HSBC UK Bank Plc · DRN-5833388

The complaint Mr R complains that HSBC UK Bank Plc won’t refund the money he lost when he was the victim of what he feels was a scam. What happened In mid-2024, Mr R came across a property investment company on a social media website. The company claimed to be offering investments in specific property units on the understanding they would be refurbished and rented out for social housing through local councils and housing authorities they held contracts with. And after looking into the company and reading reviews from other people who had invested, Mr R decided to invest and made a payment from his HSBC account to the company. I’ve set out the payment Mr R made from his HSBC account to the property investment company below: Date Amount 1 June 2024 £13,500 Mr R initially received the returns he understood he would from the investment. But the payments then stopped and the property investment company stopped responding to his communication, so Mr R felt he had been the victim of a scam and reported the payment he had made to HSBC. HSBC investigated but didn’t agree to refund the payment Mr R had made. Mr R wasn’t satisfied with HSBC’s response, so referred a complaint to our service. One of our investigators looked at the complaint. They were satisfied the available evidence was sufficient to say Mr R had been the victim of a scam. And they didn’t think HSBC had established that it was entitled not to refund him. So they felt HSBC should refund the money Mr R had lost, in full. HSBC disagreed with our investigator, so the complaint has been passed to me. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In broad terms, the starting position at law is that a firm is expected to process payments and withdrawals that a customer authorises, in accordance with the Payment Services Regulations and the terms and conditions of the customer’s account. However, where the customer made the payment as a consequence of the actions of a fraudster, it may sometimes be fair and reasonable for the firm to reimburse the customer even though they authorised the payment. At the time of this payment, HSBC was a signatory of the Lending Standards Boards Contingent Reimbursement Model (the CRM code). This required firms to reimburse

-- 1 of 7 --

customers who had been the victim of certain types of scams, in all but a limited number of circumstances. But customers were only covered by the code where they had been the victim of a scam – as defined in the code. Is it appropriate to determine this complaint now? HSBC has argued that the property investment company and the payment Mr R made are the subject of an ongoing police investigation, and that the CRM code allows for it to wait for the outcome of this investigation before making a decision on whether to reimburse him. R3(1)(c) of the CRM code says: “If a case is subject to investigation by a statutory body and the outcome might reasonably inform the Firm’s decision, the Firm may wait for the outcome of the investigation before making a decision.” And there is an ongoing police investigation into the property investment company. So I’ve considered whether the outcome of this investigation is reasonably likely to impact HSBC’s reimbursement decision, and so whether it’s fair for it to rely on R3(1)(c) to delay making a decision on this case. There may be circumstances and cases where it’s appropriate to wait for the outcome of external investigations and/or related court cases. But that isn’t necessarily so in every case, as it may be possible to reach conclusions on the main issues on the basis of evidence already available. And it may be that the investigations or proceedings aren’t looking at quite the same issues or doing so in the most helpful way. I’m conscious, for example, that any criminal proceedings that may ultimately take place might concern charges that don’t have much bearing on the issues in this complaint; and, even if the prosecution were relevant, any outcome other than a conviction might be little help in resolving this complaint because the Crown would have to satisfy a higher standard of proof (beyond reasonable doubt) than I’m required to apply (which is the balance of probabilities). HSBC has also argued that our service shouldn’t consider this matter due to the complexity involved in determining whether the property investment company was a scam. But our service exists for the purpose of resolving complaints quickly and with minimum formality. With that in mind, I don’t think delaying giving Mr R an answer for an unspecified length of time would be appropriate unless truly justified. And, as a general rule, I’d not be inclined to think it fair to the parties to a complaint to put off my decision unless, bearing in mind the evidence already available to me, a postponement is likely to help significantly when it comes to deciding the issues. The Lending Standards Board has also said that the code does not require a criminal test to have been met before a reimbursement decision can be reached. Nor does it require a firm to prove the intent of the third party before a decision can be reached. So, for reasons I’ll explain in more detail below, I don’t think it’s necessary to wait for the outcome of any connected court case for me fairly to reach a decision on whether HSBC should reimburse Mr R under the provisions of the CRM code. I’m not persuaded that the outcome of the police investigation will impact HSBC’s reimbursement decision under the CRM code. And I’m satisfied there is already convincing evidence to demonstrate on the balance of probabilities that those who invested with the property investment company were dishonestly deceived about the purpose of the payments they were making and that Mr R was most likely the victim of a scam. This means his claim reasonably ought to have been assessed and it’s not necessary or reasonable for HSBC to rely on R3(1)(c) of the CRM code.

-- 2 of 7 --

Has Mr R been the victim of a scam, as defined in the CRM code? The relevant definition of a scam from the CRM code is that the customer transferred funds to another person for what they believed were legitimate purposes but were in fact fraudulent. The CRM code also says it doesn’t apply to private civil disputes, such as where a customer has paid a legitimate supplier for goods or services but has not received them, they are defective in some way, or the customer is otherwise dissatisfied with the supplier. So in order to determine whether Mr R has been the victim of a scam as defined in the CRM code I need to consider whether the purpose he intended for the payment was legitimate, whether the purposes he and the property investment company intended were broadly aligned and then, if they weren’t, whether this was the result of dishonest deception on the part of the company. From what I’ve seen and what he’s told us, I’m satisfied Mr R made the payment here with the intention of investing with the property investment company. He thought his funds would be used to fund the refurbishment and renting out of a specific property unit for social housing, and that he would receive payments in return. And I haven’t seen anything to suggest that Mr R didn’t think this was legitimate. But I think the evidence I’ve seen suggests the property investment company didn’t intend to act in line with the purpose for the payment it had agreed with Mr R. The property investment company held accounts which show around £6 million being spent in a way that appears consistent with property development. But it also received around £20.2 million from investors. Given the company’s standard unit price of £13,500, that means it would need to have entered around 1,500 property agreements. But the outgoing payments on the accounts aren’t consistent with the company paying for rent, refurbishments or furnishings for this many agreements. The property investment company also claimed to hold contracts with local authorities – as it would need to have done to fulfil the investor agreements. But its beneficiary statements show no incoming payments from local authorities or housing providers. Additionally, several local authorities have confirmed they didn’t have a working relationship with the property investment company – with one confirming an invoice the company used to supposedly demonstrate their working relationship was forged. One director of the property investment company was also removed from Companies House due to their identity being stolen, and had no connection to the company. And I think this speaks to a willingness by the company to dishonestly deceive. Our service has seen evidence that at least six different units were sold to multiple investors. This comes from complainants providing the individual property addresses they thought their investment was purchasing across around 100 complaints. This information also shows around half of those addresses were in buildings where the owners have confirmed they didn’t have a relationship with the property investment company. We’ve also seen instances where the properties remained derelict after the investment was made or remained under construction when they were supposedly generating an income. All of this makes it seem unlikely that the property investment company intended to use Mr R’s funds for genuine property development investments.

-- 3 of 7 --

From the property investment company’s accounts, we can also see that around a third of the investment capital it received was used for purposes other than the securing and developing of properties to be used for social housing – including cash withdrawals, payments to individuals involved in operating the company, paying jewellers and restaurants. And there are further substantial withdrawals and payments for which the purpose is unknown. Around £440,000 of the funds the property investment company received could be legitimate income, although none of this came from local authorities or social housing providers. But in comparison, £2.5 million was paid to investors. So it’s clear this didn’t come from genuine income – and strongly suggests the company was operating a Ponzi scheme. Overall, there is little to suggest any transactions are consistent with the property investment company completing property development for the benefit of investors, and much more to suggest the company wasn’t using investors’ funds for their intended purpose. Even if any of the funds the property investment company received were used for property development, it seems likely this was done with the intention of encouraging further investment as part of an overall scam. And so I’m satisfied the payment Mr R made to the property investment company here meets the definition of a scam from the CRM code – and it’s unlikely the outcome of the police investigation will impact this. Is Mr R entitled to a refund under the CRM code? As I explained above, HSBC was a signatory of the Lending Standards Boards Contingent Reimbursement Model (the CRM code). This code required firms to reimburse customers who had been the victim of authorised push payment scams, like the one I’ve explained I’m satisfied Mr R fell victim to, in all but a limited number of circumstances. And it is for the firm to establish that one of those exceptions to reimbursement applies. Under the CRM code, a firm may choose not to reimburse a customer if it can establish that: • The customer ignored an effective warning in relation to the payment being made • The customer made the payment without a reasonable basis for believing that: o the payee was the person the customer was expecting to pay; o the payment was for genuine goods or services; and/or o the person or business with whom they transacted was legitimate There are further exceptions within the CRM code, but these don’t apply here. The CRM code says that an effective warning should enable a customer to understand what actions they need to take to address a risk and the consequences of not doing so. It says that, as a minimum, an effective warning should be understandable, clear, impactful, timely and specific. And HSBC has sent us evidence that Mr R was shown a warning when he made the payment here which said: “Stop and think If this is a scam you could lose your money. Signs of a scam Is someone telling you what to do?

-- 4 of 7 --

If someone has told you to mislead us about the reason for your payment and choose the wrong payment type, stop. This is a scam. Who’s asking you to pay? Fraudsters can offer what appear to be genuine investment opportunities and may pressure you to invest your savings or transfer your current pension to a new scheme. Do you really know them? Fraudsters may use social media to build up a relationship with you to gain your trust before asking you to send them money.” And then… “Self defence Take action to ensure you don’t lose money. What can you do to protect yourself? • Don’t proceed if you have been cold called, offered guaranteed returns or if you are feeling pressured • Check if the company is genuine and authorised by the FCA. If they aren’t registered, take time to talk to an independent advisor before proceeding. • Check that the company is not listed in the FCA Scam list • For cryptocurrency investments, make sure you are making the payment directly to the provider, and the online wallet is in your name and only you have access to it. If you’re unsure, take time and talk to an independent advisor. • Visit our Fraud Centre for further guidance on how to undertake the required checks before proceeding By choosing to continue, you agree you’ve read our warning and are happy to proceed. You accept that we may not be able to recover your payment if it is sent to a fraudster’s account. If you’re unsure, please stop immediately.” But Mr R wasn’t being told what to say, hadn’t been talking to someone over social media and wasn’t buying cryptocurrency. So these parts of the warning weren’t relevant to his circumstances. He’d also checked that the property investment company was registered on Companies House, so I think he will reasonably have thought he had followed the guidance the warning gave. And this type of investment wouldn’t necessarily have required the company to be registered with the FCA, and the warning didn’t give much detail about what else Mr R could do or what other red flags there might be. So I don’t think this warning was specific or clear enough to be effective in Mr R’s circumstances. And so I don’t think HSBC has established that Mr R ignored an effective warning in relation to the payment he made here.

-- 5 of 7 --

I also don’t think HSBC has established that Mr R made the payment without a reasonable basis for belief that the investment was genuine. The property investment company was registered on Companies House and provided professional-looking documentation and marketing. Mr R had also spoken to a number of people from the company and read reviews from other people who had invested. There also wasn’t public information available at the time which I think would reasonably have given Mr R cause to suspect it wasn’t legitimate. So, based on his research and how the company was being promoted at the time, I don’t think it was unreasonable for Mr R to be persuaded that it was legitimate. And so I don’t think HSBC has established that any of the exceptions to reimbursement under the CRM code apply here, and so it should refund the money Mr R lost in full. Redress Mr R received a number of payments back from the property investment company following the payment he made here. And I think it would be fair for these payments to be deducted from the amount HSBC has to refund him. From what I’ve seen, Mr R’s payment to the property investment company totalled £13,500, and he received payments back totalling £1,200. So his remaining loss to be refunded is £12,300. I also don’t think any action I would’ve expected HSBC to take would have prevented Mr R making this payment, as I don’t think any of the information I would’ve reasonably expected it to have uncovered at the time of the payment would’ve uncovered the scam or caused it significant concern. But I do think there was sufficient evidence available at the time Mr R reported the payment and raised his claim with HSBC for it to assess his claim and conclude that he had been the victim of a scam. So I think HSBC should have refunded Mr R’s losses in its original response to his claim, and so should now pay 8% interest on this refund from the deadline for its original response to his claim until the date of settlement. HSBC has argued that the 8% simple interest rate is too high, and that a lower rate, or no interest at all, should be applied. But the interest award is to compensate Mr R for being deprived of the use of these funds from the point at which HSBC should have reimbursed him under the CRM code. HSBC should be well aware of our service’s approach to awarding interest in situations like this. The interest rate we apply is the same rate normally awarded by the courts. It takes into account a range of factors, such as that tax is normally deductible from the award. It is compensation for Mr R being deprived of the opportunity to use these funds, and the potential benefit he may have lost out on – ranging from lost enjoyment from what he could have purchased, to lost profits from other investments or interest, or costs incurred from borrowing – due to the refund not being paid when it should have been. In the circumstances, I’m not persuaded HSBC has demonstrated that our normal interest award would be unfair. My final decision For the reasons set out above, I uphold this complaint and require HSBC UK Bank Plc to: • Refund Mr R the £12,300 loss he suffered as a result of this scam • Pay Mr R 8% simple interest on that refund, from the deadline for its original response to his claim until the date of settlement

-- 6 of 7 --

Under the rules of the Financial Ombudsman Service, I’m required to ask Mr R to accept or reject my decision before 27 February 2026. Alan Millward Ombudsman

-- 7 of 7 --