HSBC UK Bank Plc · DRN-5861528

The complaint Mrs M complains that HSBC UK Bank Plc (“HSBC”) won’t refund the money she lost to a scam. What happened The background is known to both parties, so I won’t repeat all the details. In summary, Mrs M was looking online to book a family holiday when she came across a company I’ll refer to as “C”. She called the number provided, and the person she spoke with described a package holiday, offering what appeared to be a good deal for around £5,931. Believing that the offer was genuine – C seems to have been a clone of a legitimate travel agent – Mrs M went ahead and paid for the ‘holiday’. She was told that once her payment had been processed, she’d receive all the details by email. However, when nothing arrived, she became concerned. Things escalated when C later contacted her again asking for her credit card details and attempted to take more money. At that point, Mrs M told C she wished to cancel the booking and wanted a refund. When she was unable to reach C again, she realised she had been scammed and called HSBC to report what had happened. In May 2025, HSBC responded to Mrs M’s fraud claim and said it wouldn’t reimburse her because the payment had been authorised. In June 2025, HSBC issued its final response, saying it had followed her instructions when making the payment and that it couldn’t cancel or recall it once authorised. When the complaint was referred to our Service, HSBC offered £200 in recognition of the poor service Mrs M received when she reported the scam. Our Investigator reviewed the case. In short, he concluded that although Mrs M had been the victim of a scam, the payment was authorised, and HSBC hadn’t acted incorrectly in processing it. He also didn’t think HSBC was required to freeze interest or charges on the credit card balance, nor did he think a chargeback or section 75 claim had any realistic prospect of success. He said HSBC’s offer of £200 for the service issues was fair. As the matter couldn’t be resolved informally, it’s been passed to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, I’ve reached the same conclusions as the Investigator. Mrs M will understandably be disappointed, but these are the key reasons for my decision. Authorisation In broad terms, the law requires HSBC to process payments and withdrawals a customer authorises, in line with the Payment Services Regulations (2017) and the terms and conditions of the customer’s account. In this case, it isn’t disputed that Mrs M authorised the payment — she has explained she made it believing she was booking a genuine holiday.

-- 1 of 3 --

This means that, at least initially, Mrs M is considered responsible for the loss, even though she was the innocent victim of a scam. And while I appreciate her point that she didn’t give what she considers “genuine consent”, under the PSRs, consent is given when a customer completes the steps required to make a payment. In that context, the fact she was tricked by a scammer as to the circumstances isn’t relevant to whether the payment was authorised. Prevention Taking into account relevant law, regulatory rules, industry guidance, and what I consider to be good practice at the time, HSBC should be alert to possible fraud and, in some situations, carry out extra checks. However, in this case, I don’t think the payment was so unusual that HSBC should have intervened before processing it. Firms need to balance detecting scams with allowing legitimate payments to go through without unnecessary delays. I don’t think HSBC got that balance wrong here – considering, for example, the payment value and earlier activity on the account. The payment was also to a genuine merchant. And, as I wouldn’t have expected HSBC to have warned Mrs M directly about it, I can’t reasonably conclude that it should have known Mrs M was dealing with a fraudulent third-party. The Contingent Reimbursement Model (CRM) Code I note that Mrs H has referred to the CRM Code when saying HSBC failed to act in line with relevant industry standards. However, the CRM Code wasn’t in force at the time she made her payment. It had already been replaced, in October 2024, by the Faster Payment Scheme (FPS) Reimbursement Rules for authorised push payment (APP) scams. Neither the CRM Code nor the FPS rules apply to card payments. So I don’t think it was unfair for HSBC not to consider reimbursement under those provisions. Although, as noted above, I would still have expected HSBC to remain alert to signs of a heightened fraud risk. Recovery I’m satisfied there was little HSBC could have done to recover the money. Once a card payment is authorised, it can’t be cancelled. And neither a chargeback nor a section 75 claim is likely to have succeeded. The genuine merchant likely provided the services (such as booking tickets) for someone, even if not for Mrs M, and section 75 doesn’t apply because Mrs M had no contractual relationship with the merchant. The “misrepresentation by the supplier” Mrs M has referred to, came from the scammer not the genuine merchant. Service issues Mrs M is unhappy with the service she received when she reported the fraud, and I agree there were failings on HSBC’s part. She experienced long waits, was transferred multiple times, had to repeat her story, and was asked to contact the scammer for evidence even though she had been clear she was the victim of fraud. I don’t doubt this added significant stress during an already difficult time. However, taking everything into account – including how long the issues lasted and the fact that much of her distress arose from the scam itself – I think HSBC’s offer of £200 is fair compensation for this part of the complaint. I’m also mindful of Mrs M’s comments about how hard she worked for her money and that all this started with the hope of a family holiday. I understand the scam has affected her deeply and I appreciate why she feels it was particularly unfair that interest continued to accrue on her credit card balance. While I don’t think it was wrong of HSBC not to refund or suspend interest that is applied under the account terms—and so I won’t be asking it to do so here— firms are expected to act positively and sympathetically when a consumer is in financial difficulty. And, with that in mind, I would expect HSBC to consider this carefully should Mrs M

-- 2 of 3 --

require support because of a change in her circumstances. My final decision My final decision is that HSBC UK Bank Plc needs to pay Mrs M £200 in recognition of the service it provided. Under the rules of the Financial Ombudsman Service, I’m required to ask Mrs M to accept or reject my decision before 20 March 2026. Thomas Cardia Ombudsman

-- 3 of 3 --