HSBC UK Bank Plc · DRN-6016844

The complaint Mr C complains about ATM withdrawals that took place on his account with HSBC UK Bank Plc which he says he didn’t make or authorise. What happened Mr C says he left the UK around 2020 and had an account with HSBC that he didn’t use. Between 26 March 2025 and 22 April 2025 cash machine withdrawals took place totalling £10,160 which he says he didn’t make or authorise. Mr C says someone impersonated him and contacted HSBC to order a new debit card to his old address. Mr C says it was only by chance that he discovered the fraud after regaining access to his online banking. HSBC provided Mr C with a complete refund of the disputed transactions totalling £10,160. A compensation payment of £75 was also credited to Mr C’s account for a customer service error. Once the complaint was at our service HSBC also offered to pay Mr C interest of 8% from the date of the first withdrawal up to the date of the offer, totalling £337.97. Our investigator said whoever called HSBC to order a new debit card and change some of Mr C’s personal details did so over the phone and would’ve had Mr C’s telephone banking security details to do this, but it’s unclear how they had this information. Our investigator was satisfied the transactions were chip and PIN verified. He confirmed there was no evidence to suggest a new PIN was issued during this time and that it had stayed the same since 2016, meaning that whoever had access to Mr C’s telephone banking security details, also knew his PIN from 2016. Although Mr C was very unhappy that he’d been locked out of his account and had to go through security, our investigator didn’t think this was unreasonable. He also noted Mr C said the account was dormant so he didn’t think it would have been a huge inconvenience for him not to have had access to it. Mr C thought the account activity was unusual that it should have triggered the bank’s system that something was amiss. But our investigator said given that his personal details had been changed, it’s unclear whether HSBC would have spoken to Mr C even if HSBC’s systems had triggered. Our investigator concluded HSBC’s offer was fair. Mr C didn’t agree. He said he didn’t use or request the card; that HSBC should have been on notice to what was happening; that he was locked out of the account for the entire period and had reported the fraud as soon as he discovered it. He also said it was a stressful experience given the large sum of money involved. Mr C was unhappy the burden has fallen on him to detect the fraud and to escalate to HSBC. As Mr C didn’t agree, the complaint has been passed to me to consider.

-- 1 of 3 --

What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. It seems to me that HSBC have accepted it may not have been Mr C or someone acting on his behalf who carried out the disputed transactions as they have already provided him with a refund for the full amount. My decision therefore has not focused on whether or not I think Mr C should be held liable for these transactions as that has already been dealt with. HSBC has offered to pay interest of 8% from the date of the transactions until the date the offer was made, totalling £337.97 Given that HSBC has provided Mr C with a refund of the transactions, I think it’s fair HSBC have also offered to refund the interest. Mr C’s complaint points Mr C raised a number of complaint points following our investigator’s opinion. It’s important to explain I’ve considered everything he’s said in reaching my decision. But if I’ve not answered something that’s been said it’s not because I didn’t see it, it’s because I didn’t deem it relevant to the crux of the complaint. This isn’t to be discourteous, but merely to reflect my informal role in deciding what a fair and reasonable outcome is. Mr C has said he didn’t request or use the card that was ordered in March 2025. Given that HSBC have provided Mr C with a full refund for the transactions that took place, I can infer that HSBC have accepted it may not have been Mr C who requested or used the cards which allowed the transactions to take place. Mr C has also said that he reported the fraud as soon as he was aware. But again, given HSBC have provided him with a full refund of the disputed transactions, this point doesn’t seem to be in contention. Mr C has said he was locked out of the account for the entire fraud window. He said he lost access in mid-2025 which may have been due to an expired or deactivated digital secure key and was then asked to complete a full verification process at the end of May/early June. I do not think it was unreasonable that HSBC asked Mr C to go through verification as they needed to be certain it was genuinely Mr C trying to access his account. And it seems within about a month of being asked to do this, he gained access to his account. Mr C says there were a number of ‘warning signs’ for example a changed email address, use of a PIN from 2016 and an absence of fraud alerts. As explained above whoever contacted HSBC seemed to have Mr C’s telephone banking details and was able to pass security which enabled the email address to be updated. Given that security had been passed, I don’t think it was unreasonable for HSBC to accept the change of email address and not flag this as fraud. I also don’t think it’s reasonable to say in these circumstances that a use of the same PIN from 2016 would trigger anything on HSBC’s system. In fact, the continued use of the same PIN is a stronger argument to suggest nothing was untoward at the time. I say this because despite a new card being ordered, whoever had the card was already aware of the existing PIN and didn’t need to request a new one to use the card. It’s unclear how this third party came to be aware of Mr C’s PIN, considering he should be the only person who knows it, but

-- 2 of 3 --

nonetheless, I don’t think the continued use of the same PIN ought to have prompted HSBC to do anything differently. Mr C is unhappy about the absence of fraud alerts. But as our investigator pointed out, even if HSBC had acted based on the account activity, it’s possible they wouldn’t have spoken to Mr C as it appears some of his personal details including his email address and telephone number had been changed. And in any event, HSBC have refunded Mr C for all of the transactions which he says he didn’t make or authorise. Therefore, he’s been placed back into the position he would have been in, had the alleged fraud not occurred. In his complaint correspondence Mr C has said this was a very stressful time for him given the amount of money involved. I do not doubt Mr C was anxious to find out what was happening and whether he’d receive a refund from HSBC. But based on the evidence I have, I don’t think HSBC have done anything wrong in terms of issuing the cards as whoever called up was able to pass security. Given that the disputed transactions were all made in a UK ATM, I’m satisfied it’s more likely than not that Mr C’s PIN would have been entered successfully. So, it follows that I don’t think HSBC did anything wrong in approving the transactions when Mr C’s card and correct PIN had been entered. Mr C is unhappy that the burden has fallen on him to detect the fraud and escalate it to HSBC. Although I accept Mr C’s complaint may have taken time and effort to raise, this is something I’d expect to see. As the account owner, the onus would be on him to monitor his account and to report any unauthorised transactions promptly. I therefore do not agree that any additional compensation is warranted here. I do note Mr C was provided with £75 because HSBC incorrectly stated how long it would take to investigate his complaint. I do think this would have been a minor inconvenience for Mr C but in any event, HSBC has been more than generous in awarding compensation of £75 to reflect any distress or inconvenience this may have caused. My final decision HSBC has already refunded the disputed transactions in full and paid compensation of £75. HSBC have made an offer to pay 8% interest to settle the complaint, and I think this offer is fair in all the circumstances. So, my decision is that HSBC should pay £337.97. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr C to accept or reject my decision before 2 April 2026. Marie Camenzuli Ombudsman

-- 3 of 3 --