HSBC UK Bank Plc · DRN-6257053

The complaint Mr M complains that HSBC UK Bank Plc didn’t reimburse him money he lost to fraud. What happened As the circumstances of this complaint are well-known to both parties, I have summarised them briefly below. In November 2023, Mr M received a message purporting to be from HSBC asking if he’d attempted to make a payment that day. Mr M responded that he hadn’t and soon after received a call from someone purporting to be from HSBC’s fraud team. Mr M was told that a member of branch staff was under investigation and that his assistance was required. He was instructed to attend branch and transfer money from his account to keep it safe, which he complied with. Mr M was then passed to another caller who claimed they were from the Financial Conduct Authority (FCA). He told Mr M he would be taking over the investigation and instructed him to liquidate his assets into his HSBC account, open accounts with other providers, and transfer his assets to those accounts. Mr M was then instructed to purchase gold bullion which was collected from his home address by a courier. Again, Mr M complied with these requests. Mr M eventually realised he was the victim of fraud when he was contacted by law enforcement regarding payments that had been made to his account by another victim as part of the fraud. Mr M therefore reported the matter to HSBC. HSBC looked into Mr M’s claim but concluded from its investigations that it was not liable to reimburse his loss. It found that it had provided sufficient warnings regarding the fraud Mr M was a victim of during the payment process, which it says Mr M ignored. It also added that many of the payments made were to Mr M’s own accounts, which it said negated its responsibility to reimburse the funds lost. Mr M remained unhappy with HSBC’s handling of his claim, so he referred the matter to our service for an independent review. An Investigator considered the evidence provided by both parties but concluded that HSBC, along with Mr M’s other account provider, were responsible for his loss. He therefore recommended that liability be split between HSBC and the other provider. HSBC disagreed with that assessment, maintaining that it provided effective warnings to Mr M throughout that were ignored. As agreement couldn't be reached, the matter was passed to me to decide. On 12 March 2026, I issued my provisional findings to both parties setting out that I was minded to reach a different outcome to that of our Investigator. My findings were as follows: “I’ve considered all the available evidence and arguments to decide what’s fair and

-- 1 of 7 --

reasonable in the circumstances of this complaint. Considerations The starting position in law is that payments service providers, such as HSBC, are expected to process payments its customer instructs it to make, as set out in the Payment Services Regulations 2017. There is no dispute here that Mr M authorised the transactions in dispute, so he is presumed liable for those payments in the first instance. However, in deciding what’s fair and reasonable in all the circumstances of this complaint, I’m required to take into account relevant: law and regulations; regulators’ rules, guidance and standards; codes of practice; and, where appropriate, what I consider to have been good industry practice at the time. Taking those into account, HSBC ought reasonably to have been on the lookout for any transactions that would indicate Mr M was at risk of financial harm from fraud. And where it identifies a risk, it ought reasonably to intervene in that payment, ascertain the purpose of it, and provide warnings relevant and proportionate to the risks presented. Furthermore, HSBC was a signatory to the Lending Standards Board’s Contingent Reimbursement Model (the CRM Code) at the time the payments were made. Under that Code, firms are expected to reimburse customers that fall victim to fraud, subject to a number of conditions and exceptions. The CRM Code however only applies to payments made to an account the fraudster controlled and does not cover payments made to one’s own account. In this complaint, only the first payment Mr M made toward the fraud from his HSBC account is covered by the CRM Code, as all subsequent payments were made to accounts Mr M controlled. I will therefore have to consider this payment separately to the others Mr M made. Was HSBC fair in declining Mr M a reimbursement under the terms of the CRM Code? As I have set out above, the starting position under the terms of the CRM Code is that signatories are expected to reimburse a customer who has lost money to fraud unless it can demonstrate a valid exception applies. Those exceptions include, but are not limited to: • the customer ignored an effective warning by failing to take appropriate action in response to that warning. • the customer made the payment without a reasonable basis for believing that the payment was for genuine goods/services and/or the person or business with whom they transacted was legitimate. The first and only payment covered by the scope of the CRM Code was also the first payment made toward the fraud. And HSBC identified this payment as suspicious and suspended it pending further investigation. Mr M, who was under the influence of the fraudsters at the time, was dishonest with HSBC when questioned about the purpose of the payment, explaining it was a gift to his grandson for a mortgage deposit. Having listened to the call between Mr M and HSBC I have noted that Mr M’s responses were confident and astute. So I am not persuaded Mr M’s responses ought to have prompted further concerns from HSBC. Before processing Mr M’s payment, the representative covered specific scenarios that are typical in cases of fraud. The first covered by the representative was specific to the fraud Mr M was in the process of being a victim of. The representative mentioned that fraudsters

-- 2 of 7 --

typically contacted customer purporting to be from HSBC or the police claiming that their account is at risk, and would typically ask customers to move money to a ‘safe account’. The representative told Mr M that HSBC would never ask a customer to do this. I do understand that Mr M was firmly under the spell of the fraudster’s social engineering tactics at the time. But I am persuaded that this warning was effective and covered specifically the circumstances Mr M was in. And as Mr M ignored this warning, I find it reasonable that HSBC seeks to rely on this exception to reimbursement for the payment that was covered by the CRM Code. I will now move on to the subsequent transactions Mr M made from his account to other accounts he held. Did HSBC act reasonably in allowing subsequent payments to be made? HSBC has argued in some of its correspondences that it is not required to reimburse a customer’s loss from a transaction where they have sent funds to their own account. I respectfully disagree with that assertion. It is well-known to HSBC that multi-stage frauds are a common feature in financial crime, specifically to circumvent fraud controls. And a payment to one’s own account does not automatically relinquish HSBC’s responsibility to ensure a customer is not at risk of financial harm from fraud. To the contrary, out of character and unusual payments to one’s own account could increase the risk associated with a payment. For ease of reference, a table of the subsequent payments Mr M made to his own accounts is as follows: Payment no. and date Payment type Amount 2. 11 December 2023 Bank transfer (account 1) £250 3. 16 December 2023 Bank transfer (account 1) £1,500 4. 20 December 2023 Bank transfer (account 1) £20,000 5. 21 December 2023 Bank transfer (account 1) £500,000 6. 12 January 2024 Bank transfer (account 1) £500 7. 17 January 2024 Bank transfer (account 1) £240,000 8. 23 January 2024 Bank transfer (account 1) £10,000 9. 2 February 2024 Bank transfer (account 2) £5,000 10. 5 February 2024 Bank transfer (account 2) £110,000 11. 20 February 2024 Bank transfer (account 2) £20,666 Again, on the second payment Mr M made, HSBC held it for further checks. Mr M contacted HSBC and was asked the purpose of the payment. He told the representative that he was topping up his account held with the other provider, where he paid his bills from. Mr M again answered further questions confidently and astutely.

-- 3 of 7 --

Mr M was again warned about the specific fraud that was being committed against him. This warning set out that fraudsters call pretending to be from the bank or police claiming that there has been a fraud on the account. And the representative also mentioned that the caller’s claim that they need assistance with an investigation and ask to move money to make it safe. They also warned of being on the phone with them during the call and being asked to lie to the bank. The representative told Mr M that HSBC, nor any other financial institution, would ask him to move his money. These warnings ought to have resonated with Mr M, as they matched exactly what he’d experienced. But he was so convinced by the fraudster that he chose to ignore these, despite it being said to him by various HSBC employees up until this point. It is clear that Mr M’s answers were so convincing, and warnings specific to the fraud he was a victim of were not being heeded, that HSBC would not have been able to prevent the fraud up until this point. For the same reasons I have given above, I don’t find that HSBC would have been able to prevent Mr M from making payments 3 and 4. Payment 3 did not appear out of the ordinary and HSBC intervened again on payment 4. Mr M again provided persuasive answers and ignored warnings specific to the fraud he was a victim of. Payment 5 however represented a significant risk. This payment was carried out in branch and HSBC has provided notes from that visit. These notes are not detailed but set out that Mr M told branch staff that he was dividing funds between different bank accounts to allow for FSCS protection. I don’t find this to have been a particularly persuasive reason for moving such a significant amount of money from one account to another, as one would expect several payments to several accounts under the threshold of the FSCS protection. The notes provided contain no information about any test and challenge carried out by branch staff. So it is reasonable to conclude that no such action was taken. Mr M was present in branch and could have been probed further about his testimony. Looking at the overall picture, Mr M was sending £500,000—a significant and out of character sum—to an account he’d only set up as a new payee ten days prior. He’d sent this account over £20,000 in the preceding days and was providing a reason for the payment that didn’t quite add up. The amounts were also increasing in value over time. Mr M had also received over £750,000 into his account from an investment platform the day before he was attempting to make this payment. This is all indicative of a customer at risk of financial harm from fraud. HSBC ought to have gone further here. I find it likely that had it tested and challenged Mr M’s claims and identified the concerning pattern of behaviour on his account, it would have had sufficient cause to request evidence relating to the account Mr M was transferring his funds to. I’m also persuaded that banking protocol measures ought to have been invoked considering these patterns along with Mr M’s age being a factor to consider here. While Mr M was firmly under the spell of the fraudster at the time, I find it likely that these measures would have been sufficient to break the manipulation he’d been subjected to, as was the case when Mr M was eventually contacted by police and persuaded that he was a victim of fraud. For the reasons I have given above, I find that HSBC ought to have done more from the point Mr M made the fifth payment in the table above. And had it done so, I find it likely that the fraud would have been prevented. It therefore follows that HSBC are, at least partially, liable for Mr M’s loss.

-- 4 of 7 --

Should Mr M share liability for his own loss? Having considered the evidence carefully, I do find Mr M ought to have done more to protect himself from this fraud and heed warnings given. I would like to point out that I realise this has been an awful experience for Mr M to endure. And my intention is not to hold him responsible for the actions of the callous fraudsters who have committed this offence against him. But I must take into account what the law says about contributory negligence and apply that to the circumstances of his complaint. The ‘lure’ in this complaint involved a message being sent to Mr M on a platform HSBC would not typically contact him on. While the profile did come up with the logo and name of HSBC, I find that Mr M ought to have done more checks to ensure he was speaking with HSBC before proceeding with any further calls. I do acknowledge that fraudsters are adept at social engineering and manipulation tactics. And I can understand that the pull of assisting with an investigation can be compelling to a well-meaning person. But Mr M ought to have heeded some of the warnings he was being provided and noticed some of the red flags that were present here. While Mr M was told that persons within the branch were under investigation—and therefore untrustworthy—, he was told by multiple members of staff over the phone and in branch that the circumstances he was experiencing was fraud. Mr M also ought to have noted that the requests being made were becoming increasingly suspicious and illegitimate; such as the fraudsters beginning the conversation with telling him a branch member was under investigation, to instructing him to lie to other areas of the bank and other financial businesses. I realise with hindsight that some of the red flags I have pointed to are easy to identify, and understand that Mr M was being carefully manipulated by the fraudsters. But I do find that Mr M could have proceeded with greater care here. Overall, and for the reasons I have set out above, I’m persuaded that it is reasonable for Mr M to share equal liability for his loss.” Both parties were given until 26 March 2026 to provide any further comment. As that deadline has now passed, I’m able to issue my final decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. HSBC has accepted my provisional findings in this matter and has provided no further comment for consideration. However, Mr M has asked that I reconsider my position regarding his liability in this case. He has highlighted vulnerabilities while under the control of the sophisticated and highly motivated fraudsters and has asked that his liability is more reflective of this fact. I would like to thank Mr M for his further submission and would like to assure him that these factors were taken into consideration when reaching my provisional findings. I would like to take this opportunity to explain how I considered these factors in greater detail. I do accept that Mr M was more susceptible to fraud, being considered an ‘older old’ consumer at the time, as defined in the Financial Conduct Authorities’ guidance on the fair

-- 5 of 7 --

treatment of vulnerable customers. But Mr M’s age does not automatically make him vulnerable or less able to protect himself from fraud. As I have already touched upon in my findings in both this matter, and the linked complaint Mr M has against his other banking service provider, I don’t think any vulnerability would have been reasonably identifiable to HSBC at the time he was making the payments. Mr M was clearly of sound mind when being probed as to the purpose of the payments on several occasions by HSBC. He was able to answer questions confidently and astutely, and was coherent and believable in his responses. Mr M also did not seem to lack any understanding of the warnings given to him throughout. I have not seen any evidence that would suggest Mr M lacked mental capacity at the time or was in circumstances that limited his ability to protect himself from the fraud being committed against him. I have already acknowledged that the fraudsters had meticulously manipulated Mr M, as they are well-adept at doing. And I realise Mr M, as a well-meaning person, thought he was assisting authorities with an investigation while protecting his money. But these are the very reasons why I do not consider Mr M more liable than his banking service providers for the loss he has suffered. Equally, I must acknowledge that HSBC did attempt on several occasions to intervene and protect him from harm. Mr M was provided with clear and concise warnings throughout that were identical to the circumstances he was in fact experiencing. And while they ought to have gone further than they did at a point, I cannot disregard the effort that was made by HSBC, or that Mr M continued to make payments despite these warnings and interventions. For these reasons, I remain of the opinion that it is reasonable for Mr M to be held partly liable for his loss in the circumstances. And I believe a 50% reduction in redress is fair when considering what I have set out above. Again, I would like to reiterate that my findings are not intended to lay blame on Mr M for the callous actions of the fraudster, but to acknowledge that all parties ought to have done more here to protect Mr M in the circumstances of this complaint, including Mr M himself. Putting things right As this complaint involves the splitting of liability between two businesses and Mr M, it involves complex calculations. I will set out the calculation for each business’ liability along with the overall reimbursement owed. HSBC ought to have prevented £886,166 of Mr M’s loss. Bank M, which received a proportion of that loss, has taken liability for £501,334.44 of that loss. It is therefore reasonable that the amount HSBC is liable for is reduced by that amount to £384,831.56. Deducting a further 50% of this amount to reflect Mr M’s liability, the total amount owed to him is £192,415.78. HSBC has split liability in this case, so it can only be held liable for 50% of this amount. Therefore, HSBC should reimburse Mr M £96,207.89 of his loss. As HSBC could have prevented Mr M’s loss from the date he made the payments, it should also pay him 8% simple annual interest on this amount from the date the payments were made to the date it settles, to reflect the deprivation of those funds.

-- 6 of 7 --

My final decision For the reasons I have given above, I uphold this complaint and direct HSBC UK Bank Plc to settle this complaint as I have set out above. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr M to accept or reject my decision before 24 April 2026. Stephen Westlake Ombudsman

-- 7 of 7 --