HSBC UK Bank Plc · DRN-5307500

The complaint C complains that HSBC UK Bank Plc (‘HSBC’) declined to reimburse him for cheque payments paid out of his account that he says he did not make or otherwise authorise. What happened The circumstances of this complaint are well known to both parties, so I will not go into every detail of what happened here. But, in summary, C was in a relationship with someone I will call ‘S’. S helped C manage his finances. C has difficulties in reading and writing so this arrangement grew over time, with S managing both his personal and business finances. This included managing paperwork, invoices, managing his accounts, arranging payments and liaising with HSBC. This was facilitated by a series of third-party mandates with HSBC. C grew concerned that he had not seen his account statements in some time, as he now knows S was intercepting them or receiving them electronically through online banking S had set up, despite previously telling C that it was unsafe to do so. C also was uncomfortable that he had not seen his accountant as frequently, and some cheques were declined. So C spoke to his accountant, who said they had no concerns about S at the time but did ask S to hand over some additional documentation relating to C’s business. S left C shortly thereafter, which made C suspect she had been stealing from him. C utilised the help of a representative and his accountant to establish that S had been falsifying business invoices between 2018 and 2023, and arranging for cheques to be paid into her own account instead. If the cheques or invoices had been genuine the cheques should have been paid to the businesses that C dealt with, but they were paid to S. C says that he did not sign any of these cheques, despite them being signed in his name rather than S’s. There are over 30 cheques in dispute, which total over £120,000 and took place over five years from June 2018 to June 2023. C complained to HSBC in May 2024 who declined to uphold his complaint, or reimburse the disputed cheques. It maintained that this was a civil matter, as S had authority to transact on C’s account. It said even if it were to consider the matter, it could only consider cheques reported as fraudulent within 13 months of the date they debited his account. But it said it would not refund the three cheques that had been reported in this time frame. C was unhappy with HSBC’s response, so escalated his concerns to our service where one of our investigators looked into what had happened. They recommended that C’s complaint should be upheld, and the disputed cheques be refunded in full along with 8% simple interest from the date of the loss. They did so because they thought it was more likely than not that S had forged C’s signature on the cheques and so concluded that the cheques were not properly authorised. They said that the third-party mandates were irrelevant because the cheques were most likely fraudulently signed in C’s name. They said that applying a strict 13-month time bar would not be fair and reasonable in this case, as S’s deception meant that C could not have reasonably known about the fraud within this timeframe. They also recognised that HSBC’s service issues had caused C significant distress and inconvenience and recommended that they pay £500 in recognition of this.

-- 1 of 4 --

HSBC maintained its stance and believed that there was not enough evidence that the cheques had been forged, and queried why the cheques had only come to C’s attention now when it would have expected C was recording his annual accounts. It felt that had this been done, the matter would have come to all parties’ attention sooner, and the claimed loss would therefore have been reduced. As no agreement could be reached, the case has been passed to me to decide. I wrote to both parties with my initial thoughts on the matter, as they differed from what the investigator said in part. It was my opinion at the time that it was more likely than not that S had fraudulently signed the cheques in C’s name, and so they should be considered as unauthorised. However, I also said that the relevant regulations said that C would only be entitled to redress for unauthorised transactions where he notified HSBC of them without undue delay and no later than 13 months from the debit date. So, I asked both parties to provide any further comments or evidence, but said that if nothing changed, I would be asking HSBC to reimburse only the cheques which were disputed within 13 months. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I would firstly like to say how sorry I was to read of what C has been put through by S. This appears to have been a cruel and callous fraud undertaken by someone trusted by C. I understand that the police are investigating and hope these matters are progressing well. My role here is not to determine the liability of S – criminal or otherwise. My role is to decide on the dispute between HSBC and C. I have to think about what it did and didn’t do, and if it acted fairly and reasonably whilst having regard to the rules, regulations and good industry practice it ought to have adhered to at the time. Was it fair and reasonable for HSBC to consider the cheques authorised? The starting position in line with the relevant legislation – The Payment Services Regulations 2017 – is that HSBC would be liable for any unauthorised payments, and C is liable for any authorised payments. A common situation in which a payment would be considered authorised is where a customer has made a payment themselves. But there are other circumstances in which a payment can fairly be considered authorised – such as where a customer has given permission for someone else to make a payment on their behalf, or where a customer has told their payment service provider that they want a payment to go ahead. HSBC have argued that S was acting under the third-party mandate that C had agreed to, so any abuse of this was a civil matter and not one for it to consider. However, I do not think this is such a straightforward matter. The cheques in dispute were supposedly signed by C. And so if the cheques which were supposed to be signed by C had actually been forged by S or any other party, these would not be considered valid or authorised. I will never be able to say with absolute certainty how these cheques came to be signed, and certainly claim no expertise in handwriting analysis. HSBC have a number of variations of C’s signature on his account. I imagine it is not uncommon for signatures to change over time, and there is evidence of variations in his signature on documents I have had sight of

-- 2 of 4 --

which I know he signed. So, I must consider the available evidence and make a finding on the balance of probabilities as to whether the cheques were fraudulently signed – and therefore whether the corresponding payments which left C’s account could be considered authorised. C has told us that he did not sign these cheques, and so I have taken his testimony into account here. It is clear that S conducted a sophisticated fraud, in that she even created false invoices in order to satisfy C’s accountant that payments leaving his account were legitimate. I agree with our investigator that it would seem an unnecessary risk for her to present C with blank cheques or cheques written out to her, when she had unrestricted access to his cheque book due to the nature of the work she undertook on his behalf. This may have caused questions to be asked sooner – and it is clear that this is something she was trying to avoid by creating the false invoices to provide to the accountant. So, I think on balance it is more likely than not that S would simply have falsified the cheques in their entirety here. So, I think that it is more likely than not that C did not sign the cheques, and therefore did not authorise the payments. Was it fair and reasonable for HSBC to decline to review some payments as they were not reported without undue delay? The regulations relevant to this case – the Payment Services Regulations 2017 – say that C would be entitled to reimbursement for unauthorised transactions “only if [he] notified the payment service provider without undue delay, and in any event no later than 13 months after the debit date, on becoming aware of any unauthorised [transactions]”. I do appreciate and empathise with the position C was put in, and understand that he was unaware of the disputed payments until long after they had begun. However, the regulations are quite clear that HSBC’s liability is dependent on the transactions being reported no later than 13 months after the debit date – and most of the cheques were debited prior to this. Only the final three cheques were reported within this time frame. There is an understanding that customers are expected to keep their accounts safe and be aware of what is taking place on them. It appears that C must have not done so for over around five years. I do appreciate this was because he had someone he trusted who appeared to be doing so on his behalf, but this does not negate his overall responsibility when it comes to HSBC’s liability here. And when C became suspicious, he was able to utilise other people to bring the circumstances to light, so I see no reason why checks and balances beyond annual accounts could not have been put in place sooner. So, all things considered, I think that it was reasonable for HSBC to rely on this exception to reimbursement and so will only ask it to reimburse the fraudulent cheques which were debited from his account within 13 months of when he reported matters to HSBC. Should HSBC make a payment to C in recognition of the distress and inconvenience it caused him? I will not repeat the myriad of service issues C has detailed to our service, which our investigator repeated many of in his view of this complaint. But, I will say that there were clearly service issues including delays, failure to log the dispute properly, requiring C to repeatedly get in touch to provide the same information, and delays with providing the details of the investigation and outcome. Given the background of what C was already going through, it is clear to me that the impact on him was far greater than it may be for another customer. In a short space of time his partner left him, he discovered a large and prolonged fraud had been committed against him,

-- 3 of 4 --

and his business and finances suffered immensely as a result. This understandably had a significant detrimental impact on his mental health. Whilst HSBC are not responsible for what S did, their actions (or lack thereof) caused a significant further impact on him because of the vulnerable state he was already in. C described to our service that he felt that he did not have HSBC’s support and had to struggle to get in touch with it, which significantly compounded the distress he was already in. He also said the uncertainty meant that he was unable to commit to future personal or business plans. He also highlighted the inconvenience of having to spend so much more time then he should have had to trying to communicate with HSBC. So, all things considered, I think our investigator’s recommendation of £500 in recognition of the distress and inconvenience it caused him is fair and reasonable in the circumstances of this complaint. Putting things right In order to put things right, I require HSBC to: • Reimburse the disputed cheques which were reported to it within 13 months of the debit date; • Pay 8% simple interest on these cheques from the date they were debited to the date of settlement; and • Pay C £500 in recognition of the distress and inconvenience it caused. My final decision I uphold this complaint and require HSBC UK Bank Plc to reimburse C in line with what I have outlined above. Under the rules of the Financial Ombudsman Service, I’m required to ask C to accept or reject my decision before 9 April 2026. Katherine Jones Ombudsman

-- 4 of 4 --