DRN-6234718

The complaint Mr C is being represented by a claims manager. He’s complaining about HSBC UK Bank Plc because it declined to refund money he lost as a result of fraud. What happened Sadly, Mr C fell victim to a cruel investment scam after he was contacted by someone he didn’t know online. After chatting for some time, he came to believe he was in a romantic relationship with the scammer. They introduced him to the idea of investing in a cryptocurrency trading scheme and guided him through the process of setting up an account on a fake platform. To fund the scam, Mr C made the following debit card payments from his HSBC account between April and June 2024: No. Date Amount £ 1 15 Apr 50 2 22 Apr 5 3 22 Apr 400 4 22 Apr 100 5 11 Jun 2,000 6 11 Jun 2,000 7 11 Jun 1,000 8 11 Jun 200 9 14 Jun 2,000 10 14 Jun 2,000 11 14 Jun 1,000 12 14 Jun 2,000 13 14 Jun 2,000 14 15 Jun 2,000 15 15 Jun 2,000 16 15 Jun 1,000 17 16 Jun 2,000 18 16 Jun 2,000 19 16 Jun 2,000 20 28 Jun 2,000 21 28 Jun 2,000 22 29 Jun 2,000 23 29 Jun 1,150 The payments were sent to two cryptocurrency exchanges, after which the currency purchased was transferred to the scammers. Some of these payments were funded by a loan Mr C had taken from HSBC. He says he realised it was a scam when he tried to log onto the site later on and found it had been closed down. In response to his complaint, HSBC refunded £2,600 to Mr C’s account but declined any further reimbursement.

-- 1 of 5 --

Our investigator didn’t recommend the complaint be upheld. While they felt HSBC should have done more to question Mr C about the payments he was making, they didn’t think any further intervention would have stopped him from wanting to go ahead with them. In particular, they noted that he didn’t provide accurate information about the purpose of the payment to the bank and that he continued to make payments after members of his family told him they believed it was a scam. Mr C didn’t accept the investigator’s assessment and his representative made the following key points: • A human intervention was required in connection with the payments on 11 June as they bore the hallmarks of a cryptocurrency-related scam. This would have involved the bank asking open and probing questions about the payments that would have led to the scam being uncovered. • While he was coached about what to say to the bank, the instructions he was given were limited and this didn’t take place ‘live’ while he was speaking to HSBC. He also wasn’t given a detailed cover story to explain the reason for the payments. • Further, the reason he gave to the bank when he spoke to an agent on 13 June wasn’t plausible as the cryptocurrency exchange isn’t normally used for foreign currency exchange. • It shouldn’t be assumed that he wouldn’t have been honest if the bank had asked him further questions about the payments simply because the scammer told him not to be. • When applying for the loan online and asked about its purpose, he wasn’t offered the option to say it was for investment. • The evidence from his chats with the scammer show Mr C heard the concerns of his family. This demonstrates he would likely have been receptive to appropriate warnings from the bank. • He was vulnerable and his chats with the scammer show the state of his mental health at the time. • HSBC failed to meets its obligation under the Financial Conduct Authority’s (FCA’s) Consumer Duty to prevent foreseeable harm. The complaint has now been referred to me for review. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, I’ve reached the same overall conclusions as the investigator. I haven’t necessarily commented on every single point raised but concentrated instead on the issues I believe are central to the outcome of the complaint. This is consistent with our established role as an informal alternative to the courts. In considering this complaint I’ve had regard to the relevant law and regulations; any regulator’s rules, guidance and standards, codes of practice, and what I consider was good industry practice at the time.

-- 2 of 5 --

Before going any further, I’ve noted the comments about Mr C’s situation and concerns about his mental health at the time of the scam. I was sorry to read of this but I’ve seen nothing to indicate HSBC was made aware of these factors or that it should reasonably have been expected to take them into account when acting on his instructions. There’s no dispute that Mr C authorised these payments. In broad terms, the starting position at law is that a bank is expected to process payments a customer authorises it to make, in accordance with the Payment Services Regulations and the terms and conditions of their account. In this context, ‘authorised’ essentially means the customer gave the business an instruction to make a payment from their account. In other words, they knew that money was leaving their account, irrespective of where that money actually went. There are, however, some situations where we believe a business, taking into account relevant rules, codes and best practice standards, shouldn’t have taken its customer’s authorisation instruction at ‘face value’ – or should have looked at the wider circumstances surrounding the transaction before making the payment. HSBC also has a duty to exercise reasonable skill and care, pay due regard to the interests of its customers and to follow good industry practice to keep customers’ accounts safe. This includes identifying vulnerable consumers who may be particularly susceptible to scams and looking out for payments which might indicate the consumer is at risk of financial harm. Taking these things into account, I need to decide whether HSBC acted fairly and reasonably in its dealings with Mr C. The payments I must take into account that many similar payment instructions HSBC receives will be entirely legitimate. I also need to consider its responsibility to make payments promptly. But at the same time, I’m conscious the payments went to cryptocurrency and that the bank should have known this meant they carried a higher risk of being associated with fraud. Having considered what HSBC knew about the initial payments in April, particularly that the amounts involved were low, I’m not persuaded it ought to have been particularly concerned that Mr C was at risk of harm from fraud and I can’t reasonably say it was at fault for processing them in line with his instructions. On 11 June, however, Mr C made four separate payments totalling over £5,000 and this is the point at which I think HSBC should have identified he may be at risk of harm from fraud and intervened in the payment process. Having thought carefully about the risks these payments presented, I think a proportionate response would have been for the bank to attempt to establish the surrounding circumstances, most likely by speaking to him over the telephone. While HSBC doesn’t appear to have questioned the transactions on 11 June, one of its agents did speak to Mr C on 13 June after he’d tried to make further payments. Due to the close proximity of these events, I think it’s likely that an intervention call two days earlier on 11 June would have resulted in a similar outcome. I’ve listened to a recording of Mr C’s call with the bank’s agent on 13 June. When describing the purpose of the payment, he said it was for foreign currency exchange rather than that he was making an investment. His chats with the scammers also show he sent money by making several smaller payments rather than fewer larger payments in an attempt to avoid detection by the bank’s security systems. I think this, along with declaring an inaccurate

-- 3 of 5 --

reason for taking the loan, shows an intent to hide what he was really doing from the bank as he’d been advised to do by the scammer. I do think HSBC’s agent should have asked far more questions and that its intervention fell short of the standard I would have expected. But I don’t think it’s clear that Mr C would have been any more open about the real circumstances in which the payments were being made if he’d been asked further questions. This notwithstanding, once HSBC had identified a fraud risk I think it should also have identified that the nature of the payments meant the most likely type of scam that could be taking place was a cryptocurrency investment scam. And, in the circumstances, whether or not Mr C had ultimately disclosed that he was investing, I would have expected it to provide a tailored warning setting out common features of this type of scam. I’ve thought carefully about the effect this type of warning might have had but I don’t think it would have been likely to prevent Mr C from wanting to go ahead with payments to the scam. In making this complaint, his representative set out a variety of reasons why he believed the investment scheme was legitimate, including: • his own research, including a review of the company’s website, and media coverage about the returns people were earning from cryptocurrency; • the fact the scammer seemed very knowledgeable about cryptocurrency; • he was set up with an account on a sophisticated and professional portal that appeared to show trades being made and profits generated on his behalf; and • the fact he was able to start with small investments. But probably more important than these factors, Mr C has said he believed he was in a romantic relationship with the scammer and I’m not persuaded that a relevant warning from his bank would have been sufficient to undermine his trust in them. In reaching this conclusion, I noted the chats with the scammer show Mr C had discussed what he was doing with his parents and that they’d spoke to a financial adviser about this and warned him against sending further money as they suspected he was being scammed. But despite this, he continued to make further payments. On balance, taking everything into account, I’m not persuaded that a more robust intervention by the bank that included a tailored warning about investment scams would have stopped Mr C from wanting to make these payments. I want to be clear that it’s not my intention to suggest Mr C is to blame for what happened in any way. He fell victim to a sophisticated scam that was carefully designed to deceive and manipulate its victims. I can understand why he acted in the way he did. But my role is to consider the actions of HSBC and, having done so, I’m not persuaded these were the cause of his losses. I’ve also noted the comments of Mr C’s representative about the FCA’s Consumer Duty and I’ve taken account of HSBC’s obligations following its introduction, but I’m not persuaded this changes the outcome here. While the bank was expected to avoid causing him foreseeable harm, I’m not persuaded its actions were the cause of the harm he suffered, nor do I think that harm was reasonably foreseeable given the information he would have been likely to disclose if it had intervened as I’ve described

-- 4 of 5 --

Recovery of funds Mr C isn’t due any refund under the industry’s reimbursement scheme for authorised push payment (APP) fraud as these payments were made by card rather than bank transfer and were sent to another account in his own name. Further, he doesn’t appear to have reported the scam to the bank until more than a year after the last payment, by which time the normal timeframe for the bank to make a chargeback claim had expired. In any event, he sent money to legitimate cryptocurrency exchanges that provided the service requested of them, that of converting it to cryptocurrency and transferring it to the wallet address he provided. In the circumstances, I don’t think anything that HSBC could have done differently would likely have led to these payments being recovered successfully after this period of time. In conclusion I recognise Mr C has been the victim of a cruel scam and I’m sorry he lost this money. I realise the outcome of this complaint will come as a great disappointment but, for the reasons I’ve explained, I don’t think any further intervention by HSBC would have made a difference to the eventual outcome and I won’t be telling it to make any further refund. My final decision My final decision is that I do not uphold this complaint. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr C to accept or reject my decision before 13 May 2026. James Biles Ombudsman

-- 5 of 5 --