HSBC UK Bank Plc · DRN-5771668

The complaint Mr W complains HSBC UK Bank Plc won’t reimburse the money he lost to an investment opportunity that he now considers to be an authorised push payment (‘APP’) scam. What happened The background to this complaint is well known to both parties, so I’ll only refer to some key events here. Around January 2021, Mr W was introduced to an investment opportunity with a company I’ll refer to as ‘V’. The introduction came from a family member who’d invested with V for some time and had some success. Mr W understood V’s director, Mr S, ran an investment syndicate where investors funds would be pooled and then traded via either contracts for difference or spread betting on foreign exchange and other markets. Investors would then receive a share of the profits, based on the number of units they owned. Mr W said he was promised that only 50% of his invested funds would be traded, with the other 50% ringfenced from trades, to prevent a total loss. Mr W expected to make a 4% return on his invested funds. Having carried out his own due diligence, which primarily involved checking V’s record on Companies House, Mr W was satisfied V was genuine and decided to invest. Between January 2021 and April 2022, Mr W transferred £13,997.29 to Mr S’s account over a series of sixteen faster payments. Mr W received two credits from Mr S totalling £5,842, but he started having concerns about the investment around June 2022 when his family member was unable to withdraw from the investment. Mr W contacted Mr S who said the trading accounts had been suspended and the funds in the accounts had been frozen. Mr S said he was encountering problems with the online broker he used (which I’ll refer to as ‘P’) and the underlying overseas bank. Having tried unsuccessfully to recover his lost funds through other avenues, Mr W contacted HSBC for help in recovering the £8,155.29 lost to the scam. HSBC said because Mr W had been able to withdraw a substantial amount from his investment, it could not consider it a scam. It therefore refused to reimburse Mr W’s losses stating that it had deemed it to be a civil dispute which isn’t covered under the Contingent Reimbursement Model (CRM) Code. Unhappy with HSBC’s response, Mr W referred his complaint to the Financial Ombudsman Service. Our Investigator upheld the complaint. She was persuaded, on balance, V was operating a scam and as HSBC could not establish that an exception to the Code existed, HSBC was required to reimburse him in full. She therefore recommended that it refund Mr W’s loss plus 8% simple interest. Mr W accepted our Investigator’s opinion. HSBC disagreed. It considered it was premature to conclude V was operating a scam as investigations were ongoing. But it said it would reconsider Mr W’s claim if the law enforcement enquiries concluded that there was an intent to scam at the point Mr W made his payments.

-- 1 of 6 --

The complaint has been passed to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, I’m upholding this complaint for largely the same reasons as our Investigator. I’m persuaded the evidence supports that there was a significant difference between what Mr W thought about the investment and what V had in mind regarding the purpose of the payments. I’m also satisfied that the purpose was substantially different as a result of dishonest deception on V’s part. I’ll explain why. When considering what is fair and reasonable, I’m required to take into account: relevant law and regulations; regulatory rules, guidance and standards; codes of practice; and, where appropriate, what I consider to have been good industry practice at the relevant time. In broad terms, the starting position in law is that a firm is expected to process payments and withdrawals that a customer authorises, in accordance with the Payment Services Regulations 2017 (PSRs) and the terms and conditions of the customer’s account. However, where the customer made the payment because of the actions of a fraudster, it may sometimes be fair and reasonable for the provider to reimburse the customer even though they authorised the payment. The CRM Code HSBC was a signatory to the voluntary CRM Code, which provided additional protection to scam victims, while it was in place. Under the CRM Code, the starting principle is that a firm should reimburse a customer who is the victim of an APP scam (except in limited circumstances). But the CRM Code only applies if the definition of an APP scam, as set out in DS1(2) (a) of the Code, is met: “Authorised Push Payment scam, that is, a transfer of funds…where (i) The Customer intended to transfer funds to another person, but was instead deceived into transferring the funds to a different person; or (ii) The customer transferred funds to another person for what they believed were legitimate purposes but which were in fact fraudulent.” The CRM Code is explicit that it doesn’t apply to “private civil disputes, such as where a Customer has paid a legitimate supplier for goods, services, or digital content but has not received them […] or the Customer is otherwise dissatisfied.” If I conclude that the payment here meets the required definition of a scam then Mr W would be entitled to a reimbursement, unless HSBC can show that any of the exceptions as set out in R2(1) of the Code apply. Can HSBC delay making a decision under the CRM Code? HSBC has suggested it is premature to reach a conclusion on this case, because of pending law enforcement investigations. In doing so it may now be seeking to rely on R3(1)(c) under the Code. The CRM Code says firms should decide whether to reimburse a customer without undue delay. But if a case is subject to investigation by a statutory body and the outcome of that

-- 2 of 6 --

investigation might reasonably inform the firm’s decision, the CRM Code allows a firm, at section R3(1)(c), to wait for the outcome of that investigation before making a reimbursement decision. But I can see HSBC has already reached a reimbursement decision, which it communicated to Mr W in its final response dated 26 June 2024, informing him he was not entitled to reimbursement as it deemed his loss stemmed from a civil dispute. As HSBC has made a decision under the code, R3(1)(c) has no further application. The LSB confirmed in its DCO letter 71 to firms dated 6 November 2024 that “a firm should not seek to apply this provision where it believes that the case is a civil dispute and therefore outside of the scope of the CRM Code”. The Financial Ombudsman does not have the power to restart R3(1)(c) – so where a firm has made a reimbursement decision a consumer is entitled, under the DISP rules, to refer the matter to our service. Is it appropriate to determine Mr W’s complaint now? I understand that a police investigation into V is still ongoing, but we do not know the progress of that investigation or when a conclusion is expected. So, I have considered whether it would be appropriate to delay my decision because of the ongoing investigation – in the interests of fairness. There may be circumstances and cases where it may be appropriate to wait for the outcome of external investigations and/or related court cases. But that isn’t necessarily so in every case, as it may be possible to reach conclusions on the main issues based on evidence already available. And it may be that investigations or proceedings aren’t looking at quite the same issues or doing so in the most helpful way. To determine Mr W’s complaint, I must ask myself whether, on the balance of probabilities, the available evidence indicates that it’s more likely than not that Mr W was the victim of a scam rather than a failed investment. But I wouldn’t proceed to that determination if I consider fairness to the parties demands that I delay doing so. I’m aware that Mr W first raised his claim with HSBC in June 2024, and I need to bear in mind that this service is required to determine complaints quickly and with minimum formality. With that in mind, I don’t think delaying giving Mr W an answer for an unspecified length of time would be appropriate unless truly justified. So, unless a postponement is likely to help significantly when it comes to deciding the issues, bearing in mind the evidence already available to me, I’d not be inclined to think it fair to put off the resolution of the complaint. I’m also aware there is a possibility that the ongoing investigations could result in some recoveries for V’s investors. To avoid the risk of double recovery, I think HSBC would be entitled to take, if it wishes, an assignment of the rights to all future distributions to Mr W under those processes in respect of his investment resulting from the payments made from this account before paying anything I might award to him on this complaint. For the reasons I discuss further below, I don’t think it’s necessary to wait until the outcome of the ongoing law enforcement investigations for me to fairly reach a decision on whether HSBC should reimburse Mr W under the provisions of the CRM Code. Has Mr W been the victim of an APP scam, as defined in the CRM Code? To reach a conclusion on whether Mr W was more likely than not victim of a scam, as

-- 3 of 6 --

defined by the CRM Code (DS1(2) (a)), I need to consider the purpose of his payments, and whether he thought this purpose was legitimate. I then need to consider whether this was broadly in line with V/Mr S’s purpose. If I decide there was a significant difference in these purposes, I must then consider whether this was due to dishonest deception on the part of V/Mr S. Based on the evidence presented, I’m satisfied Mr W made payments to Mr S as part of an investment. He believed his funds would be pooled with other investors and traded on various markets, and that he would then receive a percentage of the profits. I haven’t seen anything to suggest Mr W didn’t think the investment with V, and run by Mr S, was legitimate, particularly as he was aware of family members who he believed had successfully invested. It’s evident that V had some features that gave it the impression that it was operating legitimately. V was incorporated in 2017 and registered on Companies House, with Mr S listed as the company director. Investors, including Mr W, were provided with professional looking documentation, including terms and conditions. Mr S was also in regular contact with investors via a weekly email, where he would comment on trading performance. However, I’m satisfied the weight of evidence supports a conclusion that V and Mr S was, most likely, operating a scam: • The receiving bank account (‘Account 1’) statements for Mr S (which we have received in confidence but the evidence from which can be summarised here) demonstrates a pattern of credits received into the account from multiple payees each month. This is followed by a series of smaller payments out to a similar list of payees. There are also a large number of payments to another account in Mr S’ name (‘Account 2’). • While there is some evidence of payments being made from Account 1 to P, the payments don’t correspond, either in time or value, to the payments received into the account from Mr W and other investors. For example, there are no payments to P between March 2021 and January 2022. And yet, during this time Mr W made 10 payments to Mr S, totaling over £4,000 (there were also a significant number of credits from other investors). • While it’s unclear how funds were used when they were transferred to P, I have seen no evidence that any credits were received back from P. So, while Mr W received several credits back from Mr S, it doesn’t appear these were funded from genuine returns on his investment/ profits from trading as he understood. Rather, it looks as though these credits were funded by the payments in from other individuals. • It appears Mr S was effectively operating a Ponzi scheme, paying returns to persuade victims V was in fact operating legitimately so they would keep paying into the supposed investment syndicate. • Statements for Account 2 show a high volume of day-to-day lifestyle spending; occasional large purchases (including the purchase of a car); large payments to other unknown individuals and transfers to savings accounts. While there are a few payments to P, this is again a small percentage of the sums invested, and there is no evidence of credits received back due to trading activity. • There is no evidence that 50% (or any other portion) of investor funds were moved to a separate, non-trading account, as investors were led to believe. Considering the account activity as a whole, as well as what I can see regarding Mr W’s

-- 4 of 6 --

payments into Mr S’ accounts, I consider it supports the allegation V (via Mr S) was operating a Ponzi scheme and investors funds were not used for trading as they had been told. Taking into account all of the above, I’m satisfied, on the balance of probabilities, that the money that was sent to Mr S was not used for its intended purpose. The evidence suggests that Mr W wasn’t involved in a failed investment but a scam. Is Mr W entitled to a refund under the CRM code? Under the CRM Code, the starting principle is that a firm should reimburse a customer who has been the victim of an APP scam, like Mr W. But a firm may choose not to reimburse a customer if it can establish that one or more of the exceptions to reimbursement apply (R2(1)). As HSBC declined Mr W’s claim as being a civil dispute, it is unclear if it considers any of the other exceptions to reimbursement apply. I have nevertheless considered whether I think HSBC could fairly rely on any of the exceptions in this case. HSBC has confirmed that none of Mr W’s payments triggered HSBC’s fraud detection systems, so it had no contact with him about any of the payments. So, it could not refuse Mr W’s claim on the basis that he ignored an effective warning. So, the only relevant exception in the circumstances is whether Mr W made the payments “without a reasonable basis for believing that: i. the payee was the person the customer was expecting to pay; ii. the payment was for genuine goods or services; and/or iii. the person or business with whom they transacted was legitimate.” Did Mr W have a reasonable basis for belief? Thinking next about Mr W’s reasonable basis for belief, the investment material I’ve reviewed appears professional and the overall premise of the investment did not seem unreasonable. As noted above, V was registered on Companies House and had been for a number of years. There was also nothing in the public domain at the time about V from which Mr W could have reasonably inferred that a scam was taking place. I’ve also considered that Mr W was introduced to the investment by a family member, who had themselves invested and received returns, which I think would have been compelling. He was also aware of a larger network of investors who had also invested successfully, and was receiving regular updates from Mr S summarising how trades were performing. I have thought about the fact that Mr W was directed to pay an account in Mr S’ name, rather than to pay V directly as per the terms and conditions. But given Mr S was the company director, and conducting the trading himself, I don’t it was unreasonable for Mr W to accept that payments needed to be made in this way. Overall, I’m satisfied Mr W had a reasonable basis to believe the payment was for a genuine investment and that V was operating legitimately. With this in mind, I don’t think HSBC could reasonably establish that any of the exceptions to reimbursement under the CRM Code apply here. It follows that it should refund the money Mr W lost in full.

-- 5 of 6 --

Putting things right I’ve thought carefully about whether interest should be added to the refund Mr W is due from HSBC, and if so from what date. Outside the provisions of the CRM Code, I consider it unlikely that any intervention by HSBC at the time of the payments would have positively impacted Mr W’s decision-making. I don’t think either party would have likely uncovered sufficient cause for concern about V such that Mr W would have chosen not to proceed at that time. As such, I don’t think HSBC could reasonably have prevented Mr W’s loss. So, I don’t think it would be fair to require it to compensate him for the loss of use of his funds from the date of his payments. But I consider HSBC ought to have reimbursed his loss on receipt of his CRM claim. So, to put things right, HSBC UK Bank Plc must now refund Mr W the disputed payments he sent Mr S as part of the scam, minus the credits he received back from him. It should also pay 8% simple interest per year on this amount, running from the date it declined his claim to the date of settlement. If HSBC UK Bank Plc considers that it’s required by HM Revenue & Customs to deduct income tax from that interest, it should tell Mr W how much it’s taken off. It should also give Mr W a tax deduction certificate if he asks for one, so he can reclaim the tax from HM Revenue & Customs if appropriate. In order to avoid the risk of double recovery, HSBC UK Bank Plc is entitled to take, if it wishes, an assignment of the rights to all future distributions in relation to scam payments we’re upholding that arise from the police investigation and any criminal proceedings that may follow before paying the award. My final decision For the reasons given above, my final decision is that I uphold this complaint and to direct HSBC UK Bank Plc to: • refund to Mr W the disputed payments, minus the returns he received from Mr S, which I calculate to be £8,155.29 made as a result of the scam; and • pay simple interest at 8% per year on the amount refunded (less any tax lawfully deducted), calculated from 26 June 2024, when it declined his claim. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr W to accept or reject my decision before 13 November 2025. Lisa De Noronha Ombudsman

-- 6 of 6 --