HSBC UK Bank · DRN-6185611

The complaint Mr M has complained that HSBC UK Bank Plc won’t refund the money he lost to a scam. What happened In summary, in summer 2025, Mr M made a purchase on a scammer’s website which had been made up to look like a genuine merchant. To pay for the purchase, Mr M used his HSBC debit card via PayPal. Essentially, Mr M made a card payment from his HSBC account to his PayPal facility, then PayPal sent the money on to the scammer. The payment was in a foreign currency, and Mr M had thought he was paying around £50, but was charged around £500 instead. Mr M has said that the scammer did not provide the goods he purchased. HSBC tried a chargeback, and provided a temporary refund. The chargeback was against PayPal, and did not succeed, so the temporary refund was taken back again. HSBC didn’t think they were otherwise liable for Mr M’s loss. Our investigator looked into things independently and didn’t uphold the complaint. Mr M asked for an ombudsman’s decision, so the complaint’s been passed to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I understand that Mr M fell victim to a scam, for which he has my sympathy. I appreciate that the scammer caused him a good deal of frustration, and I appreciate why he’d want to try to get his money back. We must keep in mind that it’s the scammer who’s primarily responsible for their own scam, and it’s the scammer who really owes Mr M his money back. But in this case between Mr M and HSBC, I’m only looking at what Mr M and HSBC might be liable for. Having carefully considered everything that both sides have said and provided, I can’t fairly hold HSBC liable for Mr M’s loss. I’ll explain why. HSBC didn’t scam Mr M, and HSBC are not generally responsible for the scammer. HSBC were also not responsible for providing the goods that Mr M purchased from the scammer. In this situation, Mr M’s contract to purchase goods was with the scammer, not with HSBC, and HSBC did not breach any such contract. HSBC can potentially be liable for certain things in cases of scams, depending on the situation. So I’ve thought carefully about what they might be liable for here.

-- 1 of 3 --

While Mr M may not have intended for the money to end up with a scammer, and while he may not have intended to pay the amount he did, he did make this payment, and the technical data supports that it was properly authenticated. And under the Payment Services Regulations and the terms of his account, Mr M is liable for the payments he puts through and the resulting loss in the first instance. Further, broadly speaking, HSBC had an obligation to follow his instructions – the starting position in law is that banks are expected to process payments which a customer authorises them to make. HSBC should have been on the lookout for payments which could be the result of fraud or scams, to help prevent them. But a balance must be struck between identifying and responding to potentially fraudulent payments, and ensuring there’s minimal disruption to legitimate payments. Here, while of course this would’ve been a substantial amount for Mr M to lose – again, he has my sympathy there – the payment was not nearly large enough to have been of particular concern to the bank, and it was not out of line with amounts he’d spent in the preceding period. It was just a single payment, not a series of rapid payments, made from a more than sufficient balance to a well-established payment service who Mr M had used many times before. There was nothing particularly suspect about the payment, and I can’t see that HSBC had any pressing reason to intervene at the time it was made. I understand Mr M found it frustrating that despite reporting the payment to HSBC shortly afterwards, they couldn’t stop it. But it wasn’t possible for HSBC to do so. While the payment would’ve taken some time to show on Mr M’s statement and would’ve displayed as being “pending” after he made it, that’s just to do with the way such card payments are processed. The transaction had already gone through from HSBC’s end, and by the time Mr M reported it, it was already too late for HSBC to have stopped it. I do appreciate that this is not intuitive. I’ve then considered what HSBC did to try to recover the money after Mr M told them about the scam. It wasn’t possible for HSBC to simply take back the money. And as this was a card payment to Mr M’s own PayPal facility, it was not covered by the CRM Code for scams, nor by the PSR’s latest rules. Sometimes, card payments can be disputed through a chargeback. As our investigator explained, chargebacks are not mandatory, they have to follow certain rules set by the card scheme, and they can only be made against the party the card payment went to, and only for certain reasons. For example, if Mr M had made a card payment to a merchant directly, then that merchant had failed to provide the goods, then it would be fairly straightforward to make a chargeback claim for the goods not being provided. The problem here is that the card payment in question went to PayPal, not directly to the scammer. In essence, Mr M’s debit card payment was to PayPal, then PayPal paid the scammer. So any chargeback from Mr M would have to be a claim against PayPal. But PayPal weren’t supposed to provide the goods that Mr M purchased from the seller, they were just providing a payment service; and as far as I can see they provided the service they were supposed to. As such, there was no chargeback reason which would’ve realistically succeeded against PayPal here. So while it was nice of HSBC to try a chargeback when they didn’t have to, I’m afraid it’s unsurprising that the chargeback was not successful in this case. And there was nothing more that HSBC could’ve reasonably done which would’ve been reasonably likely to get the money back.

-- 2 of 3 --

Finally, I’ve considered Mr M’s request for compensation. As before, I can see that the scammer caused him a good deal of trouble and upset, for which he has my sympathy. But this case is against HSBC, not the scammer. And I can’t see that HSBC got anything substantially wrong here, let alone anything which would warrant compensation. So while I’m sorry to hear about what the scammer did to Mr M, I don’t think HSBC can fairly be held responsible for the loss. And so I can’t fairly tell HSBC to reimburse Mr M in this particular case. My final decision For the reasons I’ve explained, I don’t uphold this complaint. This final decision marks the end of our service’s consideration of the case. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr M to accept or reject my decision before 19 May 2026. Adam Charles Ombudsman

-- 3 of 3 --