Santander UK Plc · DRN-6066979

The complaint Ms E complains that Santander UK Plc did not reimburse the funds she lost to a scam. What happened Both parties are aware of the circumstances of the complaint so I won’t repeat them again in detail here. In summary, Ms E was cold called by an individual I will refer to as ‘A’ who claimed to be a broker who could help her invest. They built up a friendship over an extended period of time and Ms E did invest in some legitimate companies A introduced her to. A advised Ms E of a way she could invest that was low risk. He introduced her to a number of his friends from university who were running various businesses, and he recommended Ms E invest directly in their businesses via loans, which she would receive monthly instalments back on with interest. She initially made payments from a third-party account in her name. Ms E went on to make the following payments from her Santander account totalling £162,500: Date Amount 07/09/2022 £12,500 22/09/2022 £7,500 17/10/2022 £15,000 04/11/2022 £25,000 21/12/2022 £12,500 12/01/2023 £10,000 13/01/2023 £10,000 20/02/2023 £10,000 13/06/2023 £20,000 14/06/2023 £20,000 09/08/2023 £20,000 She did receive back a number of returns, which on the Santander account amounted to £91,043.51. In December 2023, Santander had concerns about a further loan payment Ms E attempted to make and referred her to the branch for additional checks. The branch staff invoked the banking protocol and the police were called to speak with Ms E, however she did not initially have concerns about the payments she had made. Soon after, A said he was unable to make the repayments he had promised, and this made Ms E think she may be the victim of a scam. She spoke with the police again about the issue and they began investigating A and his business.

-- 1 of 7 --

Ms E eventually raised a scam claim with Santander, and initially only mentioned payments she made to one particular business. Santander said they felt this was a civil dispute, as Ms E appeared to know A and considering the amount of returns she received, it was more likely this was a genuine investment that failed. Ms E referred the complaint to our service and our Investigator looked into it. They were satisfied Ms E had fallen victim to a scam, and that the payments were covered under the Lending Standards Board’s Contingent Reimbursement Model (“CRM”) Code. They did not think Santander had provided effective warnings for the payments as they should have done under the Code, but they also thought Ms E did not carry out any relevant checks on A before sending him and his friends significant sums of money. So, they thought liability should be shared with both parties and recommended a refund of 50% of the losses Ms E incurred. Following this, Ms E provided additional evidence about her circumstances at the time of the scam, including that she was lonely and suffering from depression when A first contacted her and she was taking medication for this. She also was quite isolated and felt A had taken advantage of this when he befriended her. I wrote to Santander informally to set out why I felt there was enough evidence to be satisfied a scam had occurred. However, Santander maintained that the level of returns received suggested this was a genuine investment between Ms E and A and there was a possibility Ms E could be in a position of betterment if we upheld this case. And they did not think the transactions would have appeared unusual considering the account history. I issued a provisional decision in which I reiterated that I felt there was enough evidence to be satisfied a scam had occurred, and that I felt Ms E’s specific vulnerabilities at the time made her more susceptible to the scam. I therefore recommended a full refund under the CRM Code. My provisional decision read as follows: It isn’t in dispute that Ms E authorised the payments outlined above. Because of this the starting position – in line with the Payment Services Regulations 2017 – is that she’s liable for the transactions. But she says that she has been the victim of an authorised push payment (APP) scam. Santander has signed up to the voluntary CRM Code, which provides additional protection to scam victims. Under the CRM Code, the starting principle is that a firm should reimburse a customer who is the victim of an APP scam (except in limited circumstances). But the CRM Code only applies if the definition of an APP scam, as set out in it, is met. I have set this definition out below: ...a transfer of funds executed across Faster Payments…where: (i) The Customer intended to transfer funds to another person, but was instead deceived into transferring the funds to a different person; or (ii) The Customer transferred funds to another person for what they believed were legitimate purposes but which were in fact fraudulent. The CRM Code is also explicit that it doesn’t apply to private civil disputes. The wording in the code is as follows: “This Code does not apply to: b) private civil disputes, such as where a Customer has paid a legitimate supplier for goods, services, or digital content but has not received them, they are defective in some way, or the Customer is otherwise dissatisfied with the supplier.” I’ve therefore considered whether the payments Ms E made to A and his associates fall under the scope of an APP scam as set out above. Having done so, think that they do. I’ll explain why in more detail.

-- 2 of 7 --

In order to determine if Ms E has been the victim of a scam, I have to consider if her intended purpose for the payments was legitimate, whether the intended purposes she and the individuals she paid were broadly aligned and, if not, whether this was the result of dishonest deception on the part of the individuals she paid. Was Ms E’s purpose for the payments legitimate? Ms E has provided a number of agreements between herself and the various entities she lent funds to, each one setting out basic information such as the amount of the loan, the end date and the expected interest rate, as well as some other general provisions. Ms E has said she understood she was lending the various companies funds so they could grow as businesses, and she thought these would be safer investments as A knew the individuals personally. Based on this evidence, I think it is more likely Ms E’s purpose for the payments was legitimate. Did Ms E and the payee’s purpose for the payments align? I have reviewed the receiving bank statements for the companies and individuals Ms E paid; on the understanding she was investing in those companies/individuals to help them grow. However, when her individual funds are followed, I can see the majority of them were quickly transferred out to the same personal account, in the name of a separate individual, who appears to be the director of the company Ms E sent the majority of the funds to, which I will refer to as ‘D’. From this personal account, the majority of the funds were forwarded to a trading platform known for spread betting and CFD trading. The rest of the funds were either forwarded to the other accounts Ms E lent funds to which were then used to give her monthly returns, were sent to another individual that also appears to have loaned A and his associates funds who is potentially another victim of the scheme or went to what appears to be a property management company. I therefore think Ms E’s funds were mostly used to either trade with, went back to Ms E to pay returns for her own loans, to another individual who appears to have made similar loans, or pay what looks like property management fees. It should be noted that A himself has admitted to Ms E that he traded with her funds and is unable to fully repay her now. Having considered the receiving bank information across all of the accounts Ms E paid, I therefore think that A’s purpose for the funds did not align with Ms E’s. There is a clear disconnect between what she thought the funds would be used for and where they ended up. Her intention was to assist small businesses with loans and get a return on what she felt was a safer investment. Instead, the majority of her funds have either been lost to trading or used to repay her own loans. What this misalignment due to dishonest deception? From what I have seen, I think there is compelling evidence that the mismatch between Ms E’s understanding of what the funds would be used for and what A went on to use them for is due to dishonest deception on A’s part. Firstly, Ms E has provided an e-mail chain between herself and the individual who says he is the director of D, from an e-mail address in the name of the business D. For simplicity I will refer to the director of D as ‘X’. This back and forth occurred over six e-mails over the course of around a month in early 2024. The final e-mail comes from A’s personal e-mail address, but the subject matter follows on from the earlier e-mails from X and the sign off is in X’s name. It therefore appears A forgot to sign out of his personal e-mail address before responding to Ms E. This suggests to me that A and X are, in fact, the same person and A has been misleading Ms E about his actual identity. In addition to this, I can see that the majority of the funds were funnelled through the various accounts Ms E paid and ended up in a personal account in X’s name. Ms E also confirmed that the director of the brokerage firm A worked for also confirmed A was not his real name

-- 3 of 7 --

and he was in fact X. Ms E has provided an e-mail from the director of the brokerage firm in which he says that the loan she provided the firm immediately went out to X’s personal account. On balance, I think it is more likely A is a pseudonym and that the individual Ms E had been conversing with was actually X, the director of D. D also happened to be the company Ms E lent the majority of the funds to. I therefore think there was dishonest deception on the part of X who I think was ultimately the individual orchestrating the scam as a whole. I say this because he built a relationship with Ms E using a fake name and went on to fabricate loans to various businesses and individuals before using the majority of her funds to trade with instead. I have reviewed the receiving bank statements of all the accounts Ms E paid, but I will focus on D’s account as Santander has specifically mentioned there is no negative information online about D and it has been actively trading since 2018, so they think D is a legitimate company that Ms E invested in. Due to data protection issues, I cannot go into detail about what the receiving bank information shows for D’s account. The account provider has confirmed they had significant concerns about the account and the way it was run, specifically that it was not acting as a genuine business account should. Their findings support the likelihood that X was operating a scam operation, and I am satisfied Ms E’s funds were not used in the way she expected them to. I do understand Ms E received a significant amount of returns and this therefore does not look like a typical investment scam. But ultimately, I think it is more likely these were maintained in order to persuade her the lending she was making was legitimate and ensure she continued to lend funds to X via the various businesses he and his friends owned. It was only when a further payment she was about to make to the scam was stopped by Santander in late 2023 and she did not make more that these repayments started to falter and be missed. And I think it is more likely the repayments became difficult as X could no longer use Ms E’s own funds to make the repayments that she was due. I do appreciate that these repayments did continue through to as late as mid-2025, but on balance I think it is more likely these continued to try and deter Ms E from pursuing the matter further with the banks and police. Finally, I also have to consider Santander themselves thought this was a scam and invoked banking protocol in December 2023 which ultimately led to the scam being unravelled in the months after this. Based on everything I have seen so far, I currently think I have seen enough to be satisfied Ms E fell victim to an APP scam as set out in the CRM Code. Considering the payments under the Code The CRM Code requires firms to assess whether a customer was vulnerable to the APP scam they fell victim to at the time it occurred. The relevant sections state: “A Customer is vulnerable to APP scams if it would not be reasonable to expect that Customer to have protected themselves, at the time of becoming victim of an APP scam, against that particular APP scam, to the extent of the impact they suffered. This should be assessed on a case-by-case basis. In these circumstances, the Customer should be reimbursed notwithstanding the provisions in R2(1), and whether or not the Firm had previously identified the Customer as vulnerable. […] Factors to consider include: (a) All Customers can be vulnerable to APP scams and vulnerability is dynamic. The reasons for dynamics of vulnerability may include: the personal circumstances of the

-- 4 of 7 --

Customer; the timing and nature of the APP scam itself; the capacity the Customer had to protect themselves; and the impact of the APP scam on that Customer (b) A Customer’s personal circumstances which lead to vulnerability are varied, may be temporary or permanent, and may vary in severity over time (c) APP scams may include long-running APP scams or in the moment APP scams.” In this case Ms E has stated she was first contacted by X, posing as A, in around 2017/2018. This was initially a professional relationship but X soon befriended Ms E and spoke with her regularly about his life, relationships, family and personal difficulties. While she made some genuine investments that he introduced her to earlier on, she only started making the direct loans involved in the scam in 2021. Ms E says that at that time, she was suffering from depression and was taking medication prescribed by the doctor for this and she has said she was lonely and felt isolated. As a result of her depression, she neglected her own personal hygiene as well as the upkeep of her house. This led not only to unsanitary conditions but also meant repairs were not carried out when needed. Ms E has stated that during this time, X, posing as A, was her only ‘friend’. Her situation only worsened during the lockdowns of COVID-19 and her medication for depression was slowly increased. At the time she started to make the payments to the scam, she was 69 years old and while this does not put her into the category of ‘older-old’, it does mean she was retired and generally more isolated than she had been previously. The fact that X spoke with Ms E for some time before asking her to invest in his friends’ businesses as a cover to trade with her funds suggests to me that he was most likely building a trusting relationship with her. Seeing as they spoke regularly and spoke of their lives, I think it is likely X recognised Ms E was lonely and vulnerable and not in a strong mental state and I think he used this to take advantage of her and convinced her to invest in people he said he trusted. I am also aware that this complaint was referred to our service via the police and they stated in that referral that Ms E was very vulnerable at the time the scam unfolded. As mentioned previously, Ms E had been quite isolated and I think the combination of her age, mental state and loneliness meant she was more susceptible to this specific kind of socially engineered scam, and I don’t think it would be reasonable to expect her to protect herself against the APP scam she fell victim to. I therefore think Santander is responsible for reimbursing Ms E for her losses due to the scam, under the provisions of the CRM Code. Police Investigation Santander has said that a final decision is premature while a police investigation is ongoing and they have concerns that if a prosecution is made, Ms E could be in a position of betterment if funds are recovered. There may be circumstances and cases where it’s appropriate to wait for the outcome of external investigations and/or related court cases. But that isn’t necessarily so in every case, as it may be possible to reach conclusions on the main issues on the basis of evidence already available. And it may be that the investigations or proceedings aren’t looking at quite the same issues or doing so in the most helpful way. I’m conscious, for example, that any criminal proceedings that may ultimately take place might concern charges that don’t have much bearing on the issues in this complaint; and, even if the prosecution were relevant, any outcome other than a conviction might be little help in resolving this complaint because the Crown would have to satisfy a higher standard of proof (beyond reasonable doubt) than I’m required to apply (which is the balance of probabilities). I’m aware that Ms E first raised her claim with Santander in April 2024 and I need to bear in mind that this service exists for the purpose of resolving complaints quickly and with minimum formality. With that in mind, I don’t think delaying giving Ms E an answer for an unspecified length of time would be appropriate unless truly justified. And, as a general rule,

-- 5 of 7 --

I’d not be inclined to think it fair to the parties to a complaint to put off my decision unless, bearing in mind the evidence already available to me, a postponement is likely to help significantly when it comes to deciding the issues. For the reasons I have set out in detail above, I don’t think it’s necessary to wait for me to fairly reach a decision on whether Santander should reimburse Ms E under the provisions of the CRM Code. I say this because in view of the evidence already available to me, I don’t currently consider it likely that postponing my decision would help significantly in deciding the issues. As there is an ongoing investigation, it’s possible Ms E may recover some further funds in the future. In order to avoid the risk of double recovery, Santander is entitled to take, if it wishes, an assignment of the rights to all future recoveries as a result of a criminal investigation. If the bank elects to take an assignment of rights before paying compensation, it must first provide a draft of the assignment to Ms E for her consideration and agreement. Redress Based on what I have seen so far, I am currently of the opinion that Santander should reimburse Ms E her losses in full. However, I am aware that Ms E did receive returns as part of the scam, and these were largely spread across two main current accounts she held (one of which was Santander) as well as two smaller payments to two separate current accounts she had with other banks. As these were general returns and given Ms E was falling victim to a scam and her ‘investment’ wasn’t genuine, I don’t think these ‘returns’ should be attributed to any specific payment. Instead, I think this money should be deducted from the amount lost by apportioning it proportionately across all of the payments Ms E made to the scam. This ensures that these credits are fairly distributed. To work this out, Santander should take into account all of the payments Ms E made to the scam (including those from other businesses), which I’ve set out in a separate spreadsheet which I have attached to this decision. In this case, the ‘profit/returns’ received equals £119,333.52 and the total amount paid to the scam equals £247,499. Santander should divide the ‘profits/returns’ by the total amount paid to the scam. This gives the percentage of the loss that was received in ‘profits/returns’. Deducting that same percentage from the value of each payment gives the amount that should be reimbursed for each payment. Here the ‘profit/returns’ amount to 48.22% of the total paid to the scam. It follows that the outstanding loss from each payment should be reduced by the same percentage. That means Santander should reimburse 48% of each payment. Please note that, for ease of reading, I’ve rounded the relevant percentages down to two decimal places, but Santander should perform the calculation I’ve set out above to arrive at a more precise figure, as I have done to arrive at the figure below. After taking the steps set out above, I calculate the Ms E’s outstanding loss from these payments to be £84,149.39. Ms E responded and accepted my provisional findings. Santander initially responded and asked to see some of the evidence we had relied upon. I forwarded the relevant evidence we were able to share, and they then asked for additional information about the vulnerabilities mentioned in my provisional decision. I sent Santander an outline of what Ms E had sent to our service in which she detailed her circumstances at the time of the scam and just before it, which included the relevant vulnerabilities. I asked for any responses to be sent to me before 31 December 2025 but did not receive any additional comments.

-- 6 of 7 --

What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having carefully reviewed all of the evidence, as well as the additional comments made by Santander, I am still of the opinion that Ms E has been the victim of a scam as defined by the CRM Code, and that she was more susceptible to this specific scam due to her particular circumstances and vulnerabilities at that time. I think that A specifically preyed on Ms E’s loneliness and isolation at the time and that her worsening depression contributed to her trusting A and falling victim to this social engineering scam. I therefore think that Santander are responsible for reimbursing Ms E with the losses incurred under the scam. I have set out the redress above and have calculated it at £84,149.39. Santander should also include 8% simple interest from the date it declined Ms E’s claim to the date of settlement. My final decision I uphold Ms E’s complaint in full against Santander UK Plc and direct it settle the complaint as I’ve set out below. • I direct Santander UK Plc to pay Ms E £84,149.39 – which is based on payments made towards the scam and proportionate deductions for returns received. • Santander UK Plc also needs to pay 8% simple interest from the date it declined Ms E’s claim to the date of settlement. Under the rules of the Financial Ombudsman Service, I’m required to ask Ms E to accept or reject my decision before 6 February 2026. Rebecca Norris Ombudsman

-- 7 of 7 --