HSBC UK Bank Plc · DRN-5931199

The complaint Mr and Mrs S complain that HSBC UK Bank Plc won’t refund the money they lost when they were the victims of what they feel was a scam. What happened In April 2020, Mr S decided to invest in a company his wife had previously invested in which leased cars. He understood his investment would be used to fund vehicles which would then be leased out, and that he would receive fixed interest payments each month. And Mr S then made two payments totalling £28,000 from a joint HSBC account he held with Mrs S to account details he was given for the car leasing company. I’ve set out the payments made from Mr and Mrs S’s account below: Date Amount 8 April 2020 £25,000 8 April 2020 £3,000 Mr and Mrs S received the interest payments they were told they would from this investment until January 2021, but the payments then stopped. And after the car leasing company went into administration, Mr and Mrs S suspected they had been the victims of a scam and reported the payments to HSBC. HSBC investigated but said it was awaiting industry guidance and so didn’t agree to refund the money Mr and Mrs S had lost. Mr and Mrs S weren’t satisfied with HSBC’s response, so referred a complaint to our service. One of our investigators looked at the complaint. They didn’t think it was fair to delay the outcome of the complaint. They also said they thought the circumstances here met the definition of a scam and were satisfied Mr and Mrs S had no reason to suspect the investment wasn’t legitimate. So they recommended HSBC refund their losses in full. HSBC disagreed with our investigator, so the complaint has been passed to me. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In broad terms, the starting position at law is that a firm is expected to process payments and withdrawals that a customer authorises, in accordance with the Payment Services Regulations and the terms and conditions of the customer’s account. However, where the customer made the payment as a consequence of the actions of a fraudster, it may sometimes be fair and reasonable for the bank to reimburse the customer even though they authorised the payment. At the time of these payments, HSBC was a signatory of the Lending Standards Boards Contingent Reimbursement Model (the CRM code). This required firms to reimburse

-- 1 of 7 --

customers who had been the victim of certain types of scams, in all but a limited number of circumstances. But customers were only covered by the code where they had been the victim of a scam – as defined in the code. Is it appropriate to determine this complaint now? HSBC has argued that the payments Mr and Mrs S made are the subject of an ongoing complex investigation and it would be fair to wait for the outcome of this investigation before making a decision on whether to reimburse them. And R3(1)(c) of the CRM code says: “If a case is subject to investigation by a statutory body and the outcome might reasonably inform the Firm’s decision, the Firm may wait for the outcome of the investigation before making a decision.” So I’ve considered whether the outcome of this investigation is reasonably likely to impact HSBC’s reimbursement decision, and so whether it’s fair for it to rely on R3(1)(c) to delay making a decision on this case. And whether it would be appropriate to delay my decision in the interests of fairness, as a case against the car leasing company’s directors is still progressing through court. There may be circumstances and cases where it’s appropriate to wait for the outcome of external investigations and/or related court cases. But that isn’t necessarily so in every case, as it may be possible to reach conclusions on the main issues on the basis of evidence already available. And it may be that the investigations or proceedings aren’t looking at quite the same issues or doing so in the most helpful way. I’m conscious, for example, that any criminal proceedings that may ultimately take place might concern charges that don’t have much bearing on the issues in this complaint; and, even if the prosecution were relevant, any outcome other than a conviction might be little help in resolving this complaint because the Crown would have to satisfy a higher standard of proof (beyond reasonable doubt) than I’m required to apply (which is the balance of probabilities). In order to determine Mr and Mrs S’ complaint, I have to ask myself whether, on the balance of probabilities, the available evidence indicates that it’s more likely than not that they were the victims of a scam rather than a failed investment. But I wouldn’t proceed to that determination if I consider fairness to the parties demands that I delay doing so. I’m aware that Mr and Mrs S first raised their claim with HSBC in June 2025, and I need to bear in mind that this service exists for the purpose of resolving complaints quickly and with minimum formality. With that in mind, I don’t think delaying giving Mr and Mrs S an answer for an unspecified length of time would be appropriate unless truly justified. And, as a general rule, I’d not be inclined to think it fair to the parties to a complaint to put off my decision unless, bearing in mind the evidence already available to me, a postponement is likely to help significantly when it comes to deciding the issues. The Serious Fraud Office (SFO) had been carrying out an investigation into the car leasing company and several connected companies. But that investigation concluded on 19 January 2024 when the SFO published the outcome of the investigation, which included the charging of former company directors with fraud, on its website. The Lending Standards Board has also said that the code does not require a criminal test to have been met before a reimbursement decision can be reached. Nor does it require a firm to prove the intent of the third party before a decision can be reached.

-- 2 of 7 --

So, for reasons I’ll explain in more detail below, I don’t think it’s necessary to wait for the outcome of any further investigation or connected court case for me fairly to reach a decision on whether HSBC should reimburse Mr and Mrs S under the provisions of the CRM code. I’m satisfied there is already convincing evidence to demonstrate on the balance of probabilities that those who invested with the car leasing company were dishonestly deceived about the purpose of the payments they were making and that Mr and Mrs S were the victims of a scam. So it is appropriate for me to consider this complaint. I’m also aware that the Financial Services Compensation Scheme (FSCS) is accepting customer claims submitted to it against the car leasing company’s parent company. More information about the FSCS’s position on claims submitted against the parent company can be found on the FSCS’s website. The FSCS is also aware that we have issued recent decisions upholding complaints against banks related to the car leasing scheme. Whether the FSCS pays any compensation to anyone who submits a claim to it is a matter for FSCS to determine, and under their rules. It might be that the parent company has conducted activities that have contributed to the same loss Mr and Mrs S are now complaining to us about in connection with the activities of HSBC. As I’m minded to uphold this complaint for the reasons given below, Mr and Mrs S should know that as they will be recovering compensation from HSBC, they cannot claim again for the same loss by making a claim at the FSCS (however, if the overall loss is greater than the amount they recover from HSBC, they may be able to recover that further compensation by making a claim to the FSCS, but that will be a matter for the FSCS to consider and under their rules.) Further, if Mr and Mrs S have already made a claim at the FSCS in connection with this matter, and in the event the FSCS pays compensation, Mr and Mrs S are required to repay any further compensation they receive from his complaint against HSBC, up to the amount received in compensation from the FSCS. Our service and the FSCS operate independently, however in these circumstances, it’s important that we and the FSCS are working together and sharing information to ensure that fair compensation is awarded. More information about how we share information with other public bodies can be found in our privacy notice on our website. Have Mr and Mrs S been the victims of a scam, as defined in the CRM code? The relevant definition of a scam from the CRM code is that the customer transferred funds to another person for what they believed were legitimate purposes but were in fact fraudulent. The CRM code also says it doesn’t apply to private civil disputes, such as where a customer has paid a legitimate supplier for goods or services but has not received them, they are defective in some way, or the customer is otherwise dissatisfied with the supplier. So in order to determine whether Mr and Mrs S have been the victims of a scam as defined in the CRM code I need to consider whether the purpose they intended for the payments was legitimate, whether the purposes they and the car leasing company intended were broadly aligned and then, if they weren’t, whether this was the result of dishonest deception on the part of the company. From what I’ve seen and what they’ve told us, I’m satisfied Mr and Mrs S made the payments here with the intention of investing with the car leasing company. They thought their funds would be used to purchase vehicles which would then be leased out, and that

-- 3 of 7 --

they would receive returns on their investment. And I haven’t seen anything to suggest that Mr and Mrs S didn’t think this was legitimate. But I think the evidence I’ve seen suggests the car leasing company didn’t intend to act in line with the purpose for the payments it had agreed with Mr and Mrs S. Mr and Mrs S appear to have been led to believe their capital would be used to fund specific vehicles, which would be secured in their favour until the leases were repaid. The promotional material I’ve seen for the company refers to the investment as ‘asset-backed’ and frequently refers to the investor’s car or the car they have funded. And Mr and Mrs S were given a vehicle funding form, which states they had funded two units and the make of the specific vehicles will be confirmed later. But there’s no record at Companies House of any charge in Mr and Mrs S’ favour over any vehicle with the company following their investment. And the Financial Conduct Authority (FCA)’s supervisory notice to one of the connected companies said that, while the companies had around 1,200 customers and had entered around 1,200 leases, they had only registered 69 vehicles at Companies House – which suggests the vast majority of the vehicles funded weren’t secured in the way I think Mr and Mrs S were led to believe theirs would be. The FCA also checked a sample of the vehicles the companies held against the DVLA database, and found a significantly larger proportion of these were second-hand than the companies’ stated business model suggests or would support – as it relied on securing significant discounts on new vehicles, which wouldn’t be available on second-hand vehicles. It also found a number of leases started significantly before the vehicles were put on the road, and some vehicles not found on the database at all. And the FCA said it considered the companies’ valuation of the vehicles it held was unrealistic and that the group’s liabilities significantly exceeded its assets. A report by the administrators of one of the connected companies also said that the total number of loan agreements was 3,609, relating to 834 investors, but that the number of vehicles held by the group at the appointment of the administrators was 596 – or less than one car for every six loan agreements. So I think the evidence shows the car leasing company wasn’t acting in line with the business model and features of the investment it had led Mr and Mrs S to believe they were making. And so the purpose the company intended for the payments Mr and Mrs S made wasn’t aligned with the purpose Mr and Mrs S intended for the payments. The SFO has also said that the former company directors are accused of providing those who invested with false information and encouraging people to pay in whilst knowing that investments were not in reality backed up by the cars they had been promised. So I think the discrepancy in the alignment of the payment purposes between Mr and Mrs S and the company was the result of dishonest deception on the part of the company. Returning to the question of whether in fairness I should delay reaching a decision pending developments from external investigations, I have explained why I should only postpone a decision if I take the view that fairness to the parties demands that I should do so. In view of the evidence already available to me, however, I don’t consider it likely that postponing my decision would help significantly in deciding the issues. As I’ve explained above, there is significant evidence about the actual activity carried out by the car leasing company already available. And while the connected court case is still ongoing, there is no certainty as to

-- 4 of 7 --

when it would be concluded nor what, if any, new light it would shed on the evidence and issues I’ve discussed. I’ve also considered that there may be evidence our service does not have access to or that may become available at a later date. But, for the reasons I’ve explained above, I’m satisfied there is sufficient evidence available here for me to come to a fair and reasonable decision on this complaint and I don’t consider it likely that the outcome of any ongoing investigation or court case would significantly affect the conclusions I have reached. And so I still think the circumstances here meet the definition of a scam from the CRM code. Are Mr and Mrs S entitled to a refund under the CRM code? As I explained above, HSBC was a signatory of the Lending Standards Boards Contingent Reimbursement Model (the CRM code). This code required firms to reimburse customers who had been the victim of authorised push payment scams, like the one I’ve explained I’m satisfied Mr and Mrs S fell victim to, in all but a limited number of circumstances. And it is for the firm to establish that one of those exceptions to reimbursement applies. Under the CRM code, a firm may choose not to reimburse a customer if it can establish that: • The customer ignored an effective warning in relation to the payment being made • The customer made the payment without a reasonable basis for believing that: o the payee was the person the customer was expecting to pay; o the payment was for genuine goods or services; and/or o the person or business with whom they transacted was legitimate There are further exceptions within the CRM code, but these don’t apply here. From what I’ve seen, the communication Mr and Mrs S had with the car leasing company and the documents they received about the investment all appear to have been relatively professional and looked legitimate. The way Mr and Mrs S were told the investment would work doesn’t appear to be suspicious and the returns they were told they would receive don’t appear to be too good to be true. And it appears the company had been operating for several years, one of the connected companies was authorised and regulated by the FCA, and a number of previous investors – including Mrs S herself – had received the returns they were told they would. So I don’t think there was anything about the investment that should have caused Mr and Mrs S significant concern, or that HSBC has established that they made the payments without a reasonable basis for belief that the investment was legitimate. HSBC has said Mr and Mrs S were shown a warning when making the payments which said: “This could be a scam Fraudsters can offer you what appears to be a genuine opportunity with high returns. They can try to pressure you to invest your savings or transfer your current pension to a new scheme. • Take time to talk to someone you trust who is not involved with the investment • You must independently research who you’re sending money to

-- 5 of 7 --

• Check the company is genuine and authorised by the Financial Conduct Authority by visiting https://www.fca.org.uk/consumers/unauthorised-firms- individuals#glossary • Company names can be cloned. It’s vital you contact the company on an independently verified number Visit our Fraud Centre to find out more By choosing to continue, you agree you’ve read our warning and are happy to proceed. You accept we may not be able to recover your money if it’s sent to a fraudster’s account.” But while this warning did mention to possibility of investment scams, I don’t think it gave enough detail about what this kind of scam could look or feel like. And I don’t think it gave clear enough guidance on the checks Mr and Mrs S could have carried out to check whether the car leasing company was genuine. Mrs S had also previously invested with the company and received returns, and one of the connected companies was authorised by the FCA. So I think Mr and Mrs S would reasonably have felt they had satisfied themselves the car leasing company was genuine. And so I don’t think this warning was specific or impactful enough to be effective in Mr and Mrs S’ circumstances, or that HSBC has established that they ignored an effective warning in relation to the payments they made. And so I don’t think HSBC has established that any of the exceptions to reimbursement under the CRM code apply here, and so it should refund the money Mr and Mrs S lost in full. Redress As Mr and Mrs S received a number of monthly interest payments back from the car leasing company in relation to these payments, I think it would be fair for these payments to be deducted from the amount HSBC has to refund them. From what I’ve seen, Mr and Mrs S’ payments to the car leasing company totalled £28,000, and they received nine interest payments back following this, totalling £4,812.48. So their remaining loss to be refunded is £23,187.52. I also don’t think any action I would’ve expected HSBC to take would have prevented Mr and Mrs S making these payments, as I don’t think any of the information I would’ve reasonably expected it to have uncovered at the time of the payments would’ve uncovered the scam or caused it significant concern. But I do think there was sufficient evidence available at the time – particularly the outcome of the SFO investigation published on 19 January 2024 – for HSBC to assess Mr and Mrs S’ claim and conclude that they had been the victims of a scam. So I think HSBC should have refunded Mr and Mrs S’ losses in its original response to their claim, and so should now pay 8% interest on this refund from the deadline for its original response to their claim until the date of settlement. My understanding from the administrator’s statement about the car leasing company and connected companies is that the company owed over £40 million to investors that it was unable to pay – and that this far outweighs its assets. So it is far from certain that complainants will receive anything back at all. But it is possible Mr and Mrs S may recover some further funds in the future so in order to avoid the risk of double recovery, if it wishes,

-- 6 of 7 --

HSBC is entitled to take an assignment of the rights to all future distributions under the administrative process before paying the award. My final decision For the reasons set out above, I uphold this complaint and require HSBC UK Bank Plc to: • Refund Mr and Mrs S the £23,187.52 loss they suffered as a result of this scam • Pay Mr and Mrs S 8% simple interest on that refund, from the deadline for its original response to their claim until the date of settlement Under the rules of the Financial Ombudsman Service, I’m required to ask Mr and Mrs S to accept or reject my decision before 13 March 2026. Alan Millward Ombudsman

-- 7 of 7 --