Santander UK Plc · DRN-6259555

The complaint Miss D complains that Santander UK Plc won’t reimburse her with money she lost to a scam. She also complains about the way Santander responded to her scam claim and subsequent complaint. What happened On 10 March 2026 I issued my provisional decision on this complaint. I wanted to give both parties a chance to provide any further evidence and arguments before I issued my final decision. That provisional decision forms part of this final decision and is copied below. What happened Miss D booked a hotel through a well known booking platform. She had been communicating with the hotel about various room requirements through the booking platform’s messaging system. She has told us that: • On 1 July 2025, two weeks before her scheduled stay, she received a message which she believed was from the hotel through the booking platform’s messaging system. The hotel said she needed to provide additional information within eight hours to avoid cancellation of the booking. She clicked on a link which she believed took her to the booking platform’s website. • She provided the requested information about her booking and then was asked to enter her card details as a temporary hold, to be released on confirmation. She had experienced this before so it seemed legitimate. Using her Santander current account debit card, she authorised a payment of £398.22. The page indicated the payment had failed so she attempted to make the transaction again. She was then told there were three more payments to make – and at that stage she became suspicious. • She immediately contacted the hotel, which said they’d not requested any payment and that this was a scam. She then called Santander within five minutes of the transaction to dispute the two payments of £398.22. Santander said when a payment was authorised it couldn’t be reversed, which she found surprising as she works in financial services and understood payments were pending for a period of time. • Santander said it would raise a scam claim and that she would hear within seven to ten days. But as she didn’t hear back, on 16 July 2025 she contacted Santander which gave her a link to submit evidence of the scam. She did so but as she’d not heard by 24 July 2025 she called to chase the claim and complain. Santander logged her complaint but didn’t offer any resolution. • On 2 August 2025 she received a letter from Santander dated 24 July 2025 saying it wasn’t liable for the loss because she’d authorised the payments. It referred her to the card disputes team, which might attempt a chargeback. On 11 August 2025 she

-- 1 of 7 --

received a second letter dated 2 August 2025 asking for additional information even though she’d already submitted the evidence through the link Santander had sent to her. She printed and sent the evidence by special delivery as the pre-paid envelope provided was insufficient. • On 23 August 2025 Santander sent her a letter (which she received on 1 September 2025) stating her claim wasn’t covered under the chargeback scheme and had been closed. Following her holiday she made a formal complaint on 8 September 2025. Santander issued its final response letter on 18 September 2025. In summary, it said the card payments were not covered under any scam-related codes of practice and it couldn’t recover the payments under the chargeback process. Unhappy with Santander’s response to her scam claim and about its service, Miss D asked this Service to look into her complaint. She explained the impact of the scam on her financially and emotionally, which was not helped by the bank’s response and its failure to protect her as its longstanding customer. Our Investigator didn’t uphold Miss D’s complaint. He said Miss D had authorised the payments and they didn’t seem significant enough for Santander to recognise she might be at risk of financial harm by fraud. The chargeback rules didn’t cover scams, so Santander didn’t need to refund Miss D any money despite her being the victim of a cruel scam. Miss D didn’t agree with the outcome and asked for an Ombudsman’s review. She said Santander acted without due care and skill and didn’t take enough steps to protect her from a clear and recognisable scam. In summary, she said: • The transactions were unusual and out of character: they were made in euros which was unusual for her, for exactly the same amount within minutes of each other, to a new payee and inconsistent with her usual spending so this should have triggered Santander’s fraud detections systems and an intervention before it allowed the payments. • Santander failed to give her any effective scam warning about an authorised push payment or booking/invoice scams or intervene in any way allowing the scam to succeed. • Santander failed to act promptly even though she notified it within minutes of realising the transactions were fraudulent. It failed to stop or recover the funds before they left her account, showing poor internal coordination and an ineffective fraud response. A prompt recall could have prevented some or all of the loss. • Santander handled her claim and complaint poorly and failed to support her as a scam victim, and she had to chase for a response several times at a time she was out of pocket and in her overdraft for a longer period of time. • She works in financial services and has to take great care when making transactions. The scam was highly convincing and Santander had a duty to act when unusual or high risk transactions occur. • Under the Payment Services Regulations 2017 and in line with the Contingent Reimbursement Model (CRM) Code Santander must act fairly and reasonably to detect and prevent fraud in the ways she’s described and to handle her complaint in a timely and supportive way. Santander did not exercise the care or fairness required by regulation or industry standards.

-- 2 of 7 --

• She asks us to review whether Santander acted fairly and reasonably in allowing these payments and in its complaint handling, which caused further distress to her – a longstanding customer - at an already difficult time. Our Investigator explained why Miss D’s comments didn’t change his mind. As an agreement couldn’t be reached the complaint was referred to me for review. Through our Investigator, I asked Santander to comment on Miss D’s concerns about its customer service and complaint handling. It’s now done so and, in summary, says that both its scam and chargeback teams gave its responses to her concerns and it responded to her complaint reasonably promptly. We have shared its comments with Miss D. What I’ve provisionally decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I’m sorry to hear Miss D has been the innocent victim of a cruel scam. I don’t underestimate the impact of the scam on her financially and emotionally. I need to decide whether Santander should compensate her for the money she lost to the scam. Having reviewed this complaint, I don’t intend to require Santander to compensate Miss D. I’ll explain why. Miss D has raised the CRM Code. But neither the CRM Code nor the more recent Authorised Push Payment (APP) scam reimbursement rules (ASR) apply to her two disputed card payments. This is because the CRM and the ASR apply only to APP payments. Card payments are not push payments but are ‘pull payments’ – that is, the payment is pulled from the customer’s bank account following their authorisation. It isn’t in dispute that Miss D authorised the two disputed card payments. In broad terms, the starting position at law is that a bank such as Santander is expected to process payments and withdrawals that a customer authorises it to make, in accordance with the Payment Services regulations (in this case the 2017 regulations) and the terms and conditions of the customer’s account. But taking into account longstanding regulatory expectations and requirements, and what I consider to be good industry practice for firms when processing payments, Santander ought to have been on the look-out for the possibility of fraud and made additional checks before processing payments in some circumstances. I’ve considered Miss D’s comments about the two disputed payments, which she says were unusual and out of character for her based on her usual usage of her account. I’ve taken into account that the payments were for identical amounts, made in quick succession to the same payee and were international transactions in euros. Santander’s fraud systems were not triggered, and I appreciate Miss D thinks that they should have been. But I’m conscious that the two payments were for relatively modest amounts and I don’t consider these payments alone would have indicated that Miss D might be at risk of financial harm from fraud. I also need to take into account that Santander needs to strike a balance between protecting against fraud and not unduly hindering legitimate transactions. I don’t consider I can fairly

-- 3 of 7 --

say that Santander ought to have been so concerned about the payments such that it ought to have intervened and provided specific warnings to Miss D. I appreciate Miss D considers Santander ought to have been able to prevent the card payments leaving her account, given she reported the scam to it so promptly after making the second payment. But Miss D authorised Santander to debit these payments to her account and I don’t consider there is a clear mechanism for a successful recall to take place here. I think Santander properly reviewed whether it could recover the money using the chargeback process. But I think it fairly concluded that there could be no successful chargeback in these circumstances, where Miss D had authorised the payments but had sadly been scammed. So I don’t think Santander could successfully have recovered the money for her. I’ve considered Miss D’s complaint about the way in which Santander responded to her scam claim and her subsequent complaint. I think Santander should have responded to Miss D within the timescale it gave her and she shouldn’t have had to chase for a response. I see that its response to her scam report took just over three weeks and was provided to her following her chaser. Miss D had already submitted evidence of the scam so I don’t consider she should have had to submit it again to a different department, although she would still have needed to sign and return the declaration for the chargeback claim. On receipt of the declaration Santander issued its responses on the chargeback issue and her complaint reasonably promptly. Having considered all the circumstances, I think there were some shortcomings in Santander’s service to Miss D. While I accept these shortcomings will have added to Miss D’s frustration, I don’t think Santander’s overall handing of this matter was so poor that I can fairly make a separate award of compensation. My provisional decision For the reasons I’ve explained, I don’t intend to uphold this complaint. Santander responded to say it agreed with my provisional decision. Miss D responded to say she rejected my provisional decision and asked that I reconsider it. She didn’t consider my decision reflected the ‘highly unusual’ nature of the transactions, Santander’s lack of intervention or the significant financial and personal impact on her. In summary, she said: • She restated her points about why she considered the payments were unusual and out of character based on her usual usage of her account, and so should have been readily identifiable through effective fraud monitoring systems. In support of this, she sent us her bank statements for the 12-month period before the scam. • The disputed payments displayed multiple indicators of elevated fraud risk (which she described) and she doesn’t accept my characterisation of them as ‘relatively modest’ as compared to her income and proportion of her available funds. The suggestion that the transaction value was insufficient to trigger concern is flawed. Suspicion must be assessed relative to a customer’s behaviour and financial position, not just absolute thresholds. • The payment journey was not inherently suspicious to her, so it was reasonable for

-- 4 of 7 --

her to proceed without heightened suspicion. • Santander failed to intervene and despite her reporting the transactions promptly it did not block or recall the payments, or mitigate the loss. • The impact on her of Santander’s poor complaint handling has been significant, adding stress at an already difficult time. • Santander did not meet the required standard of care under the Payment Services Regulations 2017, the FCA Consumer Duty or broader regulatory expectations. • Under the Payment Services Regulations 2017 firms must act with appropriate care and in line with good industry practice. The FCA Consumer Duty requires firms to act in good faith, avoid foreseeable harm and support informed decision making. This type of fraud is well known and foreseeable in the industry and appropriate safeguards should be in place. • Santander failed to provide effective and timely warnings or assess the transactions in line with her normal account behaviour. This is inconsistent with FCA Principles including treating customers fairly and providing clear, fair, and not misleading communications. • Given the clear indicators of fraud, the uncharacteristic nature of the transactions and her immediate notification, Santander had reasonable opportunities to mitigate the loss. As a minimum she expects reimbursement of the £796.44 she lost and compensation for her distress and inconvenience for Santander’s poor service. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Although I’ve summarised Miss D’s submissions, I’ve considered all the points she has made. I won’t address all her points in my findings because I’ll focus on the reasons why I’ve made my decision and the key points which I think are relevant to the outcome of this complaint. I have carefully considered all the evidence again, including Miss D’s response to my provisional decision. But I’m not persuaded to change my findings and I don’t uphold this complaint for the reasons given in my provisional decision and below. Before reaching my provisional decision I took into account the regulatory expectations and requirements mentioned by Miss D. I said: ‘But taking into account longstanding regulatory expectations and requirements, and what I consider to be good industry practice for firms when processing payments, Santander ought to have been on the look-out for the possibility of fraud and made additional checks before processing payments in some circumstances.’ To expand on this point further, in broad terms the starting position at law is that a bank such as Santander is expected to process payments and withdrawals that a customer authorises it to make, in accordance with the Payment Services Regulations (in this case the 2017 regulations) and the terms and conditions of the customer’s account.

-- 5 of 7 --

But, taking into account relevant law, regulators’ rules and guidance, relevant codes of practice and what I consider to have been good industry practice at the time, I consider it fair and reasonable that Santander should: • have been monitoring accounts and any payments made or received to counter various risks, including preventing fraud and scams; • have had systems in place to look out for unusual transactions or other signs that might indicate that its customers were at risk of fraud. This is particularly so given the increase in sophisticated fraud and scams in recent years, which firms are generally more familiar with than the average customer; • have acted to avoid causing foreseeable harm to customers, for example by maintaining adequate systems to detect and prevent scams and by ensuring all aspects of its products, including the contractual terms, enabled it to do so; • in some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks, or provided additional warnings, before processing a payment. I am grateful to Miss D for sending me her bank statements, which I had also received from Santander before reaching my provisional decision and had reviewed. I have considered her points around her usual payments made to and from her account and the features of the disputed payments. She makes the point that the payments were not modest for her and should be viewed in the context of her account usage. I appreciate the disputed payments were for meaningful amounts to Miss D and I don’t underestimate that. But I don’t consider the amounts of the payments, their pattern or who they were paid to were so unusual or inherently suspicious such that Santander ought to have intervened to pause or stop payments she’d authorised. The payments were to an international payee in another currency but this doesn’t mean Santander should have realised they were made as a result of fraud. Santander’s fraud detection measures weren’t triggered. I appreciate Miss D thinks they should have been triggered but as I’ve said there is a balance Santander must strike between protecting against fraud and not unduly hindering genuine transactions. Having taken into account all the evidence including Miss D’s comments it is my view that the two disputed payments were not so suspicious such that Santander ought to have intervened and provided scam warnings as she has suggested, having taken into account their amounts, pattern and international nature. I do not base my finding only on ‘transaction value’ or an ‘absolute threshold’ as Miss D suggests. Rather, I have assessed whether the transactions overall were so unusual such as Santander ought fairly and reasonably to have intervened. Although I have considered Miss D’s comments I have decided they were not so unusual to require an intervention and scam warning. Miss D has explained why she considers it was reasonable for her to make the payments. I do acknowledge that she was the victim of a scam, causing her both financial loss and distress. But I’ve decided Santander didn’t need to intervene, so I don’t need to go on to consider whether Miss D contributed to the loss she suffered (which we call ‘contributory negligence’). I understand Miss D thinks that Santander should have been able to prevent the card payments leaving her account given how quickly she reported the fraud. But I don’t agree that was possible in circumstances where she authorised the two card payments. Miss D says Santander failed to mitigate the loss – that is, it failed to reduce the loss to her by attempting to recover the money following her report of fraud. I remain of the view there

-- 6 of 7 --

was no reasonable prospect of Santander recovering the money using the chargeback process where Miss D had sadly been scammed. I have thought again about Miss D’s request for compensation for her distress and inconvenience due to Santander’s handling of her scam report and complaint. I think it could have responded more helpfully. But for the reasons I’ve already outlined I don’t think the way it handled matters was so poor that I can fairly make a separate award of compensation to Miss D. My final decision For the reasons I’ve explained in my provisional decision and in this final decision, I don’t uphold this complaint. Under the rules of the Financial Ombudsman Service, I’m required to ask Miss D to accept or reject my decision before 27 April 2026. Amanda Maycock Ombudsman

-- 7 of 7 --