HSBC UK Bank Plc · DRN-6236572

The complaint Mr M complains that HSBC UK Bank Plc are refusing to refund him the amount he lost as the result of a scam. Mr M is represented by a firm I will call “C” but for ease I will refer to Mr M throughout. What happened Between January and April 2025, Mr M lost over £28,000 to what he believed was a genuine investment opportunity he had found via social media. Prior to sending the payments, Mr M undertook background checks on the company. This involved researching the company online, where he found a range of mixed reviews. Seeing both positive and negative feedback reinforced Mr M’s belief that the company was legitimate, as genuine businesses often receive a mix of reviews due to differing customer experiences. Additionally, Mr M checked several scam spotter websites, but found no reference to the company, further supporting his impression that it was legitimate. It was only when Mr M was told he would need to pay fees in order to retrieve any funds that he realised he had been scammed. Mr M complained to HSBC who said the funds were initially transferred to accounts in Mr M’s name which he had full access and control over. They said Mr M assured them during a call that he wasn’t being assisted by a third party, and that the payments also weren’t considered to be unusual based on his previous account activity. Our investigator looked into the complaint and was of the view that while HSBC should have intervened more, it wouldn’t have prevented Mr M’s loss because when they did intervene, Mr M provided misleading information meaning they weren’t able to uncover the scam. Mr M disagreed and so the case has been passed to me for a final decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I’m very aware that I’ve summarised this complaint briefly, in less detail than has been provided, and in my own words. No discourtesy is intended by this. Instead, I’ve focussed on what I think is the heart of the matter here. If there’s something I’ve not mentioned, it isn’t because I’ve ignored it. I haven’t. I’m satisfied I don’t need to comment on every individual point or argument to be able to reach what I think is the right outcome. Our rules allow me to do this, and it simply reflects the informal nature of our service as a free alternative to the courts. When deciding what’s fair and reasonable in all the circumstances of a complaint, I’m required to take into account relevant law and regulations; regulators’ rules, guidance and standards; codes of practice; and, where appropriate, what I consider to be good industry practice at the time.

-- 1 of 4 --

Where the evidence is incomplete or missing, I am required to make my findings based on the balance of probabilities. In other words, what I consider is most likely to have happened given the information available to me. As a starting point in this case, Mr M doesn’t dispute that the payments were made in line with his instruction to HSBC to make them. In broad terms, the starting position at law is that a firm such as HSBC is expected to process payments and withdrawals that a customer authorises them to make, in accordance with the Payment Services Regulations (in this case the 2017 regulations) and the terms and conditions of the customer’s account. That means in the first instance Mr M is presumed liable for the payments. HSBC would not ordinarily have any responsibility for a loss incurred through the payments – provided they carried out the instructions correctly. And here, there is nothing that leads me to believe they didn’t do so. I’m really sorry that Mr M has lost such a large sum of money, but this doesn’t automatically entitle him to a refund. It would only be fair for me to tell HSBC to reimburse Mr M if I thought they reasonably ought to have prevented the payments, or they unreasonably hindered recovery of the funds. Prevention Businesses have various and long-standing obligations to be on alert for fraud and scams and to act in their customers’ best interests. So, a first consideration in determining HSBC’s obligations here would normally be: should they ought reasonably to have held any suspicions or concerns in relation to the payments, and if so, what might have been expected from a proportionate intervention. In this case, I’m satisfied Mr M authorised the relevant payments, and as explained above, HSBC would generally be expected to process payments a customer authorises them to make. That said, as a matter of good industry practice, they should have taken proactive steps to identify and help prevent transactions – particularly sufficiently unusual, uncharacteristic or suspicious transactions – that could involve fraud or be the result of a scam. However, there are many payments made by customers each day and it’s not realistic or reasonable to expect a business to stop and check every payment instruction. There’s a balance to be struck between identifying payments that could potentially be fraudulent and minimising disruption to legitimate payments. In this case, I can see that of the seven transactions made to the cryptocurrency account, two were stopped which totalled £4,000. The other five payments were of low value or of a value that would not be deemed as unusual, and the rest of the payments were made to another account in Mr M’s name. Payment six was stopped and a phone call was needed, as it would have breached the maximum amount HSBC allows for the purchase of cryptocurrency in each 24-hour period. HSBC also explained that Mr M had used cryptocurrency providers regularly in the past, meaning the transactions wouldn’t have been considered unusual. So overall, considering the intervention that took place, I don’t find it unreasonable that HSBC let the payments go through given the answers that were provided, however I do still feel they could have intervened further down the line. Losses to cryptocurrency fraud reached record levels in 2022 and, by the end of 2022, many high street banks had placed restrictions or additional friction on cryptocurrency purchases owing to the elevated fraud risk. So, by February 2025, when these payments took place, I think that HSBC should have recognised that payments to cryptocurrency carried a higher risk of being associated with fraud.

-- 2 of 4 --

But for me to find it reasonable that HSBC should refund the payments requires more than me finding that they should have intervened/probed further. This is because legitimate payments can also be large, which doesn’t always mean the money is being lost to fraud or a scam. For me to ask HSBC to refund the payments, I would need to be satisfied that not only did they fail to intervene sufficiently, but had they intervened in a way that we would expect, the loss would have been avoided. So, as I have touched on above, I have thought about whether appropriate further intervention or further questioning would likely have made a difference. Ultimately, I don’t think any further intervention by HSBC would have made a difference or prevented the payments from being made here. I will explain why. The investment wasn’t one that HSBC were recommending or endorsing. Their role was to make the payments that Mr M asked them to make, as he had already made the decision to take part in the opportunity, based on what he had been told and the research he had carried out before making the payments. As mentioned above, I can see that HSBC did intervene on some of the payments made. They provided a written warning for one payment which Mr M proceeded with, and then spoke to Mr M on the phone for another payment made a few days later. During the call, Mr M said he had credited and debited money from the account without any issue and he had opened it a month prior. Mr M said he wasn’t being helped by anyone, had full access to the account and no remote access software had been downloaded. Based on the information given, HSBC released the payment and didn’t intervene any further. It is also worth noting that Mr M looks to have been heavily influenced by the scammer. I have read through the conversations that took place and can see that Mr M placed a high level of trust in the scammer and followed their instruction. Mr M followed the scammer’s guidance on how to make the payments, and made sure he always waited for the scammer’s guidance before doing anything, sending screenshots of what he was doing. Mr M also told the scammer that HSBC restricted payments to one cryptocurrency platform and because of this, he was transferring to another as there were fewer restrictions. I therefore find it most likely that even if HSBC had intervened further, Mr M would have proceeded with the payments, and even if they had stopped the payments he was making, I believe it is most likely he would have found another way to make them. So having considered everything in detail, while I believe HSBC could have possibly done more, I’m not persuaded they were at fault for carrying out the relevant payment instructions, or for not preventing Mr M from making the payments. I say this as I don’t believe any further intervention would have made a difference, given the level of control the scammer held over Mr M, and the lengths he went to in order to get the payments through with HSBC. Vulnerability I’m sorry to hear of the vulnerabilities Mr M was experiencing at the time this scam took place. I want to assure him that I have taken the information provided very seriously. When we consider vulnerability, we have to look at what the business would have known at the time the scam took place, and if they weren’t aware of any vulnerabilities, whether anything happened that should have raised concern. While I acknowledge that Mr M was vulnerable, I haven’t seen anything to suggest that HSBC were aware of his circumstances at the time, and I haven't seen anything which I believe should have raised any concern with them while he was completing the transactions. Because of this, I’m not able to say that HSBC should have done anything differently in relation to Mr M’s vulnerabilities. Recovery

-- 3 of 4 --

I’ve also looked at whether HSBC took the correct steps once Mr M contacted them to dispute the payments. I’m satisfied that they did what they could to recover the funds once they were aware of the scam. The payments were made to accounts in Mr M’s name meaning if any funds had remained, he would be able to access them. Having carefully considered everything overall, I don’t find that HSBC could have reasonably prevented the loss Mr M incurred. In saying this, I don’t underestimate the impact on Mr M as he has lost such a significant amount of money which has left him in a vulnerable position. I am really sorry he fell victim to such a cruel scam – he is not at fault here, the scammer is. However, it is simply the case that I don’t consider I can fairly and reasonably hold HSBC liable for his loss. My final decision My final decision is that I do not uphold this complaint. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr M to accept or reject my decision before 28 April 2026. Danielle Padden Ombudsman

-- 4 of 4 --