Lloyds Bank PLC · DRN-5976296

The complaint Mr M complains that Lloyds Bank PLC won’t refund him the money he lost to a scam. Mr M is represented by a professional representative but for ease of reading I’ll refer to Mr M throughout. I’ll also refer to Mr M’s mum as she assisted him in reporting the matter to Lloyds. What happened In May 2022 Mr M paid a total of around £1,600 to a third party for a YouTube channel. Later that month, Mr M paid the third party a further £1600 for YouTube channel training which wasn’t received. The third party told Mr M the reason the training couldn’t be provided was because he’d not received the money. He said his bank account – also an account with Lloyds – was connected to PayPal and so all payments went through PayPal first. He explained that PayPal had blocked the payment and asked Mr M to make a further payment in order to unblock the PayPal account and release the funds. The third party Mr M was liaising with is an alleged fraudster and the technique used here is commonly recognised as an advanced fee scam. Upon making another payment, Mr M still didn’t receive the training and was told the funds were still blocked by PayPal. What followed were further requests for money to unblock the third party’s PayPal account and during the next 12 months, Mr M transferred over £180,000 to the third party. During this time, Mr M was sent spoofed screenshots, purportedly from PayPal, and fake messages between PayPal assist and the third party to support the third party’s story. In January 2024 Mr M’s mum discovered her son had been scammed and contacted Lloyds to report the matter. Mr M’s mum thought Mr M was vulnerable as he is slightly autistic, and his stepdad had passed away not long before the scam started. Her initial submissions to Lloyds were that Mr M had been threatened and extorted for money following the purchase of the YouTube channel. Shortly afterwards, upon gathering further information, Mr M’s mum felt her son had fallen victim to a scam that also involved threatening behaviour from the perpetrator. Mr M’s mum said the matter had had a significant impact on Mr M, leaving him feeling suicidal. After significant investigation into the matter, Lloyds provided Mr M with a refund of £1,600 for the YouTube training that he didn’t receive but it declined reimbursement for the remaining loss under R2(2) of the CRM Code. This was because it had been unable to get a clear picture of events with the story changing from blackmail to a scam. Unhappy with Lloyds’ response Mr M referred his complaint to us. An investigator looked into Mr M’s complaint and upheld it in part. He was persuaded that Mr M had fallen victim to a scam and that payments were covered by the CRM Code. He acknowledged Mr M’s vulnerabilities, but he did not find Mr M met the definition of ‘vulnerable’ under the CRM Code. He felt Mr M could’ve protected himself from the scam he

-- 1 of 9 --

fell victim to and decided that under the CRM Code an exception to reimbursement applied. He thought Mr M didn’t have a reasonable basis for believing the payments he made were legitimate. However, he also thought Lloyds could’ve done more to protect Mr M from financial harm from fraud. He didn’t think Lloyds needed to do any more regarding payments 1 – 20 but he thought that from payments 21 – 57 Lloyds ought to have done more. He thought that by this point Lloyds ought to have identified a scam risk and that, had it sufficiently discussed payment 21 with Mr M, the scam would’ve been exposed and the subsequent losses prevented. On that basis he recommended Lloyds reimburse Mr M 50% of payments 21 – 57. Lloyds didn’t agree with the investigator’s opinion. It said it had declined Mr M’s claim because when it attempted to assess whether reimbursement was due under the provisions of the CRM Code, Mr M acted obstructively or dishonestly and gave conflicting reasons relating to the purpose of the payments. Lloyds argued Mr M’s mum initially reported Mr M had been the victim of blackmail and, after being told that wasn’t something the bank could help with, the story changed. It said Mr M hadn’t provided sufficient evidence to show he’d been scammed and there was no evidence he’d been blackmailed either, rather that Mr M had threatened the alleged perpetrator. It wasn’t persuaded by Mr M’s submissions around the absence of evidence relating to blackmail – that he didn’t know how to use the messaging app he’d used to communicate with the third party properly – because there was evidence on the messaging app screenshots that he did know how to use it. Our investigator maintained his view. He said there was enough evidence of spoofed messages from PayPal to substantiate Mr M’s story that the overall purpose of the payments was to unblock the PayPal account. He didn’t think it was that unusual that Mr M’s mum’s story changed and ultimately didn’t agree that Lloyds could rely on R2(2) of the CRM Code to deny reimbursement either. He didn’t think Mr M or his mother had deliberately set out to be obstructive or change their story, and he thought the overarching intent of R2(2) was to prevent claimants from being reimbursed who are party to the fraud. Mr M’s representative didn’t agree with the investigator’s view either. In summary, they said Mr M was vulnerable to the scam and that he met the definition of vulnerable within the CRM Code. They said the scam itself evidenced this given its implausible nature. They said while there has been no formal diagnosis, assessments when Mr M was younger showed he is likely autistic. They add there is evidence autistic individuals are more vulnerable to financial exploitation due to traits of honesty and taking requests at face value. They further set out that autistic individuals are more trusting, with a limited understanding of risk, and they struggle to communicate what is happening to them. Because neither party agreed with the investigator’s opinion the complaint has been passed to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In deciding what’s fair and reasonable, I am required to take into account relevant law and regulations, regulator’s rules, guidance and standards, and code of practice; and, where appropriate, I must also take into account what I consider to have been good industry practice at the time. The starting point under the relevant regulations (in this case, the Payment Services Regulations 2017) is that Mr M is responsible for payments he authorised himself. But at the relevant time, Lloyds was also a signatory of the Lending Standards Board’s Contingent

-- 2 of 9 --

Reimbursement Model Code (CRM Code) which required firms to refund victims of APP scams in all but a limited number of circumstances. These are known as exceptions to reimbursement. Lloyds should also, as a matter of what is fair and reasonable and what I consider to be good industry practice, have been on the look out for unusual and out of character transactions or other indications that its customer might be at risk of financial harm from fraud. Mr M received goods in relation to payments 1 – 9 and Lloyds has reimbursed Mr M payment 10 – the payment for the YouTube channel training that wasn’t received. The payments that remain in dispute are payments 11 – 57 and for those payments, Lloyds has argued that exceptions to reimbursement apply. It has relied on R2(2) of the CRM Code to deny reimbursement and remains unsure whether the matter relates to blackmail or an APP scam given the inconsistent account of events. It seems to me that the first issue to decide is whether or not what happened to Mr M meets the definition of an APP scam under the CRM Code and whether Lloyds can rely on R2(2) of the CRM Code given the inconsistency in the version of events reported. Did Mr M fall victim to an APP scam and can Lloyds fairly and reasonably rely on R2(2) of the CRM Code to deny reimbursement? The CRM Code defines an APP scam as: … a transfer of funds executed across Faster Payments, CHAPS or an internal book transfer, authorised by a Customer in accordance with regulation 67 of the PSRs, where: (i) The Customer intended to transfer funds to another person, but was instead deceived into transferring the funds to a different person; or (ii) The Customer transferred funds to another person for what they believed were legitimate purposes but which were in fact fraudulent. R2(2) of the CRM Code says ‘In assessing whether a customer should be reimbursed or not, firms should consider whether, during the process of assessing whether the Customer should be reimbursed, the Customer has acted dishonestly or obstructively in a material respect’. I accept that the circumstances in this case are unclear and confusing, and the evidence is incomplete. I understand this would’ve been a difficult case for Lloyds to assess and this has been a difficult case to decide. Where the evidence is unclear and incomplete I need to make my decision based on what I think is more likely than not to have happened (in other words, applying the balance of probabilities). I’ve thought very carefully about whether there is enough evidence to demonstrate Mr M fell victim to an APP scam and whether the payments in dispute meet the CRM Code definition of an APP scam. On balance I am persuaded they do. I’m also not persuaded it is fair or reasonable in the particular circumstances of this case for Lloyds to rely on R2(2) of the CRM Code to deny reimbursement. I’ll explain why. The reason for Lloyds relying on R2(2) is because it alleges Mr M’s story changed over time. That, in turn, has meant Lloyds has been unable to determine whether or not the circumstances relate to an APP scam or something else, like blackmail. The Lending Standards Board produced a Practitioner Guide to help support firms with the application of the CRM Code. Under R2(2), the Practitioner Guide sets out that firms should consider the

-- 3 of 9 --

intent behind the concealment of information, and notes that this can occur due to fear or embarrassment rather than a customer deliberately setting out to mislead their bank for their own gain. I’ve taken this into account when reaching my conclusions. I accept Mr M’s mum’s opening line when she reported the matter to Lloyds was that Mr M had been threatened, blackmailed and extorted. And I accept the call handler told her blackmail is not covered by the bank. I have considered the possibility that following this conversation Mr M and his mum decided to change their story in order to be reimbursed, but I’m not persuaded that is what happened here. Firstly, I think it’s relevant that it was Mr M’s mum rather than Mr M who reported the scam. Having listened to a significant number of lengthy call recordings following that initial scam reporting call, it’s clear that Mr M’s mum pieces together further information relating to what’s happened over time. Given the extent of the loss and the duration over which the payments were made, this seems reasonable. During the initial reporting call Mr M’s mum is clearly shocked and desperate to make sense of what’s gone on. I think the first call handler recognised this. He encouraged Mr M’s mum, who was due to report the matter to the police the following day, to get a good understanding of the circumstances relating to each payment. He recognised she’d referred to blackmail but also to goods not being received, and he advised her to get more information about each payment given this went on for a long time, and because what she’d already relayed indicated that the purpose of the payments may have changed over time. And that is what happened. On reflection and having had time to gather more of the facts, chat through things with the police and Mr M, Mr M’s mum and Mr M provided further information relating to the scam during subsequent calls. Lloyds had several calls with Mr M and his mum; some of these lasting hours. I understand why Lloyds made so many calls – this is a confusing set of circumstances which are difficult to unpick – but it is also less surprising that some of what is said is different each time. On some calls Mr M’s mum is the main speaker and other times it’s Mr M. On some calls with Mr M, he says several times that it isn’t the best time to talk because he doesn’t have a spreadsheet in front of him that helps him recall the purpose of each payment. While I accept the spreadsheet referred to contains little detail regarding the purpose of each payment, I can see how it could help jog Mr M’s memory. It’s also the case that some of the calls are with different call handlers or are follow up calls from the same case handler. As the investigation evolves, questions are understandably positioned differently to try and get to the bottom of things. It isn’t surprising that this leads to slightly different answers from Mr M. As an example, Mr M has two calls with one case handler over a few days. On the first of these calls Mr M describes the threats and the payment associated with it – one payment on 3 January 2023, but he can’t remember if there were threats associated with some of the following payments too. He says the third party was trying to scare him and told him he had explicit pictures of him and knew where he lived. During the call a few days later, the call handler asked further questions on this point. He asked why the third party was blackmailing him given how many payments he’d already made and continued to make after the alleged blackmail. And the call handler tried to establish if the purpose of the payments were due to blackmail or to unblock the PayPal account to get his money back. Mr M struggles to answer these questions – his recollections seem muddled and the conversation is a little unclear. I am not convinced Mr M remembers the detail here. I don’t think he’s being cagey either, rather, upon being asked this question Mr M seems to be reflecting on why he actually made these payments, which by this point was almost a year earlier. While it isn’t completely clear, I think Mr M ultimately responds by referring back to

-- 4 of 9 --

the blocked PayPal account and spoofed PayPal messages as the reason for making the payments. It makes more sense that the payments were ultimately made for this reason rather than a threat from the fraudster which seemed unlikely to materialise. Especially as Mr M had already made so many payments by this point and continued to send several thousands of pounds thereafter, and there are a number of spoofed PayPal messages which, while not specific to each transaction, broadly cover most of the duration of the disputed payments. As Lloyds has noted, other than what Mr M has said, there is no evidence of Mr M actually being blackmailed by the perpetrator. I cannot know for sure whether or not Mr M was blackmailed at any point given the lack of supporting evidence. But when pushed as to why he made the payment in January 2023, given the third party did not have any explicit material to share, and when asked why he continued to make further payments after this point, I’m persuaded it’s more likely than not Mr M believed the primary purpose of the payments were to unblock the PayPal account and get his money back, even though he was increasingly losing hope that it would work. He refers to the payment in question in January 2023 and those following as ‘restarting’ the payments rather than making payments for a different purpose. He says the third party threatened him, but also kept mentioning the payments frozen by PayPal, and continued to send him supporting spoofed screenshots from PayPal. This is also Mr M’s mum’s interpretation of events – that the threats were thrown in to scare her son but he ultimately made the payments to unlock the PayPal account so his money could be returned to him. Turning back to some of the other inconsistencies in the story overall and the lack of clarity. I think it’s also relevant that that reporting call took place 8 months after the final disputed payment was made. Any inconsistencies in his submissions become more understandable against this backdrop. As I have explained, I accept the circumstances here are very confusing and it is difficult to understand, especially in the cold light of day, why Mr M continued to make the payments for as long as he did, and why he paid as much money as he did. But this is often the case with advanced fee scams. While I accept the duration of the scam and amount paid overall is more unusual, I’m persuaded Mr M’s vulnerabilities, which I’ll go on to discuss in more detail, had a bearing here. At times during the calls with Lloyds, I think Mr M seems uneasy and lacks confidence and logic. I’ve thought carefully here as to whether Mr M is hiding something but on balance, based on the evidence available, I am not persuaded this is the case. For the reasons I’ve explained, I’m not persuaded Mr M or his mum had any intent to mislead Lloyds to secure a refund. It follows that I don’t think that it is fair or reasonable for Lloyds to rely on R2(2). On balance, I am not persuaded Mr M or Mr M’s mum were obstructive or dishonest during the claims assessment, rather the circumstances were confusing – driven by the nature of the scam itself, the person reporting the matter not having fallen victim to the scam herself – Mr M’s mum – and Mr M’s vulnerabilities and state of mind at the time. On balance, I think it’s more likely than not the payments in dispute do relate to an APP scam and meet the definition required under the CRM Code. I’ve thought very carefully about whether the payment(s) Mr M made in January 2023, which he has specifically said were associated with threats, should not be considered as payments covered by the Code and treated separately (based on Mr M’s submissions either one payment, or the following three or four made on 3 January 2023). But even if the third party did make threats at certain points, I’m persuaded Mr M believed the primary purpose of the payments he made related to the unblocking of a PayPal account. Initially in order to receive YouTube training on the YouTube channel he’d received, but latterly, in addition to the training, he thought it would

-- 5 of 9 --

ensure he got back all the money he’d paid. I think there are enough spoofed PayPal screenshots and messages to persuade me this is the case. I’m mindful that threats can be and are made during APP scams, and that a threat or blackmail doesn’t necessarily cancel out the underlying scam. I’m not persuaded the perpetrator had any explicit material on Mr M and that even if threats were made, there is no evidence to show the third party had any intent to carry them out. For all the reasons I’ve explained, I think it’s more likely than not that Mr M made each payment to unblock the PayPal account and was duped into doing so. Vulnerability I’ve gone on to think about whether Mr M meets the definition of vulnerable under the CRM Code. Under the CRM Code ‘A customer is vulnerable to APP scams if it would not be reasonable to expect the customer to have protected themselves at the time of being a victim of an APP scam, against that particular APP scam, to the extent of the impact they suffered’. This has been a difficult point to decide but overall, after careful consideration, I’m not persuaded Mr M meets the CRM Code definition of vulnerability. While I accept Mr M had vulnerabilities at the time, I am not persuaded he was unable to protect himself against the scam and to the extent of the impact he suffered. I’ll explain why. Lloyds asked Mr M and his mum several times whether there were any reasons why Mr M might’ve fallen victim to this scam. Mr M’s mum shared that Mr M has a slight vulnerability as he is slightly autistic and she shared that Mr M’s stepdad had fairly recently passed away. The Lloyds call handlers sought to establish how Mr M’s neurodivergence affected him day to day and Mr M and his mum felt that until this point it hadn’t. Mr M’s representative has shared information with us about Mr M’s autism, sharing that he is particularly trusting of information given to him. His representative has also shared information about autistic individuals being more susceptible to scams. While this may be the case, autism affects different people in different ways and it’s important I take into account what I’ve been told about the impact on Mr M specifically. I have not seen sufficient evidence that Mr M’s neurodivergence affects him day to day to such an extent that he was unable to protect himself from the scam. Based on what Mr M has reported, it appears he did have some doubts over time – not necessarily that he was being scammed, but doubts that making the payments would unblock PayPal and release the funds. I don’t think he lacked the capacity to carry out checks into the legitimacy of the arrangement following these doubts. Mr M’s representative has also said Mr M must have been vulnerable to the APP scam and in turn meets the relevant definition in the CRM Code, given he fell victim to scam where he made so many payments to unblock PayPal but never actually made a payment to PayPal. While I understand the point they’re making – that the scam lacks sophistication and plausibility – it doesn’t automatically follow that someone meets the definition of vulnerability in circumstances where a scam lacks plausibility. Here, there is simply insufficient evidence to persuade me Mr M fell victim to the scam because he met the definition of vulnerable under the CRM Code, such that no exceptions to reimbursement should apply. Exceptions to reimbursement Now that I’ve established the payments Mr M made meet the definition of an APP scam and reached my conclusion that he doesn’t meet the definition of vulnerable under the CRM Code, I’ve gone on to think about whether any exceptions to reimbursement should apply.

-- 6 of 9 --

There are a number of exceptions that firms can rely on to deny reimbursement. For broadly the same reasons as the investigator, I think Lloyds can fairly rely on R2(1)c: In all the circumstances at the time of the payment, in particular the characteristics of the customer and the complexity and sophistication of the scam, the Customer made the payment without a reasonable basis for believing that: i) The payee was the person the Customer was expecting to pay ii) The payment was for genuine goods or services, and/or iii) The person or business with whom they transacted was legitimate I do not think Mr M had a reasonable basis for believing the payments were for genuine goods or services, or that the person with whom he transacted with was legitimate. I say this because the scam was not particularly plausible or sophisticated and I think Mr M ought to have checked the situation he found himself in was legitimate before making the payments. I’ve not seen evidence which convinces me the third party provided plausible reasons as to why Mr M needed to make payments to unblock a PayPal account via another Lloyds account rather than through PayPal directly. Like the investigator, I accept consumers aren’t likely to know the intricacies of how financial institutions may unblock accounts, but asking the original sender of the funds to send more money (and in this case a significant number of times, amounting to a significant cost), seems unlikely to be legitimate. I say this having taken into account the spoofed PayPal screenshots from PayPal assist requesting funds, and other spoofed screenshots from PayPal showing how much money was in the account. Given the suspicious nature of the request for funds, I don’t think Mr M should’ve taken the screenshots at face value and I think he should have taken steps to verify their authenticity – such as by contacting PayPal directly. I’m also mindful the quality of the screenshots themselves are not to the standard of a legitimate organisation. As time went on, I think Mr M’s basis for belief that he was engaging in a legitimate arrangement became less and less given the amount of payments he was requested to make over a significant period of time. I’ve thought carefully about Mr M’s vulnerabilities in reaching these conclusions but overall, I think it is fair and reasonable Mr M is held partly responsible for the loss he incurred. I’m persuaded Mr M did spot red flags and did challenge the fraudster at times, but overall I don’t think he took the steps he ought to have done off the back of these observations. Overall I’m satisfied Lloyds can fairly and reasonably rely on an exception to reimbursement and that means it can hold Mr M liable for the loss in part. Did Lloyds do enough to protect Mr M from financial harm from fraud? I’ve gone on to think about whether Lloyds met the standards required of it under the CRM Code and whether it ought to have done more to protect Mr M from financial harm from fraud. The CRM Code says that where firms identify APP scam risks in a payment journey, they should provide effective warnings to their customers. And as I have explained, Lloyds should also, as a matter of what is fair and reasonable and what I consider to be good industry practice, have been on the look out for unusual and out of character transactions or other indications that its customer might be at risk of financial harm from fraud. I agree with the investigator that prior to payment 21, I don’t think Lloyds needed to do more

-- 7 of 9 --

than it did as the payments were not concerning enough in nature. But a pattern of fraud emerged over time. The payments progressed in frequency and amount and by the time Mr M made payment 21, a payment of £5,467, I’m satisfied Lloyds ought to have done more than it did as it ought fairly and reasonably to have identified an APP scam risk. I say this because this payment was out of character and unusual for Mr M’s account. It was the second large payment Mr M made to the same recipient that day, amounting to a total of £10,100 – this was a significant sum for Mr M to have sent and out of keeping with his typical account activity. It also followed a pattern of payments to the same recipient – despite only having added the recipient as a new payee just over two weeks earlier, Mr M had already sent rapidly increasing sums – indicating a pattern of fraud. There was also a change to the way Mr M was managing his account. Having previously kept a steady account balance Mr M was moving money to his account from elsewhere in order to fund the transactions. Despite Lloyds assertions that the recipient account was an established payee, it was only established as part of the fraud and as I have explained, over time, the payments sent to this payee ought to have prompted concern rather than reassurance. It is therefore surprising that Lloyds did not intervene on payment 21. At this stage Lloyds ought to have provided an effective warning, and given the circumstances here I think Lloyds ought to have fairly and reasonably contacted Mr M and made enquiries about the purpose of the payment before processing it. Within these enquiries Lloyds ought to have asked Mr M questions about the previous 20 payments he’d already made over a two week period to gain greater context. Had it done so, I don’t think Mr M could’ve provided a plausible explanation and I don’t think he’d have been able to satisfy Lloyds that he wasn’t the victim of a scam. I’ve reached this conclusion despite Lloyds records indicating Mr M wasn’t honest with it about one of the scam payments. During the reporting call, Lloyds’ call handler told Mr M’s mum that it did intervene when Mr M attempted to make a payment of £3000 in December 2022. It said that Mr M said the payment was for a PC bundle that he was buying from a friend who lived close by. The call handler says that no further questions were asked of the subsequent payments as there were no suspicions. While I’ve not heard this interaction, it’s important to note that by this point Mr M was attempting to make the 42nd payment to this recipient, meaning he’d already sent this individual over £130,000 and went on to send almost £50,000 more. Based on the limited information I’ve received about this intervention, I think Lloyds ought to have done much more here. While I accept Mr M wasn’t honest about the purpose of this payment, it doesn’t automatically follow that Mr M wouldn’t have been honest had he received sufficient probing relative to the scam risk presented. I don’t think Mr M would’ve been capable of persuasively explaining a credible reason for the payment or those that had gone before it, and following sufficient questioning I think he’d have been honest. And my thoughts are the same had Lloyds sufficiently probed the circumstances surrounding payment 21. I think it’s more likely than not the scam would’ve been exposed and stopped. Overall, while I’m satisfied a valid exception to reimbursement applies, I’m satisfied Lloyds ought to have done more to protect Mr M from financial harm from fraud and failed to meet the standards required of it under the CRM Code. This means that Lloyds can fairly and reasonably be held liable for 50% of Mr M’s loss from payment 21 to payment 57 inclusive. Lloyds actions as the recipient firm Mr M is also unhappy with Lloyds’ role as a recipient bank given the fraudster also banked

-- 8 of 9 --

with Lloyds. I’ve thought carefully about whether Lloyds’ liability should increase based on the role it played as a recipient bank. Banks have long standing obligations to ensure accounts aren’t opened or being used fraudulently. As Lloyds was also signed up to the CRM Code, the Code also sets out what is expected of a receiving firm. In summary it sets out that firms should take reasonable steps to prevent accounts from being used to launder the proceeds of an APP Scam, have procedures to prevent, detect and respond to the recipient of fraudulent funds, and where it identifies funds and is concerned that they may be the proceeds of an APP scam, it should freeze the funds and respond in a timely manner. Taking the above into account, while I’m limited in the information I can provide about the receiving account for data protection reasons, I am satisfied Lloyds should not bear any further responsibility for Mr M’s loss. I say this because the evidence I’ve reviewed satisfies me that Lloyds opened the recipient account correctly and there was nothing at account opening to suggest the account would later be used for fraudulent purposes. And, having reviewed the recipient account activity, I’m not persuaded there was enough going on to give Lloyds cause for concern. Recovery of funds I’ve finally looked at whether Lloyds did all it could to recover Mr M’s funds lost to the scam and if it didn’t, whether or not this made any difference. I can see that by the time the scam was reported, the money had already been moved from the receiving account so there is nothing more Lloyds needs to do here to put things right. My final decision My final decision is that I uphold Mr M’s complaint against Lloyds Bank PLC in part. I require Lloyds Bank PLC pays Mr M: • 50% of payments 21-57 • 8% interest per year from the date of the payments to the date of settlement. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr M to accept or reject my decision before 28 April 2026. Katie Doran Ombudsman

-- 9 of 9 --