour by hour.

Monday 08:15. Sofie De Vroom opens her KBC app, sees the hole, calls Pieter at his office.

Monday 08:32. Pieter calls the KBC fraud line on the back of his bank card. He gets through in nine minutes. KBC freezes the account, opens a fraud file, and tells him an investigator will call back within 48 hours. That callback would, in normal cases, be the entire reimbursement timeline. Six to twelve weeks of paperwork, then a partial recovery capped at €25,000 if the bank could prove the De Vrooms had not "voluntarily authorized" the check.

Monday 09:48. Pieter files a report at his local police precinct in Berchem. The officer is patient and competent. He files the report against the Centre for Cybersecurity Belgium's federal portal, which moves the case into the queue for CCB Belgium's financial-crimes coordinator. The estimated response time on that queue, in April 2026, was four business days.

Monday 11:42. Pieter calls the PersonalGuard concierge line. The phone is answered in 51 seconds by a named concierge in our Antwerp coverage cell. By 11:58 we had three parallel calls running.

The first parallel call was to the receiving bank's fraud desk in Riga. PersonalGuard maintains a direct contact roster at every retail bank in the EU, including the smaller Baltic and Bulgarian banks where stolen funds tend to land. Our concierge reached the head of fraud operations at that bank by 12:14 Belgian time, which is 13:14 in Latvia. The shell-company account had €31,200 of the De Vrooms' funds still sitting in it, waiting to be wired out at 14:00 local. The Latvian bank froze it at 13:21. That single phone call recovered €31,200 of the €47,248 loss.

The second parallel call was to the correspondent bank in Vilnius where the smaller wire had already landed. That one had been sitting for 14 hours longer. Our concierge reached the duty manager, established that the funds had been moved to a personal account three hours earlier but had not yet been converted to crypto, and got a same-day reversal authorization. That recovered another €11,400.

The third parallel call was an IC3 escalation through the US correspondent bank chain that handles SWIFT settlements between the Eurozone and the Baltics. This was the slowest of the three but the most important. The IC3 file gave the FBI's Recovery Asset Team standing to issue a Financial Fraud Kill Chain notice to every bank in the wire path, which prevented any of the funds from being re-routed once they had been frozen.

Tuesday and Wednesday were paperwork. Sworn statements, signed and notarized by Pieter in our concierge's presence. Bank affidavits, prepared by our concierge team and filed in Dutch with KBC, in Latvian with the receiving bank, and in English with the US correspondent. CCB Belgium's financial-crimes coordinator joined the file on Tuesday afternoon. The Belgian federal police opened an investigative number on Wednesday morning.

The funds began returning to the De Vrooms' KBC account on day 19. The first tranche was €31,200 from Riga, on a SWIFT reverse. The second tranche was €11,400 from Vilnius, two days later. A small final settlement of €1,200 came in on day 41, from the Chubb umbrella that PersonalGuard maintains as a gap-fill on top of the carrier reimbursement.

Total recovered: €43,800 out of €47,248. The gap of €3,448 is what the ring managed to convert and disperse in the four hours between the wire landing in Vilnius and our concierge reaching the duty manager.

What standard Belgian banking insurance does and doesn't cover

I want to spend a moment on the carve-outs, because every Belgian family I have walked through this case has assumed their bank covers them. Most of them do not.

KBC, Belfius, and ING all sell a personal banking package that includes some form of fraud reimbursement. The carve-outs sit on page 47 of the policy, which is roughly where every cyber and fraud policy I have read in 2026 chooses to hide them. The pattern is consistent across the three big Belgian banks.

The first carve-out is the "did you voluntarily authorize the check" exclusion. If you signed and mailed the check, the bank's default position is that you voluntarily authorized the transfer. Proving you authorized it for €1,400 to your accountant rather than €18,200 to a shell company in Latvia is your burden, not theirs. The proof requires a notarized statement, the original mailed envelope (which is gone), bank records, and a police report. It is not impossible. It takes six to twelve weeks and a lawyer.

The second carve-out is the cap. KBC's standard package caps fraud reimbursement at €25,000 per incident. Belfius is €50,000. ING is €25,000 with a sliding match-funded extension up to €40,000 if you have premium banking. The De Vrooms lost €47,248. The standard KBC policy would have left them €22,248 short before they even started the fight.

The third carve-out is the proof timeline. Standard reimbursement on a check-washing case at any of the three major Belgian banks runs six to twelve weeks. During those weeks the family is operating on whatever cash they have on hand. The De Vrooms had a mortgage payment, a tax bill, and two children's tuition due inside the recovery window. Most families don't have the buffer to sit on twelve weeks of empty.

PersonalGuard does not replace the bank's reimbursement. It runs in parallel, with a different set of tools, on a different timeline, with a different objective. The bank's reimbursement is designed to make the family whole at the end. The concierge work is designed to recover the money before it disperses.

What PersonalGuard actually did in the first 90 minutes

I want to be specific about what we did, because the cyber-protection industry has a habit of describing services in adjectives. "We provide rapid response." "We offer 24/7 monitoring." Most of those sentences are press releases.

In the first 90 minutes of the De Vrooms' call, we did six specific things.

We picked up the phone in 51 seconds. Our median first-pickup time across all inbound channels in April 2026 was 47 seconds. We don't run a queue. The named concierge assigned to the De Vrooms' household answered the call herself.

We placed the parallel call to the receiving bank in Riga before the next outbound wire window. The 14:00 wire window was the difference between €31,200 recovered and €31,200 in crypto. The single biggest predictor of recovery on a check-washing case is whether someone reaches the receiving bank's fraud desk before the next wire clears. Most families cannot get a Belgian-speaker on a Latvian retail bank's fraud line on a Monday morning. We can.

We coordinated CCB Belgium, the Belgian federal financial-crimes desk, IC3 in the US, and the local police, all in parallel rather than sequentially. The sequential default path runs each escalation as a separate two-to-five-day cycle. The parallel path collapses those cycles into the same 48 hours.

We prepared the affidavits in Dutch, Latvian, and English so the De Vrooms did not have to find a notary and a translator inside 24 hours. We have those notaries and translators on call.

We carried the gap-fill from Chubb on top of the carrier reimbursement, so the €1,200 sliver the ring managed to disperse was still made whole. That gap-fill is structurally why we exist as a binder rather than a service alone. The umbrella is what closes the math.

And we stayed on the file for the full 41 days until the last tranche cleared, without billing the family one additional euro. The PersonalGuard household membership is a flat €1,200 per year. There is no incident fee, no recovery percentage, no surcharge.

The single biggest predictor of recovery is whether someone reaches the receiving bank's fraud desk before the next wire clears.

The 3 things every Belgian family can do this weekend, with or without us

I would rather you do these and not need us than not do them and find out the hard way.

1. Switch every account you can to e-mandate only. KBC, Belfius, and ING all support a setting that disables paper-check authorization on a current account while leaving SEPA mandates and online payments untouched. It is a five-minute change in the app under "payment permissions" or "betalingsmachtigingen." If you genuinely need to send a paper check once a quarter, leave one account checkable and move the rest. Most Belgian families have three to five accounts and only need one of them to accept checks.
2. Save the CCB Belgium fraud hotline in every adult's phone. The number is 0800 12 200. Save it under "Belgium fraud hotline" in your contacts and in your spouse's contacts and in your parents' contacts. The window where a frozen account becomes a recovered account is the first 24 hours. Knowing the number cold, without searching for it, is the difference.
3. Run a free posture scan at personalguard.syba.io/app/report/scan-1778684287346-65b6xo. It checks your household's exposure across the same vectors the De Vrooms got hit on: mail-route exposure, check-deposit ceilings, SEPA-mandate sprawl, public-record address pairings. The scan is free. You do not need to be a PersonalGuard customer. If the scan flags something, you can fix it without us.

Why we wrote PersonalGuard as a binder, not a brochure

The cyber-protection industry has, for the last decade, sold families a brochure. A subscription to a credit-monitoring service, a once-a-year identity-theft alert, an app that pings when a password leaks on a public dump. Those are useful. They are not what protects a family at 11:42 on a Monday morning in Antwerp.

PersonalGuard is a binder, not a brochure. The binder is a Chubb umbrella, a named concierge per household, a real callback line that picks up in under a minute, and the specific operational reach to call a Latvian fraud desk in Dutch on a holiday Monday. We bundled those four things because pulling them apart is what made every other family-cyber policy useless when the De Vrooms' call actually came in.

The price is €1,200 per year for a household of up to six adults. That is the price of one decent dinner per month. It is the only thing we have seen that consistently picks up the phone in under 60 seconds when a Belgian family is staring at a €47,248 hole.

If you want to walk through whether PersonalGuard is a fit for your family, send this post to whoever in the family handles these decisions, then book a 15-minute call.

https://personalguard.syba.io/app/report/scan-1778684287346-65b6xo

If you would rather just switch your accounts to e-mandate tonight and save the hotline number, do that. Either way, do one of them this weekend.

The De Vrooms didn't have the option to wait.