PayrNet Limited · DRN-5883253

The complaint H complains that PayrNet Limited won’t reimburse it the money it lost to a scam. This complaint concerns an Absolutely No Nonsense Admin (“ANNA”) account. ANNA are a distributor of PayrNet Limited. For ease of reading I’ll refer to H’s interactions with ANNA throughout this decision. What happened In October 2024, H fell victim to an impersonation scam. Miss T, the director of H, was the one who dealt with the fraudster so I will refer to her throughout this decision for ease of reading. Miss T received a call from someone purporting to be from ANNA – sadly the caller was a fraudster. The fraudster told Miss T that someone had attempted to make a payment from her account and had set up a direct debit for a gym membership. Miss T was immediately concerned as just over a week earlier she’d received a call from someone purporting to be from a different financial institution that she banked with, who’d told her they’d managed to prevent loss from attempted fraud by refunding an unauthorised transaction and that she’d been the victim of identity fraud. Subsequently Miss T discovered the previous call had also been from a fraudster. Miss T recalls the fraudster purporting to be from ANNA knew her full name and her previous business address. Her previous business address was linked to the financial institution who she believed had called her the previous week. As a result Miss T connected both telephone calls, believing she’d been the victim of identity theft and that ANNA was trying to protect her from losing her money. In total, Miss T spent nearly an hour and a quarter on the phone to the fraudster. They told her she needed to urgently move her money from her ANNA account as it had been compromised, and they told her several times she wasn’t acting quickly enough. During this call the fraudster bombarded Miss T with information about scams and fraud and provided her with advice as to how she could stay safe online. Miss T recalls the fraudster telling her that as her identity had been stolen, a credit card had been applied for without her consent. She believed what the caller told her about the credit card application as she thought she could see information relating to a new credit card on her banking application. After the event Miss T realised that what she saw in relation to a new card was a little different and wasn’t associated with the fraud, but she was preoccupied at the time and didn’t notice the discrepancy. The caller told Miss T to carry out a number of tasks in order to ultimately move money. This included sharing one time passcodes which unfortunately gave the fraudster access to her account and asking her to log in and out of her account multiple times; ultimately culminating in two card payments being attempted (which were declined), and Miss T authorising three faster payments to the fraudster. At the time of the scam, Miss T was six months pregnant and feeling anxious and stressed as a result of her pregnancy and complications in her home life. At the time of the call she

-- 1 of 11 --

was meant to be chairing a meeting at her place of work and was mindful this call and the circumstances in which she found herself meant she would be late doing so. The fraudster offered to provide her with a transcript of this call to provide Miss T with evidence as to what had occupied her during this time to prove her whereabouts. Miss T recalls feeling this was a kind gesture and one she’d associate with a professional organisation. Miss T was shown a number of fraud interventions from ANNA during the course of the scam. Some prior to the faster payments - relating to the risk of sharing one-time passcodes and a new device accessing her account - and some during the faster payment journeys, specifically warning her about authorised push payment scams and a no match confirmation of payee message. She recalls the fraudster telling her she’d receive interventions; that this was standard procedure and she could disregard them given she was talking to ANNA. She was told it was critical she acted quickly to ensure her money was protected and, over the course of nine minutes, Miss T made three separate payments to two new accounts totalling £13,589. Two hours later Miss T realised she’d fallen victim to a scam and reported the matter to ANNA. ANNA was able to recover £3,998.16 but declined reimbursement of the remaining £9,590.84. While ANNA had considered Miss T’s claim under the relevant reimbursement rules, it didn’t find the claim reimbursable because it had provided fraud interventions which Miss T hadn’t engaged with properly. Unhappy with ANNA’s response Miss T referred her complaint to our service. An investigator looked into the complaint and upheld it. He was satisfied the payments were covered by the FPS Reimbursement Rules (the Reimbursement Rules). Under the Reimbursement Rules a PSP must reimburse victims of APP scams unless it can demonstrate an exception to reimbursement applies. ANNA argues that it can rely on the Consumer Standard of Caution Exception (the Exception) because Miss T and in turn H, failed to have regard to its interventions with gross negligence. The investigator did not find that Miss T’s actions amounted to gross negligence. He explained it was difficult to substantiate the exact interventions Miss T had been shown despite asking ANNA for clarification, but overall, he found the scam Miss T fell victim to was sophisticated and her actions in response to the interventions were understandable in the circumstances. He recommended that ANNA reimburse the payments Miss T made, minus the amount recovered and the excess allowance under the Reimbursement Rules. Miss T accepted the investigator’s opinion but ANNA didn’t. In summary ANNA argued that: • The investigator’s reasoning to support Miss T’s belief in the legitimacy of the call was flawed. For example, it had never spoken to Miss T before and therefore Miss T couldn’t have found the call to be familiar. • The fraud questionnaire was newly introduced and therefore the fraudster couldn’t have been familiar with it, neither could Miss T, and their interventions were better than boilerplate warnings. • Miss T did see warnings specific to the scam she fell victim to when she completed the fraud questionnaire. Our investigator maintained his opinion and felt ANNA had failed to provide sufficient evidence the fraud intervention it said Miss T saw – specific to impersonation scams – was actually seen by her. ANNA continued to disagree. In summary it said:

-- 2 of 11 --

• It wanted an ombudsman to issue a provisional decision • It did not think the bar for gross negligence should be so high that it cannot be attained • In addition to gross negligence, it didn’t think it should reimburse Miss T because the Reimbursement Rules set out that a PSP shouldn’t reimburse where a consumer seeking reimbursement has acted fraudulently. Miss T had provided it with false information about the payment purpose during the payment journey. • When initiated during the payment journey, its fraud questionnaire had prevented 99.8% of customers from becoming fraud victims. It said this indicates that the 0.2% of customers who still fall victim to the scam following the fraud questionnaire fall outside of what a reasonably prudent person would have done • It provided screenshots showing Miss T would’ve received an intervention flow relevant to the scam despite her giving inaccurate reasons for the purpose of the payments. Our investigator continued to disagree: • He referred ANNA back to previous correspondence where it had agreed it didn’t provide Miss T with the intervention flow it was now seeking to rely on. • He was satisfied Miss T’s inaccurate answers were not because she was conspiring with the fraudster and therefore did not agree that ANNA should exclude Miss T’s claim on the basis she’d acted fraudulently. • He didn’t think it could reasonably be argued that Miss T ignored a warning she never saw. ANNA responded with the following: • It accepted Miss T wasn’t conspiring with the fraudster but maintained she circumvented security measures by knowingly providing false information. • Miss T ignored 7 warnings in total which is grossly negligent • It apologised for providing inaccurate information about the interventions Miss T saw and provided correct interventions for review. Because ANNA didn’t agree with the investigator’s view the complaint has been passed to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Firstly, I’d like to address ANNA’s request for a Provisional Decision rather than Final Decision. While I don’t know if ANNA still requires a Provisional Decision given the continued correspondence between ANNA and the investigator following them raising this point, it is for the ombudsman to decide whether or not a Provisional Decision is required. Having considered the circumstances of this case very carefully, I have decided to uphold H’s complaint, for broadly the same reasons as the investigator. I’m also mindful there has been a considerable amount of communication between ANNA and the investigator following his initial view. For these reasons, I am satisfied I can move straight to a Final Decision. In 2022, against a backdrop of increasing APP fraud and the devastating consequences it can have, the Treasury announced its intention to introduce legislation for the Payment Systems Regulator to require payment service providers to reimburse victims of authorised push payment (APP) scams.

-- 3 of 11 --

Section 72 of the Financial Services and Markets Act 2023 required the PSR to introduce a reimbursement requirement for payments made over the Faster Payments Scheme as a result of fraud or dishonesty. During 2024 the PSR required the Faster Payments Scheme operator (PayUK) to change the Faster Payments Rules to require the firms that operate over Faster Payments in certain circumstances to reimburse their customers the losses they incurred through payments made as a result of APP scams. The Reimbursement Rules came into force on 7 October 2024 and apply to all UK-based Payment Service Providers (PSPs). They put a requirement on firms to reimburse APP scam payments made via the Faster Payments Scheme (a similar set of rules covers CHAPS payments), in all but very limited circumstances. My role is to determine the complaint by reference of what is, in my opinion, fair and reasonable in all the circumstances of the case. In doing so, I must take into account relevant law and regulations; regulators rules, guidance and standards; codes of practice and, where appropriate, what I consider to have been good industry practice at the relevant time. In this case I consider the Reimbursement Rules and associated guidance issued by the PSR are relevant to the payments in dispute. Where they are relevant, I must have regard to the rules and guidance, as well as considering what is fair and reasonable in the circumstances of the complaint. The Reimbursement Rules set out reasons a PSP may deny reimbursement: • An exception to reimbursement applies (The Exception) • The consumer is party to the fraud, and is claiming dishonestly or fraudulently • The payments weren’t made in relation to a fraud, rather in circumstances giving rise to a private civil dispute • The purpose of the payment was unlawful. It’s my understanding that ANNA has primarily sought to rely on the Exception to decline H’s claim. But in response to the investigator’s view, Anna said H shouldn’t be reimbursed because Miss T acted fraudulently. In saying this, I’m assuming it was suggesting the payments shouldn’t be reimbursed because ‘the consumer is party to the fraud, and is claiming dishonestly or fraudulently’. It’s unclear as to whether ANNA has retracted this statement as a reason to deny reimbursement. While they subsequently said they’d reflected on this statement, they maintain that Miss T circumvented security measures by knowingly providing false information. I will cover Miss T’s inaccurate answers during the payment journey later on in this decision, but for completeness, I do not agree that ANNA can rely on Miss T providing inaccurate answers to deny reimbursement on the basis she’s acted fraudulently. There is no dispute that Miss T is not party to the fraud. Her claim is not dishonest or fraudulent. There is no doubt she has fallen victim to a scam and I agree with the investigator that Miss T was not conspiring with the fraudster. The Consumer Standard of Caution Exception (CSOC) In order to rely on CSOC, a sending PSP, in this case ANNA, must show that as a result of gross negligence, a consumer has not complied with one or more of the following standards: • The consumer should have regard to any intervention made by their PSP and/or by a competent national authority (which includes, but is not limited to, any police force or service in the UK) • The consumer should, upon learning or suspecting that they have fallen victim to an APP scam, report the scam claim promptly to their PSP.

-- 4 of 11 --

• The consumer should respond to any reasonable and proportionate requests for information made by their PSP for a limited number of purposes (principally to validate the scam claim and whether it is reimbursable) • The consumer should, after making a scam claim, consent to the PSP reporting to the police on the consumer’s behalf on request they directly report the details of a scam to a competent national authority. It’s my understanding ANNA has sought to rely on the first standard set out above – the Intervention Standard. I can’t see that any other standard would apply here. The Intervention Standard The Payment Systems Regulator’s Consumer Standard of Caution Exception Guidance (the Guidance) provides guidance to supplement the Reimbursement Rules. It gives a more detailed and specific description of the Intervention Standard. It says: Consumers should have regard to specific, directed interventions made either by their sending PSP, or by a competent national authority. That intervention must offer a clear assessment of the probability that an intended payment is an APP scam payment. On paragraphs 1.8-1.10 of the guidance this is expanded upon further. It says: PSPs can expect their consumers to have regard to specific, directed interventions raised either by their sending PSP, or by a competent national authority. Those interventions must clearly convey the PSP’s, or competent national authority’s, assessment of the probability that an intended payment is an APP scam payment. Only in circumstances where the PSP can demonstrate that a consumer who has not been classed as vulnerable, has, as a result of gross negligence, not had regard to such interventions, can a reimbursement claim be refused. It will be up to payment firms to consider the approach they might take in creating tailored, specific interventions and to develop their own operational approaches and identify best practice. Any intervention for the purpose of their exception should be bespoke. They must be consumer, scam, and transaction specific. They should not consist of ‘boilerplate’ written warnings. Providers should not refuse reimbursement claims on the basis that a consumer received vague, non-specific warnings, or warnings that routinely accompany most or all transactions of a similar type. Where a PSP does choose to intervene with a written warning, this must be actively brought to the attention of the consumer. PSPs should not rely upon the availability of passive warnings, such as on public websites. The Guidance further explains that a consumer who chooses to proceed with a transaction after an intervention by their PSP should not automatically be deemed to have been grossly negligent. Instead, any assessment of the degree of negligence should include consideration of all relevant factors, including: • The specificity and nature of the intervention made by their sending PSP • The degree of certainty any intervention, whether written or otherwise, conveys that a prospective transaction is an APP scam • The complexity of the scam to which the consumer has become victim, including whether the victim has been subject to any degree of social engineering, or was otherwise in thrall of a scammer • Any claims history from the consumer suggesting a propensity to fall repeatedly for similar types of scams

-- 5 of 11 --

Based on PSR’s guidance, it seems to me that the PSR envisages that the assessment of whether the Intervention Standard is met, is normally a two-stage test: whether the intervention met the criteria set out in the Guidance, and whether the consumer was grossly negligent in moving past it. In this case, Miss T provided some answers to ANNA that weren’t accurate. Following the Guidance closely in this case might result in a finding that ANNA had not provided sufficiently bespoke and specific interventions and therefore that its arguments have to fall at the first stage of the test. However, Miss T’s actions, to an extent, hindered ANNA from giving the kind of intervention envisaged by, and detailed in, the Guidance. The PSR have clarified the application of the Guidance to circumstances such as this. The clarification says: “In assessing whether the interventions were bespoke and specific, consideration should be given to the nature of the information given by the consumer to their PSP including its accuracy, as part of their overall assessment of whether the CSOC exception applies. The fact that the consumer failed to give accurate responses at the time of the payment should not, of itself, automatically mean that the consumer has not acted with caution or that they have been grossly negligent. This will be one of various considerations which will need to be weighed up in determining whether a PSP should reimburse their customer.” Taking the PSR’s clarification into account, instead of applying a two-stage test as to whether the Intervention Standard is met, I’ve considered the overall question of whether Miss T failed with gross negligence to have regard to ANNA’s interventions. In doing so, I have taken into account a number of factors, including the fact that Miss T didn’t give accurate responses during some of those interventions. Gross negligence under the Reimbursement Rules It is entirely for ANNA to demonstrate H was grossly negligent. The Guidance says ‘We interpret gross negligence to be a higher standard than the standard of negligence under common law. The consumer needs to have shown a ‘significant degree of carelessness’. No further guidance is given as to the interpretation of gross negligence. In Red Sea Tankers Ltd v Papachristidis (1997) Lloyd’s Rep. 547, Mance J said of gross negligence that it “is clearly intended to represent something more fundamental than failure to exercise proper skill and/or care constituting negligence. But, as a matter of ordinary language and general impression, the concept of gross negligence seems to me to be capable of embracing not only conduct undertaken with actual appreciation of the risks involved, but also serious disregard of or an indifference to an obvious risk.” The Guidance doesn’t say much more than the PSR’s brief definition of gross negligence, but it does provide some direction on the practical application of the test in relation to the Exception, particularly at paragraph 1.13, which I’ve set out (in part) below. “… any assessment of the degree of negligence should include consideration of all relevant factors, including: “… the complexity of the scam to which the consumer has become victim, including whether the victim has been subject to any degree of social engineering, or was otherwise in thrall of a scammer”. In my view this suggests I should be considering, objectively, whether the scam had complex

-- 6 of 11 --

features (which, given the context, I’ve taken to mean an assessment of whether these were so sophisticated that a reasonable person in the consumer’s position would have found it plausible or compelling, rather than the scam simply being complicated). Whereas a consideration of whether the consumer was subject to any degree of social engineering, or was otherwise in thrall of a scammer seems to me to introduce a more subjective element – whether the consumer was psychologically manipulated into acting in the way the fraudster desired. It seems unlikely that a purely subjective assessment of gross negligence was intended – that would render the test little more than whether the fraudster was able to manipulate the victim into misunderstanding who the beneficiary of the payment was, or its true purpose. That is almost always going to be the case, or the payment would never have been made and the fraud would not have succeeded; so there could almost never be a finding of gross negligence. It would also mean that there would be little point in considering the complexity of the scam, because what would matter would be whether it succeeded in misleading the victim rather than how that was achieved. But it’s hard to conclude that a purely objective test is intended either – that would render a consideration of whether and to what extent the customer was, as a matter of fact, under the thrall of the scammer irrelevant; whereas the Guidance refers to this amongst the relevant considerations. I think the Guidance is therefore asking me to consider the complexity of the scam, while also recognising in that context the role that social engineering can have in a victim’s decision making, particularly in persuading the victim to move past interventions that might, without such manipulation, have been expected to deter them from making the payment. Did H fail to have regard to ANNA’s interventions with gross negligence? I’ve firstly thought about the complexity of the scam overall. This was a scam that evolved over time and became increasingly convincing. This is important context when considering Miss T’s actions in response to ANNA’s interventions, particularly by the time she made the payments in dispute. While there was no number spoofing, the initial hook that convinced Miss T the caller was genuine was that the call came a matter of days following what appears to have been a different scam call, warning Miss T that someone had made an unauthorised transaction on a different account, and that she’d been the victim of identity theft. During that call, Miss T recalls telling the fraudster that her main account was with ANNA. So when the call from someone purporting to be from ANNA arrived, similarly telling Miss T there’d been unauthorised spending on her account and specifically referencing an old business address associated with the account associated with the other call, she connected the two events. It meant the call came as less of a surprise; Miss T was already on notice her identity may be at risk and in turn put greater trust into the caller. She mistakenly, but in my view reasonably given the circumstances, connected the two calls and believed the caller from ANNA was protecting her from identity fraud. The steps Miss T took next , following coaching and manipulation from the fraudster, made the scam all the more convincing. Her belief in the legitimacy of the call led to her sharing OTP Codes with the fraudster, enabling them to gain access to her account and in turn increasing their ability to manipulate her even more given they now had access to information only ANNA would know. I accept the fraudster was only able to gain access to her account due to the actions Miss T took in sharing the OTPs, and so in reaching my decision I’ve thought carefully about the role she played in the success of the scam, particularly as ANNA provided messages warning Miss T about the risk of fraud with the

-- 7 of 11 --

OTP codes. Miss T’s recollections and interpretations of the content and purpose of the messages associated with the OTPs and the new device being added to her account are a little confused and hazy. She completely misinterpreted their purpose despite the messages themselves being quite clear. But I find Miss T’s misinterpretations plausible when considering the backdrop of the scam and the manipulation from the fraudster. Miss T recalls the fraudster telling her what the messages would say ahead of her receiving them, and minimising their significance explaining they were ‘standard procedure’; telling her she didn’t need to take any notice of the messages given she was talking to ANNA. She believed the messages and sharing of the OTPs were part of some kind of verification process – to verify she was talking to ANNA and for ANNA to verify it was talking to her. I’m persuaded Miss T reached these conclusions because this is how the fraudster positioned their content. As a result, I think it’s more likely than not Miss T didn’t engage with the messages in full, instead just looking or listening out for the OTP Code to share. I think Miss T’s actions here were exacerbated by the fear and haste in which she was acting at the time. The fraudster was also able to predict when Miss T would receive the messages and phone call sharing the OTP and new device messages. It’s easy to envisage a situation where the fraudster told Miss T she’d receive a message in a moment and then the message appears, strengthening Miss T’s belief that the caller is from ANNA, as it would appear to Miss T the caller has managed to generate the messages. I’m also mindful that other than relaying the OTPs provided, the rest of the messages did not require interactions from Miss T either, which means the competing voice and direction of the fraudster was less shakeable. I say this accepting that Miss T received one of the OTP codes via automated telephone call and so the fraudster couldn’t have been on the phone with her at the same time. But given the level of coaching and pre-empting from the fraudster, and knowing how these scams work, I can envisage a situation where the fraudster told her to listen out for the OTP code at the end of the message meaning Miss T wasn’t focused on the rest of the message. While Miss T’s actions in response to the OTP and new device messages could be considered careless, I’m not persuaded her actions in the face of these messages was grossly negligent bearing in mind the reasons she reasonably believed she was talking to ANNA and the environment the fraudster had created. Once the fraudster gained access to Miss T’s account the scam became increasingly convincing. As an example, the fraudster was able to input payee details ahead of her authorising the faster payments; something Miss T reasonably believed only her bank would be able to do (having not appreciated the root cause of this was her giving the fraudster access to her account). In the cold light of day Miss T might’ve realised that the caller could only take these actions because she’d allowed them access to her account. But in the moment, taking into account the wider context, I think it’s reasonable she didn’t connect the dots. Miss T didn’t have the space to take a step back and reflect on what was happening. Miss T’s recollections demonstrate that the caller created an environment of pressure and panic, adding to Miss T’s anxious state of mind at the time and further reducing her ability to properly engage with the written interventions relating to the payments she authorised. The call was lengthy and I can see the payments were authorised later on in the call; at which point I’m persuaded the fraudster would’ve significantly worn Miss T down. It seems to me much of the content of the call was designed to bamboozle Miss T and provoke fear, whilst at the same time build rapport and trust. The fraudster appears to have swung back and forth between adding significant pressure; telling her about the prevalence of fraud to create fear and the need for urgency, and being supportive; offering to provide a transcript of their

-- 8 of 11 --

call to support Miss T in explaining why she was unable to fulfil her work commitments and advising her on how to stay safe online. Miss T was clearly manipulated and this put her on the back foot from recognising potential red flags in the situation she found herself in. I’ve thought carefully about whether Miss T ought to have ended the call and ignore what she’d been told, especially as there were some elements of the scam that weren’t particularly sophisticated – for example this wasn’t an impersonation scam where number spoofing was initially used, and it would appear the fraudster might not have known about ANNA’s new fraud questionnaire given it asked Miss T to read out some of the warnings she was provided with. I also think some of the actions the fraudster asked Miss T to carry out – such as repeatedly logging in and out of her account - were slightly dubious. On the other hand, Miss T recalls the content of the fraudster’s call was indistinguishable from a legitimate call from a financial institution and as I’ve explained, she recalls the caller appeared to know information that Miss T believed only H’s PSP would. Overall, I’m persuaded the level of social engineering overcame some of the less persuasive elements of the scam. Overall, for the reasons I’ve explained, ahead of her authorising the disputed payments I can see why Miss T believed the call was genuine. And so, prior to Miss T being presented with ANNA’s interventions in relation to the payments she authorised, I think she had a reasonably held belief that the call was genuine. I have gone on to think very carefully about whether these interventions should have made the risk Miss T was not dealing with ANNA so clear and obvious that she should be considered to have acted with gross negligence in moving past them. Miss T’s recollections of these interventions are simply that the caller either pre-empted their appearance and talked her through how to respond to them, or asked her what they said and directed her on how to respond. Miss T specifically recalls the fraudster telling her to only read out the ‘options’ and not the overall statements; essentially directing her to overlook the full content of the warnings ANNA sought to provide. It doesn’t appear that Miss T properly absorbed, or even read, the content of the interventions as a result. I accept Miss T also provided inaccurate answers in relation to the purpose of the payments and that this meant ANNA couldn’t provide her with as many interventions specific to the scam she fell victim to. But it’s important to remember the level of coaching Miss T was subjected to. These later interventions were written interventions, and Miss T had a competing narrative from the fraudster over the phone throughout. That competing narrative had an advantage over ANNA’s interventions - the fraudster was able to react dynamically to ANNA’s interventions and distract Miss T from properly engaging with them. And critically, by this point, the fraudsters already had access to her account which, as I’ve said, allowed them to know even more about Miss T that she’d believe only ANNA could know. The fraudster had earned Miss T’s trust and built rapport with her – further adding strength to the scam. Miss T thought the fraudster offering to provide a transcript of the call was kind, and it reinforced the notion that her PSP was trying to protect and support her. In these circumstances, and taking into account some of the limitations of ANNA’s interventions, Miss T’s actions overall, including giving inaccurate answers, become much more reasonable. I do not think Miss T set out to mislead ANNA to gain anything, simply put, she followed the instructions from who she thought was her PSP helping her to protect her money. It is very common for customers to follow instructions from their bank, particularly when it comes to matters of fraud. ANNA has more recently provided an illustrative example of an intervention it says Miss T was provided with, which contains information more specific to the scam she fell victim to despite the inaccurate answers she gave during the payment journey. I can’t know for sure

-- 9 of 11 --

whether Miss T was shown this intervention or not given it is an illustrative example, but even if she was, it makes no difference to my overall conclusions. I accept that this intervention covered off the scam Miss T fell victim to, to some extent. For example, it included information such as telling Miss T to stop if someone had said her account is at risk or asked her to make an unexpected payment, even if that person claims to be from ANNA or the police. And to stop if she’d been told to lie about where the funds are going, or told to ignore a warning like this. At the end of the intervention screen Miss T needed to interact by ticking a box to confirm she wished to continue with the payment. What Miss T ticked simply said ‘I confirm that I trust this payee and I’m comfortable making this payment’. Miss T does not recall receiving interventions specific to impersonation scams and I can understand why this is the case given her very specific recollection that she was told to just read out statements where she had to choose an option or carry out an action. On balance I think Miss T simply checked the confirmation to proceed at the end of this screen without even reading the intervention in full in turn overlooking the content of the warning. ANNA has also shown that Miss T was provided with a ‘no match’ confirmation of payee message. Like the other interventions, Miss T doesn’t recall the content of this message and so again, it seems more likely than not the fraudster just told her to select an option in order to proceed. But having reviewed the message, other than it setting out the account details don’t match, it doesn’t warn Miss T of a scam risk and tells her to ‘double check the payee details, and only make this payment if you trust the person who provided them’. Even if Miss T did check the payee details, she’d have checked them direct with the fraudster during the call, who she trusted and believed to be a representative from ANNA. The confirmation of payee message doesn’t alert Miss T to a scam risk. ANNA has argued that Miss T’s response to the interventions are grossly negligent and that some of her recollections are flawed. It’s said that prior to the scam it had never spoken to Miss T on the phone and so queried how Miss T could find the fraudsters communication to be similar to that of ANNA. It also found her response to the warning about a new device accessing her account, and recollections over believing a credit card had been applied for without her consent unpersuasive. I think Miss T’s recollections are confused but knowing how these scams work I think it’s plausible the fraudster manipulated her into believing what she did at the time. I don’t think she’s set out to mislead ANNA or this service – I think Miss T’s observations and confusion reflect the extent of her manipulation and the confusing environment created by the fraudster. It isn’t surprising that Miss T’s recollections are hazy and confused, this is often the case with fraud victims who’ve been socially engineered. It is well known that fraudsters twist facts and use information unwittingly already provided by their victim to their advantage. I suspect Miss T’s state of mind at the time – anxious and stressed, and six months pregnant – added to this somewhat. I do accept Miss T’s actions, in the face of these interventions, in particular those more specific to the scam she fell victim to and the messages informing her of the risk of sharing OTP codes could be considered careless. But I am not persuaded it amounts to a significant degree of carelessness or recklessness. Considering the circumstances overall, while there were some aspects of the scam that were less plausible, gross negligence requires a significant degree of carelessness. It’s not enough for ANNA to show that a reasonable person in Miss T’s shoes might have acted differently. It needs to demonstrate that her actions fell so far below that of a reasonable person that she was grossly negligent – I don’t think it has done that. This was a scam where Miss T had nothing to gain but on the face of it, a lot to lose. The scam succeeds by preying on the fear of a victim who is faced with the choice to either ignore what they’re being told by whom they’re told is their PSP, and run the risk of losing their money, or engage with the caller and seek to protect their account balance.

-- 10 of 11 --

Miss T chose the latter option which, for all the reasons I have explained, I think was reasonable in the circumstances. Overall I’m not persuaded Miss T acted with gross negligence in moving past ANNA’s interventions and I think H should be reimbursed in full (subject to the excess) under the Reimbursement Rules. The excess The Reimbursement Rules allow for a firm to deduct an excess to each APP scam claim unless a customer was vulnerable to a particular APP scam. The maximum excess that can be applied is currently £100. ANNA can deduct up to £100 from the amount reimbursed, should it decide to do so. It has not indicated in response to our investigator’s view whether it intends to apply an excess but its website, at the time of writing, says that it will apply an excess of up to £100. Distress and inconvenience Finally, I’ve thought about whether H should be paid compensation for distress and inconvenience. I can see that ANNA’s communication with Miss T ought to have been better in relation to the recovery of funds and I think its failings here inconvenienced H. I therefore agree with the investigator that ANNA should pay H £100 for the inconvenience it caused. My final decision I uphold this complaint and instruct PayrNet Limited to pay H: • The amount lost to the scam - £9,590.84, minus the excess of a maximum of £100 should it choose to do so • 8% simple interest per year on that amount from the date PayrNet declined the claim under the Reimbursement Rules to the date of settlement, less any tax lawfully deductible. • £100 compensation for the inconvenience it caused H. Under the rules of the Financial Ombudsman Service, I’m required to ask H to accept or reject my decision before 28 April 2026. Katie Doran Ombudsman

-- 11 of 11 --