The Royal Bank of Scotland Plc · DRN-6141203

The complaint Mr M complains that The Royal Bank of Scotland Plc (RBS) won’t refund the money he lost to a romance investment scam. Mr M is represented in this complaint, but I’ll refer to him as it’s his complaint. What happened The detailed background to this complaint is well known to both parties. So, I’ll only provide a brief overview of some of the key events here. After the tragic loss of his wife, Mr M was actively seeking work and a new income stream. In early October 2024, Mr M received a cold call from X (a scammer) who pretended she thought the number belonged to another person. X and Mr M had a very engaging conversation which switched to a messaging app and, by showing an interest in Mr M and sharing information about each other, X discovered Mr M was vulnerable and looking for a friendship having recently been widowed. X also discovered Mr M had recently received a large inheritance and was looking to have a working investment. After messaging Mr M daily, their friendly relationship quickly grew. X made out she was a wealthy businesswoman who had made her money in Continent A through a virtual wholesale shop with Company T (a legitimate and very popular global social media platform). X explained how, for a small investment, Mr M could gain significant returns. She showed him orders and profits he could make by having a virtual shop which he could sell goods (to Company T viewers) that he purchased wholesale from Continent A at reduced prices without any overheads. This seemed an ideal opportunity for Mr M and from research he could see that Company T shops were a real thing. As Mr M didn’t have any knowledge or contacts and believed X’s claim that she was a successful expert and had connection with someone senior at Company T, he took her up on her offer of support. X gave Mr M a fake contact address in order to set up his business, purchase and sell stock. X and / or other scammers tricked Mr M into thinking he was liaising with a wholesaler, Company T customer services and had a Company T shop account which was making a high profit. X then encouraged Mr M to increase his investment. Mr M was able to see his account, which appeared professional, but only via a link supplied by X. Mr M had a bank account with Bank H and tried to make payments to the wholesaler for stock but Bank H’s system blocked them and, after he spoke to an agent, who had concerns, he decided to open an account with RBS and then transfer the funds to them (from Bank H) and then make three international payments, as shown in the following table: Payment / Credit Date Payment Method Beneficiary Total Credit from Mr M’s Bank H account 15/11/24 Mr M’s RBS account £25,000.00 1 15/11/24 International payment Person D £24,303.86

-- 1 of 8 --

Credit from Mr M’s Bank H account 19/11/24 Mr M’s RBS account £45,000.00 2 19/11/24 International payment Person K £20,240.77 3 20/11/24 International payment Person K £20,231.50 Total £64,776.13 There was a delay between Bank H’s block and the setting up of an RBS account and X pretended she was helping Mr M, adding funds to his Company T shop account. By this time, Mr M’s relationship with X had developed into a romance with plans to meet which X delayed. in late November 2024, when Mr M wanted to make a withdrawal from his fake Company T account, he was told he had to pay a large tax bill. Mr M transferred £30,281.37 from his Bank H account to his RBS account. But, at this point, he started to get suspicious. Firstly, Mr M appears to have realised he couldn’t publicly access his shop and when he asked X her behaviour was odd. Secondly, Bank H appear to have had fraud concerns after he made the £30,281.37 transfer, which resulted in RBS informing Mr M his account was being frozen. And soon after Mr M confronted X and was devastated to realise he’d been scammed. Mr M complained to RBS, seeking a refund of his loss plus interest and £300 compensation. This is because he believes there were clear warning signs and his loss would’ve been avoided if RBS effectively intervened, when he visited their branch. RBS rejected his claim and said: • Payment 1 did flag for further checks, questions were asked and his answers validated the payment after giving scam educational information. • Further payments did not flag as there were no further concerns. • His vulnerability has not been brought to their attention. Mr M then brought his complaint to our service. However, our investigator wasn’t persuaded that any further questioning from RBS would’ve prevented the scam. As Mr M disputes RBS’s version of events and doesn’t agree that they carried out sufficient intervention, this complaint has been passed to me to look at. I issued a provisional decision on 2 February 2026, and this is what I said: I’ve considered the relevant information about this complaint. My provisional decision is different to the outcome reached by our investigator. So, I’d like to give both parties an opportunity to respond. The deadline for both parties to provide any further comments or evidence for me to consider is 16 February 2026. Unless the information changes my mind, my final decision is likely to be along the following lines. If The Royal Bank of Scotland Plc accepts my provisional decision, it should let me know. If Mr M also accepts, I may arrange for the complaint to be closed as resolved at this stage without a final decision.

-- 2 of 8 --

What I’ve provisionally decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, my provisional decision is to partially uphold this complaint, and I’ll explain why. I should first say that: • I’m very sorry to hear about Mr M’s sad loss and that, soon after, this situation was cruelly used to manipulate and scam him. • In making my findings, I must consider the evidence that is available to me and where evidence is incomplete, inconsistent or contradictory, as some of it is here, I must reach my decision on the balance of probabilities – in other words, what I consider most likely to have happened in light of the available evidence and wider circumstances. • I’m satisfied that the APP Scam Reimbursement Rules, introduced by the Payment Systems Regulator in October 2024, for customers who have fallen victim to an APP scam, don’t apply here. This is because they were all international payments. • I’m satisfied that RBS did what it could to recover Mr M’s funds once they were made aware of the scam, but as soon as the international payments were made, the funds would’ve been immediately taken. • The Payment Services Regulations 2017 (PSR) and FCA’s Consumer Duty are relevant here. PSR Under the PSR and in accordance with general banking terms and conditions, banks should execute an authorised payment instruction without undue delay. The starting position is that liability for an authorised payment rests with the payer, even where they are duped into making that payment. There’s no dispute that Mr M made the payments here, so they are considered authorised. However, in accordance with the law, regulations and good industry practice, a bank should be on the look-out for and protect its customers against the risk of fraud and scams so far as is reasonably possible. If it fails to act on information which ought reasonably to alert a prudent banker to potential fraud or financial crime, it might be liable for losses incurred by its customer as a result. Banks do have to strike a balance between the extent to which they intervene in payments to try and prevent fraud and/or financial harm, against the risk of unnecessarily inconveniencing or delaying legitimate transactions. So, I consider RBS should fairly and reasonably: o Have been monitoring accounts and any payments made or received to counter various risks such as anti-money laundering and preventing fraud and scams. o Have systems in place to look out for unusual transactions or other signs that might indicate that its customers were at risk of fraud (among other things). This is particularly so given the increase in sophisticated fraud and scams in recent years, which banks are generally more familiar with

-- 3 of 8 --

than the average customer. o In some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks, before processing a payment, or in some cases declined to make a payment altogether, to help protect customers from the possibility of financial harm from fraud Consumer Duty Also, from July 2023, RBS had to comply with the Financial Conduct Authority’s Consumer Duty which required financial services firms to act to deliver good outcomes for their customers. Whilst the Consumer Duty does not mean that customers will always be protected from bad outcomes, RBS was required to act to avoid foreseeable harm by, for example, operating adequate systems to detect and prevent fraud. RBS was also required to look out for signs of vulnerability. With the above in mind I first considered each of the three payments to determine whether RBS should’ve recognised that Mr M could be at risk of financial harm and, if they should’ve, what a proportionate intervention (to mitigate the risk) would’ve looked like. Payment 1 – for £25,000 on 15 November 2024 RBS knew that Mr M was a new account holder and, as there was no account history, I think they should’ve recognised the following risks: A. It was a high value payment that was being made only a few days after opening the account. B. The funds to make the payment had come through on the same day from another bank account that Mr M held (with Bank H) and multi-stage payments can be an indicator of fraud or a scam. C. Mr M wasn’t crediting an individual’s regulated bank account here. Instead, he was making an international payment to another country and that country was in a continent where fraud and scams frequently get reported. For the above reasons, I would’ve expected RBS to have had concerns and put in place a human intervention where they could probe to provide relevant education and warnings, uncover any vulnerability and detect anything suspicious that could be a fraud or a scam. This is what RBS said they did over the phone as branch staff weren’t available due to the time Mr M arrived. Payment 2 – for £20,240.77 on 19 November 2024 This was another large payment, just a few days later, and following a further large credit of £45,000. So, the same above risk factors A to C apply, with B being more prominent. And Mr M appeared to be solely using his account for large international payments that he didn’t want or wasn’t able to do through Bank H. So, I would’ve expected them to have put in place another human intervention (as described above) for this payment. However, RBS appear not to have completed this analysis or implemented this type of intervention. Instead, they relied upon their intervention on payment 1 plus asked some general security questions. Payment 3 - for £20,231.50on 20 November 2024 This was another large payment, the day after payment 2, and Mr M was now sending over £40,000 in two days and over £60,000 in six days. These were large amounts and as risk factors A to C again apply, I would’ve expected to have seen another human intervention (as described above) for this payment. However, RBS again appear not to have completed this analysis or implemented this type of

-- 4 of 8 --

intervention. Instead, they again relied upon their intervention on payment 1 plus asked some general security questions. RBS’s human intervention I then looked closely at the human intervention that RBS relied upon to see: • If it was effective. • If it (and further human interventions, if they had occurred on payment 2 and 3) would’ve more likely than not have resulted in the scam being unravelled or stopped. Mr M spoke to a fraud and scam agent over the phone. Although it was on a telephone line from an RBS branch, as they allowed customers to use it, I was surprised they didn’t make or keep a recording. Without a recording, to determine what more likely than not happened and whether the call was effective I used other evidence which, apart from Mr M’s testimony that he wasn’t asked probing questions or given educational information, is: • Mr M’s social media dialogue with X, where he mentioned his interactions with RBS. • A number of call recordings that Bank H had with Mr M when they spoke to him about the payments he tried to make with them and also put in place a human intervention and block. • RBS payment checklists. • RBS file notes. Regarding Mr M’s full dialogue with X, there isn’t any evidence that X told or coached him on what to say to his banks to ensure the payments weren’t blocked. Importantly, X did try and encourage him not to be fully honest with his banks but, when she did this, Mr M indicated that he had to be honest and said he had told the RBS and their manager about his Company T shop. Regarding Mr M’s conversations with Bank H, most of the calls were about payment instructions and I found Mr M was honest about the business he was led to believe he was running. There were two calls with Bank H, in which Mr M was asked some probing questions, and I found he was truthful. One of these calls was with a fraud and scam agent, who was suspicious and Mr M became frustrated at her probing questions about the goods and payees which prompted her to conclude the call and ask him to visit a branch. However, from listening to all the calls he had with Bank H (and there were a number), I found Mr M’s frustration stemmed from the total time he had spent on the phone and his dissatisfaction with their service as he had spent hours on the phone trying to sort his payments out. There isn’t any information on what happened at the Bank H branch, but by then I think he was determined to close his account mainly due to his frustration over their service. When a Bank H agent probed, I noted that they quickly established that he was a vulnerable customer as when explaining his new business venture (the Company T shop) he was open about the sad passing of his wife and his inheritance. However, due to Mr M expressing frustration, there were important probing questions that he wasn’t asked such as when and how he was introduced to the business, who the friend (that he mentioned) was and how he met them. And he didn’t receive any educational information on the most likely scams which, from the information he

-- 5 of 8 --

gave, would’ve been romance and investment scams which was what was happening to him. Regarding RBS‘s payment checklists, I found these to be very limited. They did though confirm he mentioned the payments were for his business, the Company T shop. Regarding Mr M confirming he wasn’t acting under instructions and was dealing with a legitimate beneficiary, he would’ve said this because he was tricked into believing he was making a business-related payment and the beneficiary was genuine. And his urgency was because he wanted to sell goods in his shop and make a profit. Regarding RBS’s file note, this said that the phone line for the payment 1 human intervention ‘was really bad delay from customer responding to me about payment questions’. Although I recognise the difficult balancing act a bank has to make when deciding to delay a payment and Mr M had made a trip to the branch, as the agent appears to have had difficulty hearing him and there were payment risks, I think they should’ve asked him to call back later that day or the next day. Another note says ‘payment done-Empowerment used for the following - Authentication, Profiling Payment, Service & Customer Focus, Educational Advice, Mandatory inputs’. I recognise this is a brief note, but it doesn’t mention the asking of probing questions which, bearing in mind the above mentioned ‘bad (line) delay’ would’ve likely been difficult. Having considered the above, which is currently the only available evidence, even though Mr M was under X’s spell, I think it more likely than not that: • Mr M would’ve been open and honest with RBS about what he was doing and that he told the fraud and scam agent about his Company T business. • That there was a lack of probing questions on the source of the funds, how he was introduced to the business, who was helping him and how they were helping him, how he knew them and the payees and how he accessed his account (including for withdrawals), that would’ve alerted the agent to the following: o Mr M being a vulnerable customer. o Person X introducing and guiding him. o Mr M only knowing X for a short period. o X calling him out of the blue (a tactic often used by scammers’). o Mr M only being able to access his Company T shop and withdraw from it with X’s help. o The returns being too good to be true. And a skilled fraud and scam agent would’ve become suspicious similar to the Bank H agent who had less information. I think a suspicious agent would’ve then: • Brought to life romance and investment scams through examples. • Asked him to show them evidence of his shop, which he wouldn’t have been able to do (and which importantly later made him suspicious and led to the scam unravelling). • Told Mr M that he was likely being scammed and advised him on due diligence which would’ve included independently contacting Company T. • Blocked the payment and restricted his account while he considered the warning and education and completed due diligence.

-- 6 of 8 --

Although Mr M may well have become frustrated and found this difficult to believe, I think he would’ve then reflected on the education and warnings, done more research and challenged X, and this would’ve unravelled the scam and stopped his loss. So, in summary, I’m persuaded by Mr M’s testimony that RBS’s intervention was inadequate, and he wasn’t asked sufficient probing questions or given educational information which I think, on balance of probabilities, would’ve unravelled the scam and prevented his loss. So, as I think a stronger human intervention at payment 1, and interventions at payment 2 and 3, would’ve more likely than not uncovered the scam and prevented Mr M’s financial loss, I then looked at: Contributory negligence There’s a general principle that consumers must take responsibility for their decisions. Although I recognise how clever this cruel scammer was and in no way blame Mr M (as I recognise he was vulnerable and there were sophisticated elements to the scam) for making the payments, I think there was more he could’ve done before making the payments through RBS especially after Bank H had concerns over his previous payment attempts. Mr M became suspicious when he couldn’t gain access to his Company T account without using X’s link and, as he thought it was his new business and investing a lot of money, I think he should’ve considered this and questioned X at the very start or at least following Bank H’s warnings. Although X would’ve likely tried to distract him, I think this would’ve led to him doing independent checks with Company T (which would’ve unravelled the scam). Also, given the nature of investment and the money involved here, I think it’s reasonable to have expected Mr M to have completed a substantial level of research into this type of investment and sought professional advice. Compensation Finally, regarding compensation, given that RBS ought to have prevented some of the loss from occurring. As distress and inconvenience has been caused by the cruel scammer, rather than RBS, I don’t think it would be fair and reasonable to require a compensation payment here. Putting things right Having considered all the above, I think both the business and customer should’ve done more here. RBS should’ve put in place a better intervention at payment 1, which would’ve likely stopped the scam payments and then led to the scam unravelling, and Mr M should’ve been more diligent. So, I think it is only fair and reasonable for liability to be shared. So, my provisional decision is to partially uphold this complaint, and I require RBS to: • Provide Mr M with a refund of 50% of his loss from payment 1. This is £32,388.07. • Pay 8% simple interest on payments 1 to 4 from date of loss to date of settlement.

-- 7 of 8 --

My provisional decision For the reasons mentioned above, my provisional decision is to partially uphold this complaint against The Royal Bank of Scotland Plc, and my requirements are detailed in the above putting things right section. This is subject to any comments that either Mr M or The Royal Bank of Scotland Plc M may wish to make. These must be received by 16 February 2026. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Further to my above provisional decision, both parties responded before the deadline confirming their acceptance of it. As my view remains the same, I therefore adopt my provisional decision and reasons as my final decision. Putting things right Having considered all the above, I think both the business and customer should’ve done more here. RBS should’ve put in place a better intervention at payment 1, which would’ve likely stopped the scam payments and then led to the scam unravelling, and Mr M should’ve been more diligent. So, I think it is only fair and reasonable for liability to be shared. So, to put things right, I require RBS to: • Provide Mr M with a refund of 50% of his loss from payment 1. This is £32,388.07. • Pay 8% simple interest on payments 1 to 4 from date of loss to date of settlement. My final decision For the reasons mentioned above, my final decision is to partially uphold this complaint against The Royal Bank of Scotland Plc, and my requirements are detailed in the above ‘putting things right’ section of this decision paper. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr M to accept or reject my decision before 10 March 2026. Paul Douglas Ombudsman

-- 8 of 8 --