HSBC Bank Plc · DRN-5950824

The complaint Mr G complains about HSBC Bank Plc. He says that he has been the victim of a scam and would like HSBC to refund him the money he has lost as a result. What happened Mr G came across an investment company I will refer to as ‘B’. The business model centred around car leasing; investors would make an investment in B, which would be used to purchase vehicles that could be rented out to individuals in the UK. Investors would then get security over a vehicle and would receive a monthly return on its leasing for a set amount of time before receiving an exit fee consisting of the remainder of the capital and the interest detailed in their agreement. Mr G made an investment of £14,000 in February 2021 – but never received the agreed returns. Mr G contacted HSBC to ask it to return his funds as he thought he had been the victim of a scam. HSBC said that it wouldn’t be refunding Mr G, as it said he had paid money to a failed investment and wasn’t the victim of a scam. Mr G then asked our Service to look into things. Our Investigator considered his complaint, and in summary said that they were satisfied that B was running a scam, and that under Lending Standards Board’s Contingent Reimbursement Model (‘the CRM Code’), HSBC should refund Mr G the money he had lost. Mr G agreed to this outcome. HSBC responded and said that it believed Mr G’s complaint should be ringfenced until the Courts decide the outcome of the charges brought by the Serious Fraud Office (SFO) against the directors of B. As no informal agreement could be reached, the complaint has been passed to me to make a final decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, I have decided to uphold this complaint. I’ll explain why. It isn’t in dispute that Mr G authorised the payment to B. So, in line with the Payment Services Regulations 2017, he is liable for the transaction. But Mr G says that he has been the victim of an authorised push payment (APP) scam – so this isn’t the ned of the story.

-- 1 of 4 --

HSBC has signed up to the voluntary CRM Code, which provides additional protection to scam victims. Under the CRM Code, the starting principle is that a firm should reimburse a customer who is the victim of an APP scam (except in limited circumstances). But the CRM Code only applies if the definition of an APP scam, as set out in it, is met. Can HSBC delay making a decision under the CRM code? While it hasn’t been explicit, HSBC has said that it wished to delay making a decision on Mr G’s case until the Courts have decided the outcome of the charges brought by the SFO. I believe that it wished to apply R3(1)(c) under the code. The CRM Code states: R3(1) Firms should make the decision as to whether or not to reimburse a Customer without undue delay, and in any event no later than 15 Business days after the day on which the Customer reported the APP scam. (a) In exceptional cases, that period can be extended provided the Firm informs the Customer of the delay and the reasons for it, and the date by which the decision will be made. (b) The date in (a) should not be more than 35 Business days after the day on which the Customer reported becoming the victim of an APP scam. (c) If a case is subject to investigation by a statutory body and the outcome might reasonably inform the Firm’s decision, the Firm may wait for the outcome of the investigation before making a decision. (d) If the Firm relies on (c), it should make a decision no later than 15 business days after the outcome of an investigation is known. After invoking (c), the Firm should not further invoke (a). The SFO has confirmed in January 2024 that their investigation is complete, and charges have been filed. So, HSBC should reasonably have given an answer based on the evidence available as per the section of the code set out above. I also note that the Lending Standards Board has confirmed the code does not require a criminal test to be met in order for a reimbursement decision to be reached. With this in mind, as the directors of B have been charged by the SFO, I am not persuaded that HSBC can fairly delay giving an outcome under the CRM Code. Has Mr G been the victim of a scam, as per the CRM Code? The CRM Code sets out the definition of an APP scam as set out below: ...a transfer of funds executed across Faster Payments…where: (i) The Customer intended to transfer funds to another person, but was instead deceived into transferring the funds to a different person; or (ii) (ii) The Customer transferred funds to another person for what they believed were legitimate purposes but which were in fact fraudulent. I’ve therefore considered whether the payment Mr G made to B falls under the scope of an APP scam as set out above. Having done so, I think that it does. I’ll explain why in more

-- 2 of 4 --

detail. In order to determine if Mr G has been the victim of a scam, I have to consider if his intended purpose for the payments was legitimate, whether the intended purposes he and B were broadly aligned and, if not, whether this was the result of dishonest deception on the part of the company. Based on the evidence available to me, Mr G expected the funds to be used to purchase vehicles which would then be leased by a subsidiary of B. He would then receive regular returns on this investment. As B’s subsidiary was an FCA regulated company, and the documents Mr G received appeared to be professional, I see no reason why he would not have thought it was a legitimate investment. I’ve gone on to consider whether B’s intended purpose for the payments aligned with what Mr G intended as set out above. There are two reports that have helped to form my understanding of B’s intended purpose for the payments, one by the FCA and another by the administrators of B and their subsidiaries. The FCA’s report states that the number of customers B claimed had entered into leases was 1,200, however they only had 69 registered vehicles on Companies House across its three subsidiaries. When the FCA did a deep dive into the registered vehicles, they found significant discrepancies between the B’s business model and the vehicle inventory. These included a high number of what appeared to be second-hand vehicles. While B’s business model did allow for some used cars to be leased, it relied on a large extent to securing deep discounts on new vehicles which would not be available on second hand cars. A number of leases were also said to have been entered into at a date which was significantly before the vehicle was put onto the road. The FCA also found B’s valuation of its motor vehicles as unrealistic, and felt the discrepancy was around £18 million. The report from the administrators of the subsidiaries also stated that there was less than one car for every six loan agreements that were known about at the time of liquidation. With the above in mind, I am satisfied that B was not carrying out investments as per the agreements with investors such as Mr G. I’ve seen no evidence to suggest Mr G had security over a specific vehicle and as it has been found B’s linked company only had around 60 charges registered on Companies House, of which Mr G wasn’t listed. So, I think it’s unlikely he had security over one. The SFO has confirmed that the directors of B were accused of falsifying information to encourage people to pay in whilst knowing that the investments were not actually backed up by the cars they had promised. Having considered all of the information available from the FCA, the SFO and the administrators, I am satisfied that investors were dishonestly deceived into making their payments. And it follows that Mr G’s payment meets the CRM Code’s definition of an APP scam as set out above. Did Mr G have a reasonable basis for belief that the investment was legitimate? As explained previously, the starting point in law is that Mr G is responsible for any payments he authorised. But the CRM Code requires a firm to reimburse victims of APP scams that fall under its provisions, unless a firm can demonstrate that one of the exceptions to reimbursement apply. One such exception is if Mr G made the payments without a reasonable basis to believe they were for a genuine investment or that B was not legitimate.

-- 3 of 4 --

From what I’ve seen, the documents Mr G received from B prior to investing all appeared reasonably professional and looked to be legitimate. His understanding of the investment itself and how it would work did not sound unreasonable and there was nothing to suggest at the time that B itself was not legitimate, and I note one of its connected companies was authorised and regulated by the FCA. With this in mind I don’t think there was anything about the investment at that time that should have given Mr G cause for concern. So, I don’t think it has been established that he made the payments without a reasonable basis to believe the investment and/or B was legitimate. Could HSBC have prevented the loss? Considering the sophistication of the scam, I don’t think that there was anything HSBC could have done to prevent Mr G’s loss before it happened – if it had contacted him about the payment, he would have told it what he was investing in and the purpose of the transaction – and I don’t think that HSBC would have been able to identify that he was being scammed at the time. Further to this, I also don’t think there was anything that HSBC could have done to recover the loss Mr G, as by the time the scam was reported to it, B had already gone into liquidation, and no funds could have been returned. Putting things right The CRM code allows firms 15 days to make a decision after the outcome of an investigation is known. I therefore think HSBC should have responded to Mr G’s claim and refunded his losses under the CRM code within 15 days of the SFO publishing the outcome of its investigation. And so, I think HSBC should now pay 8% interest on the refund, from 15 days after the SFO published its outcome on 19 January 2024, until the date of settlement. As the car leasing company is now under the control of administrators, it’s possible Mr G may recover some further funds in the future. So, if it wishes, I don’t think it would be unreasonable for HSBC to request Mr G to complete an indemnity confirming he’ll return any funds recovered in future to HSBC. But this will be for it to arrange separately from the settlement of this complaint. So, HSBC should • Refund Mr G the payment he made as a result of this scam • Pay Mr G 8% interest on that refund, from 15 days after 19 January 2024 until the date of settlement (less any lawfully deductible tax) My final decision I uphold this complaint. HSBC UK Bank Plc should put things right as set out above. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr G to accept or reject my decision before 26 February 2026. Claire Pugh Ombudsman

-- 4 of 4 --