Bank of Scotland plc trading as Halifax · DRN-6260544

The complaint Mr H complains that Bank of Scotland plc trading as Halifax (‘Halifax’) did not fully reimburse the funds he says he lost to a scam. What happened What Mr H says Mr H’s nephew was looking to come to the UK to work. He’d spoken to someone he found on social media who I’ll call “K”. K could supposedly help Mr H’s nephew through the process of obtaining a visa to work in the UK. But Mr H’s nephew was told he needed help from someone already living in the UK and asked Mr H to represent him. Mr H chatted with K by text message, spoke on the phone and also met him in person. K had said he represented a well-known healthcare provider I’ll call “B”. He told Mr H that he would need to pay £12,000 and that would cover the costs of his nephew’s application, plane fares, and any visa and NHS fees. K said once everything was paid, he’d process the application and said it could take a maximum of six months. Mr H met K at what he believed was his home and paid him £3,000 in cash. While he was with K, Mr H was given a cheque for £12,000 and was told that if the application wasn’t successful, he could cash the cheque and get his money back. On 1 October 2023, Mr H made the following payments to K from his Halifax account: Payment Date & time Payee Payment type Amount 1 1 October 2023 14:32 Bank account held by K Transfer £100 2 1 October 2023 14:43 Bank account held by K Transfer £1,900 3 1 October 2023 14:43 Bank account held by K Transfer £3,000 4 1 October 2023 14:44 Bank account held by K Transfer £3,000 5 1 October 2023 14:45 Bank account held by K Transfer £1,000 Total payments £9,000 Mr H says these payments were funded by himself, his nephew and other family members that he now owes the lost money to. After the payments, Mr H’s nephew received information and documentation from K and had interviews, but none ever led to obtaining a certificate of sponsorship or a job as expected. After a while all contact with K stopped and the cheque he gave Mr H wasn’t able to be cashed. Mr H raised a claim with Halifax in April 2024. Halifax rejected the claim and didn’t reimburse him. Mr H raised a complaint in December 2024 and upon review, Halifax changed its position and in February 2025 it partially upheld the complaint and paid Mr H £2,156.96. Unhappy that Halifax didn’t fully refund him, Mr H brought his complaint to our service. He says that the payments should have looked suspicious compared to his previous account activity but Halifax didn’t do anything to stop the payments.

-- 1 of 8 --

What Halifax says Halifax assessed the claim and subsequent complaint under the provisions of the Contingent Reimbursement Model Code (‘CRM Code’). Halifax initially decided that it had met its obligations under the CRM Code but Mr H hadn’t. As such it wouldn’t be reimbursing Mr H. When Mr H raised his complaint Halifax changed its mind. Halifax said it could have done more to protect him and said it should have stepped in at the time of payment four. But because it still felt Mr H could also have done more to protect himself, Halifax only reimbursed 50% of payments four and five. Halifax paid Mr H £2,156.96. This included £2,000 (50% of payments four and five) and £106.96 simple interest at 8% per year, worked out from the date Mr H’s initial claim was rejected in April 2024, less a tax deduction. It also included £50 compensation as an apology for the inconvenience caused by not coming to the same decision in April 2024. In its submissions, Halifax also said it was Mr H’s nephew that had located details of K and that Mr H hadn’t completed any additional checks on K himself and there was no proof he truly represented B. It should also have been a red flag to Mr H that someone representing a large organisation like B would invite a customer to their own home to conduct business or ask for a large amount of cash to be paid. Our investigation so far One of our Investigators considered the complaint and recommended that it be upheld in part. In short, he said Halifax should have provided an Effective Warning and intervened on an earlier payment, and so it should further reimburse Mr H. He also concluded that Halifax wasn’t responsible for the cash payment he made to K and said that the £50 compensation already paid was fair. The Investigator recommended Halifax pay Mr H £325 plus 8% simple interest per year, worked out from the date the payment was made until it is refunded. The figure of £325 took into account that Mr H didn’t personally fund most of the loss, it also took into account the amount previously refunded to him and that the Investigator felt he was only due back 50% of his remaining personal loss. Halifax agreed with the Investigator’s findings, but Mr H didn’t. Because Mr H didn’t agree with the outcome of our Investigator’s assessment, the complaint has been passed to me to make a final decision. I sent Mr H and Halifax a provisional decision on 13 March 2026, setting out why I intend to uphold the complaint. In my provisional decision I said the following: “It isn’t in dispute that Mr H authorised the payments. Because of this the starting position – in line with the Payment Services Regulations 2017 – is that Mr H is liable for the transactions. But he says he has been the victim of an authorised push payment (APP) scam. Halifax was signed up to the voluntary CRM Code, which provides additional protection to scam victims. Under the CRM Code, the starting principle is that a firm should reimburse a customer who is the victim of an APP scam (except in limited circumstances). But the CRM Code only applies if the definition of an APP scam, as set out in it, is met. Halifax hasn’t disputed that what happened is an APP scam and has given an outcome under the CRM Code. Is Mr H entitled to reimbursement under the CRM Code?

-- 2 of 8 --

Under the CRM Code, a Sending Firm (in this case Halifax) may choose not to reimburse a customer if it can establish that*: • …The customer made the payment without having a reasonable basis for believing that: • the payee was the person the Customer was expecting to pay; • the payment was for genuine goods or services; and/or • the person or business with whom they transacted was legitimate. • The customer ignored what the CRM Code refers to as an ‘Effective Warning’ by failing to take appropriate action in response to such an Effective Warning. *Further exceptions outlined in the CRM Code do not apply to this case. When assessing whether it can establish these things, Halifax must consider whether they would have had a ‘material effect on preventing the APP scam’. Reasonable basis for belief I have considered whether Mr H had a reasonable basis to believe K was legitimate and was providing a genuine service to Mr H’s nephew. Taking into account all of the circumstances of this case, I don’t think Mr H had a reasonable basis for believing the payment was for genuine goods or services; and/or the person or business with whom he transacted was legitimate. I acknowledge that Mr H was introduced to K by his nephew and that his nephew was satisfied that the opportunity was genuine. I also accept Mr H trusted his nephew and spoke to and met K himself, but having looked at the evidence and testimony available to me, I consider there to have been enough warning signs that ought to have caused Mr H concern, which he does not appear to have reasonably acknowledged or acted upon. - I appreciate Mr H was acting at the request of a trusted family member who had found K and started the conversation with him. I have seen chats between Mr H’s nephew and K, the conversation quickly turned to K needing to liaise with a relative in the UK – which is how Mr H became involved. Although K sent Mr H’s nephew a picture of a supposed identity card to evidence he worked for B, I can’t see that Mr H’s nephew asked any questions to K to try and verify his legitimacy before the payments were made. So while Mr H trusted his nephew and what he’d told him about K, I can’t see that he would have had much evidence, if any, to reasonably persuade Mr H that K was legitimate. - Mr H spoke to K on the phone and then met him in person. Mr H has said he asked K about how long the process would take and where his nephew would be stationed. Mr H says K told him his nephew could choose where to work anywhere across the UK and that when he checked B’s website he could see B operated across the UK. But based on the information I’ve been provided I can’t see that Mr H carried out any other checks on K to verify his claims were legitimate, that he truly worked for B or what B’s genuine process was for employing overseas workers. - Mr H had to pay £12,000 and was told this would cover the cost of the application, plane fares and any fees involved. I think Mr H should have had concerns that he was asked to pay £3,000 in cash, and £9,000 to a personal bank account in the name of K – rather than paying directly to the company K was supposedly working for. I can’t see that Mr H asked K why he needed to pay him directly and partly in cash instead of directly to B – a legitimate organisation. - It also doesn’t appear that any breakdown of the charges was provided – considering

-- 3 of 8 --

fees are often set amounts and flight costs vary over time. There’s no paperwork to confirm what Mr H was actually paying for nor can I see any evidence that Mr H asked K about this or received persuasive answers to justify the costs involved. - I appreciate Mr H had met K in person and seen identification, but that in itself is also a red flag. It’s not usual for a representative of a large organisation like B to request to meet people at their employees’ home rather than at an official premises. - Mr H has said that it’s openly discussed in his community that care work visas are processed by company staff and it requires money to complete the applications. He has said he has seen a good number of people in his town come from overseas to work, costing them £10,000 to £20,000 to do so, and knows at least two people in his known circles that paid these amounts. I appreciate that this will have carried a lot of weight in persuading Mr H that this was a way for people to come and work in the UK from overseas. But based on the information available to me, it doesn’t appear that Mr H researched the legitimate process of obtaining a certificate of sponsorship or visa. There are easy to find government websites which explain what certificates of sponsorship are, how they are issued, who can issue them, the cost of them and links to a register of firms that are licensed to issue such certificates. Further there is information about overseas workers generally and the due process to follow to obtain a visa. I think it would have been reasonable for Mr H to have taken steps to research the legitimate process before making the payments which would have shown him there was no need for a third party to be involved and he was paying far more than necessary. - Mr H’s nephew had found K on a social media group relating to care work in the UK. While social media can be used by genuine businesses and services, it’s also used by fraudsters and isn’t a reliable place to find legitimate services like visa applications. I think this should have been a red flag to Mr H and further research should have been carried out before believing K about what he could provide. Taking everything into account, including the size of the payments and the risk involved, I’m satisfied Mr H should’ve had reasonable cause for concern that things might not be as they seem at the time he made the payments from Halifax. But it doesn’t appear that he made adequate enquiries into the legitimacy of things or what he was being told. I do acknowledge that Mr H relied on what he and his family was told and the general experience of other people he knew. But all things considered, I think there were sufficient red flags here that ought to have led Mr H to have acted more cautiously than he did. So, I think Halifax can fairly rely on one of the exceptions to reimbursement – that Mr H made the payments without a reasonable basis for believing that the payments were for genuine goods or services and/or the person or business with whom he transacted with was legitimate. Effective Warnings I’ve considered whether Halifax has met the standards required of it as per the CRM Code. In short, the CRM Code said that where the firm identifies an APP scam risk it should take reasonable steps to provide their customer with ‘Effective Warnings’. It goes on to say that as a minimum, an Effective Warning should be understandable, clear, impactful, timely and specific. Halifax only need to provide an Effective Warning when it identifies APP scam risks during a payment journey. Halifax has suggested it showed Mr H that there was a confirmation of payee match when he first setup the payee, but otherwise no other warnings were provided.

-- 4 of 8 --

Halifax has already accepted that it should have provided Mr H with an Effective Warning at the time of payments four and five and has refunded 50% of those payments for that reason. But having considered Mr H’s usual account activity, I would have expected Halifax to have had concerns about payment three as well. I say this because by payment three, Mr H was sending £5,000 across three transactions to a new payee within 11 minutes – with a total of £4,900 being sent to the same new payee within less than a minute of each payment. Halifax has said that on 5 May 2023 Mr H sent £5,010 to three different payees within 45 minutes, one of whom was a long-established payee. While that is similar activity to what happened here, I wouldn’t say it was usual for Mr H’s account generally. His account was being used for everyday relatively low value spending with the occasional larger transfer to individuals. Here though, Mr H setup the new payee, paid a small amount to start with, then made rapid increased payments to the new payee – a common sign of an APP scam. I’m satisfied this activity, along with the value of payment three should have looked suspicious enough for Halifax to provide an Effective Warning as defined by the CRM Code. With that in mind, Halifax hasn’t been able to evidence that Mr H was provided with an Effective Warning on payment three, which I think it was required to give him – so it hasn’t met the standards expected of it as per the CRM Code. But as explained above, I am not persuaded Mr H had a reasonable basis for belief that the opportunity was genuine, so Halifax should reimburse Mr H 50% of payment three under the provisions of the CRM Code. As mentioned above, Halifax has already refunded 50% of payments four and five and for the same reasons, Halifax does not need to reimburse the other 50%. And because I don’t think Halifax was required to provide an Effective Warning for the first two payments, it does not need to refund payments one and two to Mr H. Should Halifax have done anything else to prevent the loss? In accordance with the law, regulations and good industry practice, Halifax should have been on the look-out for, and protect its customers against the risk of fraud and scams. If the bank does identify a fraud risk, it should intervene before releasing the payment. Halifax has said it wasn’t concerned about payments one to five at the time. Having reviewed Mr H’s statements, for the same reasons given above I do think payment three was sufficiently unusual and should have triggered Halifax’s fraud detection systems - prompting it to intervene before releasing the transaction. I think a proportionate intervention would have been for Halifax to speak to Mr H and ask him questions to narrow down the scam risk and provide appropriate warnings based on his answers. I have no reason to believe Mr H wouldn’t have been honest with Halifax and I think if Halifax had asked him why he was paying K, how he found out about K and the services he was supposedly providing I think Halifax would have been able to break the spell of K and prevent the payment and the scam from progressing further. As such, I think 8% simple interest per year should be worked out from the date of the payment until the date its repaid. Although Halifax has already refunded Mr H 50% of payments four and five and included 8% simple interest per year worked out from the date his claim was declined, I think it should re- calculate the interest on those two payments from the date of the payments up to the date it refunded Mr H, and pay him the difference. Recovery of funds

-- 5 of 8 --

I’ve considered whether Halifax did what it could to recover the funds Mr H lost after he reported the matter to it. Halifax has said it did attempt to recover the funds from the recipient account within the expected timescales when Mr H first reported the scam. The bank that received his funds confirmed that no funds remained. I haven’t seen any evidence that confirms when Halifax got in touch with the other bank or whether it did get in touch as quickly as I would expect. But considering the payments were made in October 2023 and the first time they were reported to Halifax was April 2024, I don’t think it’s likely that any of Mr H’s funds would have remained in the account by the time Mr H reported it to Halifax. As such, I don’t think Halifax missed an opportunity to recover Mr H’s funds. Cash payment I am not holding Halifax liable for the £3,000 in cash that Mr H handed to K in person. I say this because first of all, cash isn’t covered by the CRM Code, so there was no obligation on Halifax to consider reimbursing Mr H for the cash he lost. But more importantly, no evidence has been provided to me to show where the £3,000 cash was withdrawn from. Mr H has confirmed that some of it was provided by family member. And I haven’t seen any evidence to suggest that Mr H withdrew the cash from his Halifax account, so I can’t conclude that Halifax has done anything wrong, or is in any way liable, for the cash Mr H gave to K. Compensation When Halifax reviewed Mr H’s complaint, it changed its position and upheld his complaint. It also paid Mr H £50 compensation. Halifax said this was to apologise that it hadn’t upheld his claim when he first raised it and the stress and inconvenience caused. I appreciate the whole matter has been stressful and upsetting for Mr H and his family – but this has mostly been caused by the actions of the scammer. I also appreciate it took Halifax a couple of months to give him an answer and change its position after he brought the matter back to it in December 2024. But having considered everything very carefully, I think the apology and £50 compensation already paid by Halifax is fair and reasonable in the circumstances. Remaining loss Though I have reached broadly the same outcome as our Investigator in relation to what Mr H should be reimbursed, our Investigator only recommended Halifax reimburse Mr H £325. But this was based on what our Investigator believed was Mr H’s remaining personal loss. Since our Investigator’s assessment, Mr H has confirmed that while a proportion of the total amount sent was his own personal funds, the rest was provided by other family members including his wife, his nephew and other family. He’s also confirmed that he now owes those family members the money lost. As such, I’m persuaded that the total loss is Mr H’s. Considering he has already been reimbursed 50% of payments four and five, I think he should now be reimbursed 50% of payment three without any adjustments. Summary Overall, I am satisfied, based on the evidence available, that Halifax can fairly rely on one of the exceptions to reimbursement under the CRM Code, but it should also share some responsibility for payment three, so Halifax should reimburse Mr H under the provisions of the CRM Code.

-- 6 of 8 --

In my judgment, this is a fair and reasonable outcome in the circumstances of this complaint. Putting things right I’m provisionally minded to uphold this complaint and require Bank of Scotland plc trading as Halifax to pay Mr H: • £1,500 (50% of payment three); and • 8% simple a year interest on that amount worked out from the date of the payment (1 October 2023) to the date of settlement; and • Work out 8% simple a year interest on payments four and five, from the date of the payments (1 October 2023) to the date those payments were repaid to Mr H and then pay him the difference between that figure and what he’s already received.” I said I’d consider anything further Mr H and Halifax submitted following the provisional decision. Responses to my provisional decision Mr H responded to my provisional decision and didn’t agree with the outcome. Halifax did not respond by the date given. Mr H didn’t agree with my recommendations but has suggested a fairer outcome would be to reimburse 50% of payments two and three. In summary, Mr H has said that the transactions were out of character, there were signs of a scam and Halifax didn’t give him any warnings or question the payments at the time or afterwards. Mr H has also kindly explained that his current financial position makes it difficult for him to pay back his relatives. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I have considered the additional points raised by Mr H, but they don’t change my decision. I appreciate the time Mr H has taken to respond with the points he’s made. But none of the information Mr H has provided to me is new to me. I carefully considered Mr G’s circumstances and actions at the time of the payments, as well as considering how the payments would have looked to Halifax at the time. I reviewed Mr H’s statements and took into account the way he generally used his account. In the six months prior to the scam the account was generally used for relatively low everyday spending, but there were also transfers of £1,050, £1,990 and £2,000 to other people. And as mentioned in my provisional decision, there were other transactions amounting to over £5,000 in one day in May 2023. With that in mind, for the same reasons explained in my provisional decision, I remain of the opinion that I don’t think the first two payments to K would have looked so unusual or out of character to Halifax that it was required to provide an Effective Warning or otherwise intervene on those two payments. I also appreciate that Mr H has said that if Halifax had contacted him shortly after the payments were made, it may have been able to recover his funds. I understand his point, but Halifax would have no reason to contact him after the payments were made. When considering a firm’s responsibilities and duties to prevent harm from fraud and scams, either under the CRM Code or otherwise, it’s the firms’ actions at the time of the payment that is

-- 7 of 8 --

the relevant consideration, not after the payment is completed. As explained in my provisional decision, there is an expectation on firms to attempt to recover funds from the recipient account, but this is only after a scam has been reported to it. Though Halifax doesn’t appear to have attempted to recover Mr H’s funds, as explained in my provisional decision, the scam wasn’t reported until around six months after the payments, so I don’t think it’s likely any of Mr H’s funds would have remained and so I don’t think Halifax missed an opportunity to recover Mr H’s funds there. I’m sorry for the situation Mr H has found himself in, and I recognise he has lost a lot of money and has been left in a very difficult and upsetting situation through no fault of his own. But for the same reasons I explained in my provisional decision, I still think the conclusion I set out in my provisional decision is fair and reasonable. Putting things right I uphold this complaint. Bank of Scotland plc trading as Halifax should pay Mr H: • £1,500 (50% of payment three); and • 8% simple a year interest on that amount worked out from the date of the payment (1 October 2023) to the date of settlement; and • work out 8% simple a year interest on payments four and five, from the date of the payments (1 October 2023) to the date those payments were repaid to Mr H and then pay him the difference between that figure and what he’s already received. My final decision For the reasons set out above, I uphold this complaint. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr H to accept or reject my decision before 27 April 2026. Mike Southgate Ombudsman

-- 8 of 8 --