HSBC UK Bank Plc · DRN-5815261

The complaint Mr and Mrs C are unhappy that HSBC UK Bank Plc won’t reimburse money that they lost to a scam. What happened Mr and Mrs C were attempting to purchase a property. Emails between them and their solicitors were intercepted. Because of this, they were directed to make payments to an account controlled by a fraudster. A table of payments and relevant events is set out below. Date Amount Event/Payee 10 February 2025 £39,000 Fraudster’s account 11 February 2025 £50,000 Fraudster’s account 12 February 2025 £50,000 Fraudster’s account 12 February 2025 HSBC speak to Mr and Mrs C about the payments they’ve made. HSBC ask them to carefully check the email address the requests for money have come from. It is revealed that the email address is slightly different to the genuine email address of the solicitors. Because of this, the scam comes to light. 20 February 2025 £84,900 HSBC reimburse Mr and Mrs C part of their loss. Outstanding loss £54,100 HSBC partially reimbursed Mr and Mrs C under the FPS Reimbursement Rules (“the Reimbursement Rules”) which require Payment Service Providers (“PSPs”) like HSBC to reimburse victims of Authorised Push Payment (“APP”) scams in all but very limited circumstances. The maximum amount that PSPs are obligated to reimburse is £85,000 per scam claim (minus an allowable excess of up to £100). Mr and Mrs C asked HSBC to reimburse their full loss. After HSBC declined to do this, they referred a complaint to our service. One of our investigators upheld their complaint. They concluded that HSBC should have spoken to Mr and Mrs C when they were attempting to make the first payment and, if they had done so, the scam would have come to light – just as it did later. HSBC didn’t agree, in summary it said: - Requiring HSBC to reimburse amounts in excess of the limit in the Reimbursement Rules would run contrary to the aims of the government and regulator. Complaints to our service should be reserved only for exceptional circumstances – such as where a PSP has inappropriately sought to rely on one of the exceptions to reimbursement. - Where it has reimbursed in line with the statutory limit, it can’t be reasonably concluded that it has not acted fairly and reasonably. The outcome is not fair to both parties – only to Mr and Mrs C.

-- 1 of 5 --

- By requiring it to reimburse in excess of the limit, the Financial Ombudsman is acting as a “quasi-regulator”. The investigator’s view “overrides the will of parliament” and fails to implement changes set out in HM Treasury’s consultation paper – including ensuring greater certainty for firms. - The investigator’s opinion critiques HSBC’s warning in a way that is not consistent with the Reimbursement Rules. It has not sought to rely on an exception under the rules and it therefore wasn’t appropriate to comment on its warning. - It is unclear why the investigator believed that HSBC should reimburse Mr and Mrs C under the Payment Services Regulations 2017 (“PSRs”) – as those regulations contain no provision for PSPs to reimburse authorised payments. - It’s not unusual for customers to make the occasional large payment and the information that led it to flag the final payment wasn’t available when the first payment was being made. - The fact that it prevented significant further loss has been ignored by the investigator. - Mr and Mrs C ignored its warnings, including a recommendation to carefully check the email address and to contact the solicitors by telephone. - The investigator’s view that HSBC should have contacted Mr and Mrs C by telephone is another example of the Financial Ombudsman acting as a quasi-regulator and is unrealistic. - Mr and Mrs C contributed to their own loss in a number of ways: i) They failed to notice that the amount of stamp duty was incorrect. ii) Only the fraudulent emails requested money, they contained grammatical and spelling errors and demanded payments of the maximum amount that could be transferred. The fraudster was also unaware of the total amount that needed to be paid. These factors ought to have caused Mr and Mrs C to be concerned about whether the emails from the fraudster were genuine. iii) The fraudulent emails requested money be paid to an account that had no obvious connection to the solicitors. iv) The fraudster failed to provide a compelling reason for the payment not being made in a single CHAPS payment – the way that Mr and Mrs C intended to pay. As no agreement could be reached, the case was passed to me for a final decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. HSBC has acted fairly under the Reimbursement Rules. It has reimbursed the maximum amount minus the allowable excess. I need to decide whether it should fairly reimburse Mr and Mrs C outside of the Reimbursement Rules. The Reimbursement Rules impose a non-fault regime. That means they do not require a PSP to have made an error in order for the scam victim to be reimbursed. While I recognise that our investigator made inaccurate references to HSBC’s liability under the PSRs 2017, they reasoned that HSBC were at fault for failing to adequately warn Mr and Mrs C about the risk of making the payment on 10 February 2025. HSBC’s assertion that the intention of the Reimbursement Rules was to cap fault, as well as non-fault, claims is unsupported.

-- 2 of 5 --

Indeed, the Payment Systems Regulator has reminded PSPs that fraud victims have a right to make complaints and refer them to the Financial Ombudsman Service that exists separately from the Reimbursement Rules and that APP scam victims will still be able to bring complaints where they believe that the conduct of a firm has caused their loss (in addition to any claim under the reimbursement rules)1. It follows that HSBC could be responsible for Mr and Mrs C’s loss. I need to decide whether it is. In broad terms, the starting position at law is that a bank such as HSBC is expected to process payments and withdrawals that a customer authorises it to make, in accordance with the PSRs 2017 and the terms and conditions of the customer’s account. But, taking into account relevant law, regulators’ rules and guidance, relevant codes of practice and what I consider to have been good industry practice at the time, I consider it fair and reasonable that HSBC should: • have been monitoring accounts and any payments made or received to counter various risks, including preventing fraud and scams; • have had systems in place to look out for unusual transactions or other signs that might indicate that its customers were at risk of fraud. This is particularly so given the increase in sophisticated fraud and scams in recent years, which firms are generally more familiar with than the average customer; • in some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks, or provided additional warnings, before processing a payment; I’ve reviewed Mr and Mrs C’s bank statement for the six months prior to 10 February 2025. The £39,000 payment was by far the largest external transfer that was made (more than 10 times the amount of any other payment of the same type) and it was made to a new payee. So despite Mr and Mrs C’s account generally running with a significant balance, the payment was very unusual. It should have prompted concern from HSBC that Mr and Mrs C were at risk of financial harm from fraud. To some extent it did – HSBC provided a written warning that contained relevant information about the scam they were falling victim to. But, based on the considerable risk the payment presented, I don’t think that was a proportionate intervention – it needed to do more. I think a proportionate intervention, given the size and other features of the payment, would have been to contact Mr and Mrs C to establish the circumstances surrounding it. It's notable that, once HSBC became concerned about the payments Mr and Mrs C had made, it contacted them by phone. It seems that it believed that the most effective way of satisfying any concerns it had with the payments was to discuss them with Mr and Mrs C. It was right – the scam came to light quite quickly when it did this. While HSBC might disagree with the investigator about the point at which the risk ought to have been apparent – it does appear to agree that there are circumstances where the most appropriate response to a scam risk is a telephone conversation. That doesn’t seem to me to 1 “The reimbursement rules and their award limit differ from the rules which govern complaints under the Financial Ombudsman Service’s dispute resolution rules (DISP). PSPs should therefore inform victims of APP scams that, in addition to their right to seek reimbursement under the reimbursement rules, they have the right to bring complaints against sending and receiving PSPs if they are dissatisfied with their conduct and consider this has caused their loss. Such complaints may ultimately be referred to the Financial Ombudsman Service.” PSR PS23/4 7.18

-- 3 of 5 --

be an unrealistic expectation – it’s established good industry practice and exactly what happened here (albeit later). I don’t disregard the contents of the warning that Mr and Mrs C did receive – it’s relevant to my consideration of both whether they would have ignored advice given to them during a human intervention and whether they should share any responsibility for the loss. But, for the reasons I’ve explained, I’m satisfied HSBC did make a mistake by not contacting Mr and Mrs C by phone when the first payment was attempted. As explained, the scam did come to light when HSBC spoke to Mr and Mrs C following the third payment. Mr and Mrs C had intended to make further payments but the call put a stop to the scam. The obvious conclusion to reach is that an earlier call would have had the same impact. The counter argument – that it was the specific (and later) concerns that HSBC had developed about the receiving bank account (which was held by HSBC) that caused Mr and Mrs C particular concern – is not persuasive. During the 12 February 2025 call, HSBC didn’t tell Mr and Mrs C specifically why it was concerned about the payments. And, the steps it asked Mr and Mrs C to take – most notably checking the email address – should have been a routine part of any call where there was a risk of an email intercept scam. In other words, I don’t think there was a material difference in the circumstances between 10 and 12 February 2025 such that an earlier call would not have led to the scam being uncovered in the way that the later call did. I’ve thought about why Mr and Mrs C moved past the warnings that HSBC provided. Those warnings did contain some of the same advice that was communicated over the phone – check the email address for small differences and confirm account details over the phone. The first warning also explained the general premise of the scam – that communication could be intercepted by fraudsters. Mrs C clearly didn’t take the steps the warnings advised. She says that the warnings appeared generic to her and she was confident that she was communicating with her solicitor. But it’s evident that she was not so confident that she was not prepared to follow the advice of HSBC when it was communicated over the phone. I think ultimately Mr and Mrs C’s decision to proceed with the payments despite the warnings has more to do with the warnings lacking impact (being, as they were, static, text-based and not requiring any significant interaction) than a lack of care or concern on their part. What follows from the above is that HSBC’s failure to call Mr and Mrs C when the first payment was being attempted did cause their loss. So I’ve thought about whether Mr and Mrs C should bear any responsibility for what happened. In doing so I’ve taken into account what the law says about contributory negligence, as well as what’s fair and reasonable in the circumstances of this case. The question here is whether Mr and Mrs C saw, or ought to have seen, the risk of proceeding and carried on regardless. It’s important to note that they had nothing to gain by going ahead with the payments if there was a risk that the payee wasn’t genuine. And, there’s no suggestion in any of the correspondence that they ever suspected that they weren’t actually dealing with the genuine solicitors. So they never had appreciation of the actual risk. Although there appears to be some unexpected aspects to the fraudster’s correspondence, such as the request for bank transfers, rather than a CHAPS payment, and the requirement to pay an account without any obvious connection to the solicitor – the question is whether these peculiarities should have given a reasonable person reason to believe that they were not communicating with the actual solicitor.

-- 4 of 5 --

The scam has an inherent sophistication – the fraudster was able to insert themselves into the genuine correspondence – with only the slightest and most subtle difference to the email address of the solicitors. To anyone unaware of this trick, it would be difficult to understand how the emails were not coming from the genuine solicitors and I find it quite reasonable that Mr and Mrs C may have attributed innocent explanations to the oddities (such as being asked to pay a different account, which they understood to be the solicitors’ holding account) and minor grammatical errors in the solicitor’s correspondence and requests (which otherwise appeared legitimate and professional). After all, Mr and Mrs C thought they were dealing with an expert and I wouldn’t necessarily expect them to second guess what they were being told was necessary for the house purchase to go ahead. I think HSBC unfairly highlights these discrepancies with the benefit of hindsight. HSBC might argue that, whether Mr and Mrs C were aware of how email intercept scams work prior to attempting the payments, they must have been when they attempted them due to the warnings they received. But, as I’ve already set out, I don’t think the warnings they saw were particularly impactful and considering the circumstances overall, I don’t consider it to be fair or reasonable for a deduction to be made to the amount reimbursed. That means HSBC should reimburse Mr and Mrs C’s outstanding loss. It should also pay interest at 8% simple per year on that amount to compensate them for being without the money. My final decision I uphold this complaint about HSBC UK Bank Plc and instruct it to pay Mr and Mrs C: - The outstanding loss from the scam - £54,100 - 8% simple interest per year on that amount from the date of each payment to the date of settlement. Under the rules of the Financial Ombudsman Service, I’m required to ask Mrs C and Mr C to accept or reject my decision before 29 December 2025. Rich Drury Ombudsman

-- 5 of 5 --