DRN-6286861

The complaint Mr G complains that Santander UK Plc won’t refund the money he lost when he fell victim to an investment scam. Mr G is represented in this complaint, but I’ll refer to him as it’s his complaint. What happened The detailed background to this complaint is well known to both parties. So, I’ll only provide a brief overview of some of the key events here. Mr G was contacted on social media by Person D (a scammer) about an investment trading opportunity with (fake) Company M. Mr G became interested as he was shown fake projections and told about client success stories and how the return on investment would be around 150%. Also, Person D appeared knowledgeable and professional. To pay the scammer Mr G moved funds into his Santander account and then onto Firm M (a legitimate crypto exchange) where he credited the scammer’s crypto wallet. The following table lists his payments totalling £19,003: Payment Number / Credit Date Payment Method Payee Amount 1 09/01/2024 Faster payment Mr G’s account with Firm M £2,000.00 Payment 1 returned 09/01/2024 £2,000.00 2 10/01/2024 Debit Card Mr G’s account with Firm M £2,003.00 3 12/01/2024 Debit Card Mr G’s account with Firm M £5,000.00 4 25/01/2024 Debit Card Mr G’s account with Firm M £12,000.00 Total £19,003.00 Mr G could see his money and high profits on a fake platform. But when he tried to make a withdrawal, after payment 4, he was told that he had to make a deposit and pay fees. Soon after Mr G realised he’d been scammed. In 2025, Mr G contacted Santander seeking a refund and interest as he considers they should’ve intervened and, if they had, they would’ve noticed his inexperience, unravelled the scam and stopped his financial loss. Santander rejected his claim. They said that as he had authorised the payments, they weren’t liable. Also, that he wasn’t entitled to a refund. Mr G then brought his complaint to our service and our investigator’s view was that Santander should’ve put in place an automated intervention at payment 3 and a human intervention at payment 4. She said that they should refund Mr G from payment 4 as she thought the human intervention, at that point, would’ve prevented his loss. However, she thought the refund should be 50% because of contributory negligence from Mr G.

-- 1 of 7 --

Mr G accepted but Santander disagree. Santander’s points when asking for an Ombudsman decision included the following: • The loss didn’t happen from Santander. • The payments were made via Firm M and they: o Are FCA registered. o Have stringent security and account opening processes. o Confirm that Mr G was shown fraud and scam warnings. • They haven’t seen any evidence of the scam/losses. • They ‘strongly feel that the payments in question were not unusual (which you have agreed with) and that it is unfair to suggest detection should still have occurred’. • They referenced Philipp v Barclays Bank plc saying they are being held liable for something we could not have controlled or changed. • They understand we can’t compel Mr G to make a claim with the beneficiary bank, but he does have a valid claim to make, and a refund can easily be duplicated. • They highlight that card payments do not require access to the account before processing like other methods of payment. I issued a provisional decision on 27 March 2026, and this is what I said: I’ve considered the relevant information about this complaint. My provisional decision is different to the outcome of that reached by our investigator as I think the scam could’ve been unravelled one payment earlier. So, I’d like to give both parties a further opportunity to respond. The deadline for both parties to provide any further comments or evidence for me to consider is 10 April 2026. Unless the information changes my mind, my final decision is likely to be along the following lines. If Santander UK Plc accepts my provisional decision, it should let me know. If Mr G also accepts, I may arrange for the complaint to be closed as resolved at this stage without a final decision. What I’ve provisionally decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, my decision I’m partially upholding this complaint. I’ll explain why. I should first say that: • I’m very sorry to hear that Mr G has been the victim of this cruel investment scam and that he’s lost a significant amount of money here. • Having reviewed Mr G’s submission, including his dialogue with the scammer and crypto statements provided to our service, I’m satisfied that the payments in the above table went to the scammer. • Although I’ve read and considered everything Mr G and Santander have said, I won’t be responding to every point individually. If I don’t comment on any specific point, it’s not because I’ve not considered it but because I don’t think I need to

-- 2 of 7 --

comment on it in order to reach the right outcome. • In making my findings, I must consider the evidence that is available to me and use it to decide what I consider is more likely than not to have happened, on balance of probabilities. • Although Santander were a signatory of the CRM Code which required firms to reimburse customers who have been the victim of a scam in most circumstances, I’m satisfied the code didn’t apply here as Mr G paid another account in his name (with Firm M) and by card. • I don’t think it would’ve been reasonable to have expected Santander to recover the funds considering they were made through another account and sent to a crypto account that would’ve been immediately emptied. Also, chargebacks wouldn’t have been possible as the services were provided. • The Payment Services Regulations 2017 (PSR) and FCA’s Consumer Duty are relevant here. PSR Under the PSR and in accordance with general banking terms and conditions, banks should execute an authorised payment instruction without undue delay. The starting position is that liability for an authorised payment rests with the payer, even where they are duped into making that payment. There’s no dispute that Mr G made the payments here, so they are considered authorised. However, in accordance with the law, regulations and good industry practice including the Consumer Duty, a bank should be on the look-out for and protect its customers against the risk of fraud and scams so far as is reasonably possible. If it fails to act on information which ought reasonably to alert a prudent banker to potential fraud or financial crime, it might be liable for losses incurred by its customer as a result. Banks do have to strike a balance between the extent to which they intervene in payments to try and prevent fraud and/or financial harm, against the risk of unnecessarily inconveniencing or delaying legitimate transactions. So, I consider Santander should fairly and reasonably: o Have been monitoring accounts and any payments made or received to counter various risks such as anti-money laundering and preventing fraud and scams. o Have systems in place to look for unusual transactions or other signs that might indicate that its customers were at risk of fraud (among other things). This is particularly so given the increase in sophisticated fraud and scams in recent years, which banks are generally more familiar with than the average customer. o In some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks before processing a payment, or in some cases declined to make a payment altogether, to help protect customers from the possibility of financial harm from fraud. Consumer Duty From July 2023 Santander had to comply with the Financial Conduct Authority’s Consumer Duty which required financial services firms to act to deliver good outcomes for their customers. Whilst the Consumer Duty does not mean that customers will always be protected from bad outcomes, Santander was required to act to avoid foreseeable harm by, for example, operating adequate systems to detect

-- 3 of 7 --

and prevent fraud. Also, Santander was also required to look out for signs of vulnerability. With the above in mind, I first: Looked at the three payments (2 to 4) to consider whether Santander should’ve recognised Mr G was at risk of financial harm and put in place proportionate interventions. Payment 2 – £2,003 on 10 January 2024 Santander would’ve known this was a new payee and the payment was going to a crypto exchange even though Mr G said he was paying another account in his name. Although I recognise the risk of crypto and Santander would’ve been aware (from the FCA, Action Fraud and their own data) that customers can lose money due to crypto volatility or to scammers who get their victims to make multi-stage payments, I wouldn’t have expected to have seen an intervention on payment 2 (which was the first payment as payment 1 was reversed). And I don’t think their automated new payee warning, enabling a customer to select an alternative reason, was a failing. I say this because: • Crypto payments are both legal and common and Santander process thousands of payments for their customers each day. • Santander have to strike a balance between the extent to which they intervene in payments to try and prevent fraud and/or financial harm, against the risk of unnecessarily inconveniencing or delaying legitimate transactions. • This was, in effect, the first payment as Payment 1 didn’t go through. • This amount wasn’t particularly high for Mr G to spend, and, at this point, there wasn’t yet a potential scam pattern including consistent multistage payments. Payment 3 - £5,000 on 12 January 2024 Although Mr G had made some larger payments than £5,000, importantly, these weren’t to a crypto exchange. In addition to the above-mentioned crypto risks: • The payments to a crypto exchange were increasing in value in a matter of a few days and a fraud pattern was starting to emerge. • Mr G was now spending a large amount on crypto – £7,003 in three days – when he hadn’t previously made any such payments. • Santander would’ve seen a pattern of transfers from another account prior to the payment. Taking the above into account, I think Santander ought to have provided a tailored warning that was specifically about the risk of crypto scams. In doing so, I recognise that it would be difficult for such a warning to cover off every permutation and variation of crypto scams without losing impact. But I think it would’ve been a proportionate response to the risk this payment presented. Payment 4 – £12,000 on 25 January 2024 On its own I consider this to have been a high amount to spend on crypto which has an elevated risk. Also, it was on the high side for Mr G’s account, and it meant that, in less than two weeks, Mr G was spending £19,003 with Firm M. In addition, to enable the payment another transfer had been received into his account.

-- 4 of 7 --

Considering these factors, I think proportionate action should’ve been a human intervention. This is where a fraud and scam agent would ask probing questions to give relevant education and warnings and look to detect a scam. I can’t see that Santander did the above analysis before releasing payments 3 and 4 and they haven’t provided sufficient evidence to persuade me they intervened or that it wasn’t proportionate for them to intervene. If a bank doesn’t question payments that might be at risk, then it can’t fulfil its duty to protect customers. I’m not saying that means it must check every payment out of its customers’ accounts. But here, considering the individual circumstances of this case, I believe it ought to have put in place an intervention to check Mr G wasn’t at risk of falling victim to fraud or a scam. I then considered: What would’ve more likely than not happened had Santander implemented a tailored warning on payment 3 and a human intervention on payment 4. Santander raise a question about possible coaching and persuasion tactics, which is understandable as scammers frequently do this to ensure victims mislead banks and / or disregard strong warnings. Although I can’t be certain, I think it more likely than not that this doesn’t apply here. I say this because I haven’t seen any evidence of coaching when reviewing dialogue between Mr G and the scammer. And there weren’t any phone calls between Mr G and the scammer as Person D declined these. Regarding Mr G selecting ‘transfer to my own account’, as he did have an account with Firm M and was transferring finds to them, I don’t think this can be interpreted as an attempt to circumvent Santander’s fraud prevention system. Regarding warnings from Firm M, I requested information from Firm M. But this was declined. So, it isn’t possible to know the detail of these warning and whether it was more than high level warnings about crypto volatility, that I think Mr G would’ve likely been aware of. I’ve thought carefully about what a warning about crypto at payment 3 would’ve looked like and whether it would’ve resonated with Mr G, to the extent where he wouldn’t have proceeded with the payment. I think that such a warning should have addressed the key risks and features of the most common crypto scams – which is crypto investment scams. The warning Santander ought fairly and reasonably to have provided would’ve highlighted, in clear and understandable terms, the key features of common crypto investment scams, for example referring to: an advertisement on social media, promoted by a celebrity or public figure; an ‘account manager’, ‘broker’ or ‘trader’ acting on their behalf; the use of remote access software and a small initial deposit which quickly increases in value and the importance of checking the firm is approved by a regulator. So, when considering the following, I think a tailored warning would’ve resonated with Mr G: • Santander’s dynamic fraud prevention system does warn about the above common features of crypto investment scams. • The features all applied to the scam, including the company and ‘broker’ or ‘trader’ being fake and unregulated. • Mr G’s relationship with Person D was developing and, although he was seeing some initial high returns, I don’t think he was yet fully under the scammer’s spell.

-- 5 of 7 --

• Mr G did have concerns. He told Person D that he was worried and ‘scared’. And this, more likely than not, would’ve resulted in Mr G not going ahead with payment 3 and 4, seeking advice and trying to withdraw his funds from payment 2 and, as he wouldn’t have been able to, this would’ve confirmed the education and warnings. I’m in agreement with our investigator that upon a human intervention, where an agent would’ve brought to life investment scams and Mr G would’ve likely been honest about what he was doing (including his social media introduction, the company, the ‘broker’ or ‘trader’, profits that were too good to be true) the scam would’ve more likely than not unravelled. But I think an earlier tailored automated warning would’ve had the same result. Regarding Santander’s comments about Firm M and not seeing evidence of the loss, I can only consider complaints made to our service and in our service’s jurisdiction. And having reviewed Mr G’s submissions, I’m satisfied the above listed payments went to the scammer and he hasn’t received any other refund. So, having established that a tailored automated intervention at payment 3 would’ve more likely than not uncovered the scam and prevented any further loss, I then looked at: Contributory negligence There’s a general principle that consumers must take responsibility for their decisions. Although I recognise how clever this cruel scammer was and in no way blame Mr G for being scammed, I think he should’ve been more diligent before making the payments. I noted that our investigator made this point and highlighted Mr G’s lack of due diligence. So, as Mr G accepted her view and has suffered much distress due to this cruel scam, I won’t repeat the errors he made in this provisional decision. Putting things right Having considered all the above, I think both the business and customer are equally at fault here. Santander should’ve done more and put in place interventions at payment 3 and 4, which would’ve likely stopped the payment (at payment 3), and Mr G should’ve been more diligent. So, I think it is only fair and reasonable for liability to be shared for payments 3 and 4 which totals £17,000. My provisional decision For the reasons mentioned above, my provisional decision is to partially uphold this complaint, and I require Santander UK Plc to: • Provide Mr G with a refund of 50% of his loss - for payments 3 and 4 - which is £8,500. • Pay 8% simple interest this amount from the date of loss to the date of settlement. This is subject to any comments that either Mr G or Santander UK Plc may wish to make. These must be received by 10 April 2025.

-- 6 of 7 --

What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Further to my above provisional decision, I received the following responses prior to the above deadline: • Mr G said: o He accepted the provisional decision. • Santander referred to previous correspondence and said: o They disagreed with the provisional decision. o ‘They strongly disagree the activity should be considered unusual when reviewing the statement and for all the specific reasons previously provided’. I checked all of the file notes again and I’m satisfied that when making my provisional decision I took into consideration all of Santander’s submissions including the points they raised when disagreeing with our investigator’s uphold view. As no further arguments or evidence have been produced in response to my provisional Decision, my view remains the same. I therefore adopt my provisional decision and reasons as my final decision. Putting things right To put things right, I require Santander UK Plc to: • Provide Mr G with a refund of 50% of his loss - for payments 3 and 4 - which is £8,500. • Pay 8% simple interest this amount from the date of loss to the date of settlement. My final decision For the reasons mentioned in my provisional decision, my final decision is to uphold this complaint against Santander UK Plc and my requirements are detailed in the above Putting things right’ section of this final decision paper. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr G to accept or reject my decision before 11 May 2026. Paul Douglas Ombudsman

-- 7 of 7 --