HSBC UK Bank Plc · DRN-5837840

The complaint A limited company, D, complains that HSBC UK Bank Plc won’t reimburse it after it lost money to what it considers to be an investment scam. Mr P is a director of D and has brought the complaint on its behalf. What happened As the circumstances leading up to this complaint are well known to both parties, I will not repeat them all again here in detail. Instead, I will keep my summary of what happened brief and focus on the reasons for my decision. Between October 2023 and February 2024, D made a series of payments totalling £100,000 to a company I’ll refer to as ‘M’. These payments were made in connection with an investment in forex trading. D was introduced to the investment opportunity by a family member who had also invested. D was subsequently able to withdraw £65,000 from the arrangement. Upon realising that it had likely been the victim of a scam, D reported the matter to HSBC, who considered the claim under the Lending Standard’s Boards Contingent Reimbursement Model (CRM) Code – this being a voluntary code applicable to authorised push payment (APP) scams at the relevant time. HSBC classified the matter as a civil dispute between buyer and seller and declined to provide a refund. D complained, stating that other individuals it knew had received refunds from their banks in similar circumstances. HSBC maintained its position that it was not required to provide reimbursement in these circumstances. Unhappy with HSBC’s response, D referred the complaint to our service. An Investigator reviewed the complaint and concluded that HSBC should reimburse D under the CRM Code for its loss and apply 8% simple interest per annum on the amount to be refunded, from the date that HSBC declined the claim to the date of settlement. The Investigator calculated the reimbursable amount as £50,000. HSBC disagreed with this view. It considered that it was entitled to pause or decline an outcome under relevant provisions (such as R3(1)(c) of the CRM Code) due to an ongoing police investigation into the matter. It also argued that the evidence did not sufficiently demonstrate M’s intent to scam D, and it provided several reasons for why it believed D had no reasonable basis for believing it was dealing with a legitimate investment opportunity. As no agreement could be reached between the parties, the case was passed to me for a final decision.

-- 1 of 6 --

Having reviewed the complaint, I did not agree with the Investigator's calculation of a £50,000 loss. In an effort to resolve the matter quickly and informally, I wrote to both parties setting out my intended decision. This included my reasoning for why I was upholding D’s complaint and explained that D’s net outstanding loss was £35,000 (rather than £50,000 as suggested by the Investigator), as a £15,000 withdrawal – which had been treated as coming from what was considered D’s trading account – had instead been paid directly to Mr P's personal account instead of D’s bank account. Mr P therefore owed this sum to D. D’s accountant also confirmed that this was how the monies had been treated for accounting purposes. D accepted my intended decision. HSBC continued to disagree. It said that while the police may have suggested M operated as a “Ponzi scheme”, no charges had been brought at that stage. It argued that it would be misplaced for our service to prejudge the outcome of any criminal proceedings. As both parties have now had the opportunity to comment on my intended decision, I can go ahead with my final decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In broad terms, the starting position in law is that a firm is expected to process payments and withdrawals that a customer authorises, in accordance with the Payment Services Regulations (PSRs) and the terms and conditions of the customer’s account. However, where the customer made the payment as a consequence of the actions of a fraudster / scammer, it may sometimes be fair and reasonable for the bank to reimburse the customer even though they authorised the payment. It isn’t in dispute these payments were authorised by Mr P, as the director of D from its account. Because of this the starting position, in line with the PSRs is that liability for the transactions respectively sits with D. But D says the payments from its account were made as the result of an APP scam. HSBC is a signatory of the CRM Code, which provides protection to scam victims. Under the CRM Code, the starting principle is that a firm should reimburse a customer who is the victim of an APP scam – except in limited circumstances. When considering such a claim, HSBC ultimately has one of three options available to it; it can either accept a scam has occurred and consider whether it should reimburse under the CRM Code, it can decide that no scam has occurred and therefore not provide reimbursement (treat the matter as a civil / private dispute), or it can decide to await the outcome of an investigation. In response to my attempt to resolve matters informally HSBC maintained that it disagrees with our approach to progress matters. It continues to argue that in line with the CRM Code, it is entitled to rely on R3(1)(c) to pause an outcome. Firstly, I accept there is an exception under the CRM Code (R3(1)(c)) that states that firms should make a decision as to whether or not to reimburse a customer without undue delay but that, if a case is subject to investigation by a statutory body and the outcome might reasonably inform the firm’s decision, it may wait for the outcome of the investigation before making a decision.

-- 2 of 6 --

But as we’ve already explained to HSBC whilst this exception provides a reason why firms may delay providing a claim outcome under the CRM Code, it doesn’t impact that customer’s right to refer the complaint to our service – and similarly it doesn’t impact our service’s ability to provide a complaint outcome when we consider we have sufficient evidence to do so. And that, this exception (R3(1)(c)) needs to be raised by the firm, prior to it having reached an outcome on the claim under the CRM Code, which HSBC hasn’t done in this case. In these circumstances, I’m satisfied HSBC has already decided the outcome of the claim as it makes clear in its letter dated 12 September 2024 to D, that having investigated matters it deems its claim to be buyer-seller dispute. HSBC has also stated the same in its initial submissions to our service. Therefore, HSBC can’t at this stage seek to rely on the provision R3(1)(c) within the CRM Code. I am aware there is an ongoing investigation, and there may be circumstances and cases where it is appropriate to wait for the outcome of external investigations. But that isn’t necessarily so in every case, as it will often be possible to reach conclusions on the main issues on the basis of evidence already available. And I am conscious that any criminal proceedings that may ultimately take place have a higher standard of proof (beyond reasonable doubt) than I am required to apply, this being – the balance of probabilities. The Lending Standards Board has said that the CRM Code does not require proof beyond reasonable doubt that a scam has taken place before a reimbursement decision can be reached. Nor does it require a firm to prove the intent of the third party before a decision can be reached. So in order to determine D’s complaint I have to ask myself whether I can be satisfied, on the balance of probabilities, that the available evidence indicates that it is more likely than not that D was the victim of a scam rather than this being a failed investment. Parliament has given ombudsmen the job of determining complaints quickly and with minimum formality. In view of this, I think that it would not be appropriate to wait to decide D’s complaint unless there is a reasonable basis to suggest that the outcome of any external investigation may have a material impact on my decision over and above the evidence that is already available. I’ve not seen anything that persuades me that this situation requires me to wait until the outcome of the police investigation or potential related court case for me to reach a fair and reasonable decision. So with that being said, I’ve carefully considered whether HSBC’s decision to treat this matter as a buyer-seller dispute and not provide reimbursement under the CRM Code is fair and reasonable. Has D Ltd been the victim of a scam, as defined in the CRM Code? The relevant definition of a scam in accordance with the CRM Code is that the customer transferred funds to another person for what they believed were legitimate purposes but were in fact fraudulent. The CRM Code also says it doesn’t apply to private civil disputes, such as where a customer has paid a legitimate supplier for goods or services but has not received them, they are defective in some way, or the customer is otherwise dissatisfied with the supplier. So, it doesn’t cover a genuine investment or a genuine business that subsequently failed. So in order to determine whether D has been the victim of a scam as defined in the CRM Code I need to consider whether the purpose it intended for the payments was legitimate, whether the purposes it and M intended were broadly aligned and then, if they weren’t, whether this was the result of dishonest deception on the part of M.

-- 3 of 6 --

From what I’ve seen and what D has told us; I’m satisfied it made the payments with the intention of investing in forex trading. It thought its funds would be used by M to trade and that it would receive a return on its investment. But I think the evidence I’ve seen suggests M didn’t intend to act in line with the purpose for the payments it had agreed with D. Having carefully considered everything, for the reasons set out below, on balance, I’m persuaded, that there is sufficient evidence to support that a scam was in operation and that the definition of an APP scam, as set out in the CRM Code, has been met here. • M was purporting to be a forex broker, to do so required regulatory authorisation, which it didn’t have. • The documents provided by M appear illegitimate, unprofessional, and lack necessary regulatory details, contrasting sharply with legitimate forex firms. • D’s trading account statements resemble basic bank statements rather than detailed trading activity. • The registered company number which can be found on the bottom of D’s trading account statement shows M’s nature of business on Companies House as being development of building projects and take-away food shops and mobile food stands. • I’ve seen correspondence from the police in which they informed D that it along with over hundred others had been the victim of a “ponzi scheme” and that the money sent was not invested as they’d been led to believe. It was simply given back to other “investors” to make them think they were getting a return on their “investment” and most likely used by the suspect for personal expenditure. It also goes on to explain that financial checks have been carried out which identify there are no funds or assets that can be returned. It confirms that individuals have been arrested and interviewed under the Fraud Act 2006 and the Proceeds of Crime Act 2002. • Evidence received from the recipient bank that held M’s account shows that the account activity was not entirely reflective with what you might expect to see of a business carrying out legitimate forex trading. Is D entitled to a refund under the CRM code? Under the CRM Code, a bank may choose not to reimburse a customer if it can establish that*: • The customer ignored what the CRM Code refers to as an “Effective Warning” by failing to take appropriate action in response to such an effective warning. • The customer made payments without having a reasonable basis for believing that: the payee was the person the customer was expecting to pay; the payment was for genuine goods or services; and/or the person or business with whom they transacted was legitimate. *Further exceptions outlined in the CRM Code do not apply to this case. Did HSBC meet its obligations under the CRM Code and did D ignore an effective warning? HSBC hasn’t demonstrated that D ignored any “Effective Warnings”, so it cannot rely on this exception of the CRM Code as a reason to not reimburse D.

-- 4 of 6 --

Did D have a reasonable basis for belief? I’ve considered whether Mr P (on behalf of D) acted reasonably when making these payments, or whether the warning signs ought to have reasonably made him aware that this wasn’t a genuine investment. In doing so I’ve carefully thought about the points HSBC have raised, but taking everything together, I don’t think he acted unreasonably in the circumstances of this complaint. I say this because he was introduced to the investment opportunity through his brother-in-law (a trusted family member), who personally knew one of the directors and had been investing with M since January 2023. In addition to this, his younger brother was receiving regular payments into his bank account (as he chose to withdraw monthly interest rather than compound it), and his brother-in-law also had two friends who had invested that regularly discussed performance and withdrawals with him. One of them periodically withdrew funds, which reinforced the impression that the investment was legitimate. In addition, D had been able to successfully withdraw significant sums, which further strengthened the belief that M was genuine. I note HSBC contends the returns were too good to be true, but this was an investment in forex (so high risk / high rewards), and in the particulars of this scam the expected returns promised to D weren’t to the level where I can fairly say he didn’t have a reasonable basis for belief. Considering Mr P was an unsophisticated investor; I’m not persuaded that the reasons HSBC have shared are enough to out shadow the assurances the set of circumstances here would’ve provided him. Overall, as I don’t think HSBC has established that any of the exceptions to reimbursement under the CRM Code apply here, it follows that it should refund D’s outstanding loss under the provision of the CRM Code. I have also considered the possibility of recovery (given ongoing police investigations) that could result in D being in a position of betterment. That said, I don’t consider this should prevent HSBC from reimbursing D under the CRM Code now (nor would it have at the time the matter was first reported to HSBC). However, I consider it is fair and reasonable, that HSBC can choose, if it wishes to, to obtain an undertaking from D to entitle it to any money recoverable elsewhere, whether such recovery was due to D directly, or to another party on their behalf. In other words, HSBC may require D to enter into an undertaking to assign to the bank any rights to any monies D (or another party on D’s behalf) might elsewhere be entitled to recover in respect of this loss. If HSBC asks D to provide such an undertaking, payment of the reimbursement awarded may be dependent upon provision of that undertaking. HSBC may treat D’s acceptance of my final decision as sufficient for this purpose. Alternately, HSBC would need to meet any costs in drawing up an undertaking of this type. In these circumstances, as D has been deprived of use of these funds, I think it would be fair for interest to be added to the settlement at the rate of 8% simple per annum to reflect the time D has been without use of those funds. Putting things right To put things right HSBC UK Bank Plc must take the following actions: • Pay D the sum of £35,000. • Pay 8% simple per annum, calculated from the date it declined D’s claim under the CRM Code, to the date of settlement.

-- 5 of 6 --

My final decision For the reasons given above, my final decision is that I uphold this complaint and direct HSBC UK Bank Plc to take the actions outlined in the “Putting things right” section of this final decision. Under the rules of the Financial Ombudsman Service, I’m required to ask D to accept or reject my decision before 24 March 2026. Sonal Matharu Ombudsman

-- 6 of 6 --