HSBC UK Bank Plc · DRN-6149112

The complaint Mr H complains HSBC UK Bank Plc (“HSBC”) won’t refund the money he lost to an investment scam. What happened I issued a provisional decision in January 2026 to explain why I thought Mr H’s’ complaint should be partially upheld. And I said I’d consider anything else anyone wanted to give me before proceeding with my final decision. This is an extract from my provisional decision: “The detailed background to this complaint is well known to both parties. So, I’ll only provide a brief overview of some of the key events here: In October 2024, Mr H fell victim to a cryptocurrency investment scam. He saw an advertisement online promoting a company I will refer to as “F”. Interested, Mr H went on to F’s website and entered his contact details. Mr H was then contacted by a “broker” from F who said they would instruct him on what to invest in and how, in order to make significant profits. Mr H was instructed to set up an account on what we now know to be a fake investment portal. He was also instructed to set up accounts with money transfer services and a cryptocurrency exchange. Over the next seven weeks, under the instruction of the scammer, Mr H made the following payments from his HSBC account to the new accounts he had set up in his own name. The funds were then sent on to an account controlled by the scammer. In order to facilitate the scam payments, Mr H took out various loans which credited his HSBC account prior to the scam payments. In the table below, I’ve detailed the activity that took place on Mr H’s account during the scam. I’ve highlighted the funds lost to the scam in bold: Date Payee / Payer Activity Amount 4 October 2024 Mr H’s account at “K” Payment out £3,000 9 October 2024 Mr H’s account at “K” Payment in £3,000 11 October 2024 Mr H’s account at “C” Payment out £3,000 25 October 2024 Loan company Loan funds in £25,000 25 October 2024 Mr H’s account at “C” Payment out £25,000 (reversed back into account) 29 October 2024 Mr H’s account at “B” Payment out £25,000

-- 1 of 7 --

7 November 2024 Loan company Loan funds in £5,000 7 November 2024 Loan company Loan funds in £20,000 7 November 2024 Mr H’s account at “B” Payment out £25,000 8 November 2024 Loan company Loan funds in £5,000 11 November 2024 Mr H’s account at “B” Payment out £5,000 20 November 2024 Mr H’s account at “T” Payment out £4,000 22 November 2024 Mr H’s account at “T” Payment out £4,000 Total £66,000 Mr H says he realised he’d likely been the victim of a scam when he contacted HMRC to enquire if the tax payments the scammers told him he’d need to pay were genuine. He then reported what had happened to him to HSBC. HSBC declined to provide Mr H with a refund of the amount lost. It pointed out that it had discussed a number of the scam payments with him before it allowed them to leave his account. It said during these telephone conversations, Mr H hadn’t been truthful with the bank about the real reason for the payments and this had ultimately prevented it from uncovering the scam and preventing his loss. It therefore didn’t think HSBC should be liable to refund Mr H now. Unhappy with HSBC’s response, Mr H brought his complaint to this service with the help of a professional representative and one of our investigators looked into things. The investigator didn’t recommend that the complaint be upheld. They agreed that Mr H misleading HSBC about the real reason for the payments had prevented HSBC from uncovering the scam. They also felt Mr H would’ve continued with the payments despite any proportionate intervention by HSBC. So, the investigator didn’t think HSBC could’ve prevented Mr H’s loss. Mr H disagreed with the investigator’s opinion and as an informal agreement could not be reached, the case has been passed to me for a decision. What I’ve provisionally decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In deciding what’s fair and reasonable in all the circumstances of a complaint, I’m required to take into account relevant: law and regulations; regulators' rules, guidance and standards; codes of practice; and, where appropriate, what I consider to have been good industry practice at the time. Having taken into account all of the above, I am currently minded to reach a different conclusion to the one reached by our investigator. I think HSBC could’ve done more than it did to prevent Mr H’s loss and so I’m currently minded to recommend HSBC partially refund Mr H. I’ll explain why in more detail below. In broad terms, the starting position at law is that firms like HSBC, are expected to process payments and withdrawals that a customer authorises it to make, in accordance with the

-- 2 of 7 --

Payment Services Regulations (in this case the 2017 regulations) and the terms and conditions of the customer’s account. However, whilst HSBC was not required or obliged under contract to make checks, I am satisfied that, taking into account longstanding regulatory expectations and requirements and what I consider to have been good practice at the time, it should fairly and reasonably: • Have been monitoring accounts and any payments made or received to counter various risks, including anti-money laundering, countering the financing of terrorism, and preventing fraud and scams. • Have had systems in place to look out for unusual transactions or other signs that might indicate that its customers were at risk of fraud (among other things). This is particularly so given the increase in sophisticated fraud and scams in recent years, which banks are generally more familiar with than the average customer. • In some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks, or provided additional warnings, before processing a payment. • Have been mindful of – among other things – common scam scenarios, the evolving fraud landscape (including for example the use of multi-stage fraud by scammers) and the different risks these can present to consumers, when deciding whether to intervene. Should HSBC have fairly and reasonably made further enquiries before it processed Mr H’s payments? I’m not persuaded that the first payment made by Mr H was suspicious enough to have warranted intervention by HSBC. However, HSBC did intervene and it spoke with Mr H about the payment before it was allowed to leave his account. I’ve listened to a recording of this conversation and I think Mr H says a number of concerning things about the account he is transferring the funds to and how this account supposedly works. However, he also misleads HSBC about the real reason he is attempting to make the payment. It’s arguable that HSBC could’ve done more here but given that this appeared to be a relatively modest, low risk transaction, I’m not persuaded it was unreasonable for HSBC to take what Mr H said about the payment he was making at face-value. The second payment Mr H made, the £25,000 payment made on the 25 October 2024, ultimately bounced back into Mr H’s account. So, no funds were lost to the scam at this point. However, HSBC did identify this payment as suspicious and it discussed it with Mr H during a telephone conversation prior to it being processed on his behalf. During this conversation, Mr H is asked to confirm why he is making the payment. Mr H says he’s purchasing a car and this is also the reason he has had significant loan funds paid into his account. I acknowledge that Mr H isn’t being truthful during this conversation and ultimately that he misleads HSBC’s advisor about the real reason behind the payment and about the account the funds are being sent to. However, again, I also think HSBC failed to pick up on a number of concerning things Mr H said during this conversation and I don’t think HSBC went far enough in its questioning of Mr H during this conversation either. I’ll expand on this point later in my decision. Once the payment bounces back into Mr H’s account, he attempts it again on 29 October 2024, and this time it is successful. HSBC do not contact Mr H about this payment. However, I’m satisfied that HSBC should’ve contacted Mr H to discuss it. It is the second significantly high value being made over fourteen days. If HSBC had contacted Mr H about this payment, I think it’s reasonable to assume that the conversation would’ve been similar to the conversation that had taken place on 25 October 2024 - Mr H would’ve told HSBC’s advisor

-- 3 of 7 --

that the payment he was making was to pay for a car, that for some reason unknown to him, the funds had bounced back into his account and he was now attempting to make the payment again. However, I’m not persuaded that HSBC should’ve taken this explanation at face value and allowed the payment to go through on 25 October 2024 and I’m satisfied that HSBC missed a further opportunity to prevent this payment leaving Mr H’s account on the 29 October too. I’ll explain why in more detail below. Having listened to recordings of all of the conversations Mr H had with HSBC, I’m not persuaded that HSBC’s advisors were pro-actively seeking to understand whether Mr H was falling victim to a scam or not. It’s clear they are reading from a scam script with a focus on providing Mr H with warnings about safe account scams - which aren’t relevant to the circumstances Mr H finds himself in. During some calls, Mr H isn’t asked the reason he is making the payment until ten minutes or so into the call and whenever Mr H’s answers are unclear or concerning, the advisor moves on to the next question without seeking to gain a better understanding of Mr H’s circumstances. So, having listened to the calls, it sounds like the focus was making sure all of the necessary questions were asked rather than proactively trying to ascertain whether Mr H was at risk of financial harm from fraud. For example, during the conversation that takes place on the 24 October 2024, Mr H tells HSBC he is making a large payment for a car following the receipt of loan funds into the account. But Mr H isn’t asked any questions about the car he is supposedly purchasing and his answers to other questions, although odd, are taken at face-value. For example, Mr H HSBC’s advisor that he is moving the funds to another account in his own name prior to making payment for the car where he’ll get “cashback”. HSBC’s advisor goes on to ask what type of account this is and Mr H responds that it’s a “working account”. It’s unclear what Mr H means by this but the conversation quickly moves on. Given the activity that was taking place on Mr H’s account, I’m not persuaded that HSBC’s advisor should’ve accepted Mr H’s answers to its questions at face value. Mr H was now attempting a third high value payment in a 14-day period. The third payment is for a significant amount. It is also being made after a number of high value transfers into the account including a loan. Mr H told HSBC that the initial transfer he was making was to a new payee for shopping abroad. This is now a second new payee and Mr H is saying he is making payments for a car. I also have to bear in mind that these payments are both being made via payment processers which are often associated with cryptocurrency scams and the activity on Mr H’s account is suggestive of the account being used as an intermediary to facilitate the movement of funds from one account to another. I’m satisfied that this should’ve raised suspicion at HSBC. If HSBC had asked Mr H some further probing questions, I’m not persuaded his cover-story would’ve held up to scrutiny. Mr H was apparently coming up with a cover-story whilst in the midst of these telephone conversations and I’m not persuaded that this cover-story would have withstood any proportionate probing questions from HSBC. The answers Mr H is already providing don’t ring true and the questions being asked are somewhat surface level. So, as the industry expert, I’m satisfied HSBC should be mindful that customers are often asked to provide their bank with a cover-story in order to maximise the chances of a payment being processed and it should fairly and reasonably have been on the lookout for potential tell-tale signs that this was what was happening here. I’m satisfied HSBC should’ve probed Mr H further as to the reason behind this payment and it should’ve picked up on some of the concerning aspects of Mr H’s answers too. I don’t think Mr H would’ve been able to come up with a plausible story as to why he was sending money to another account in his name with the intention of buying a car. What Mr H is saying about the account offering “cashback” doesn’t stand up to scrutiny. It doesn’t appear to me that Mr H had thought about

-- 4 of 7 --

his answers in any great detail at all. So, I’m satisfied that even if Mr H had continued to maintain his cover-story, HSBC should’ve had significant concerns about what Mr H was saying and at this point, it should’ve directed him to a local branch so The Banking Protocol could be invoked. Had the Banking Protocol been invoked in this case, I’m satisfied that its fair and reasonable to assume that the scam could’ve been prevented from this point onwards. I acknowledge that Mr H appears to have been reluctant to engage with HSBC advisors on the telephone and he misled HSBC about the real reason behind the payments. However, I haven’t seen anything that persuades me Mr H wouldn’t have acted on the advice of law enforcement. And so, I’m persuaded that had HSBC acted in line with the Banking Protocol in October 2024, Mr H’s loss could’ve been prevented from this point onwards. I’m therefore satisfied it would be reasonable to hold HSBC liable for Mr H’s loss from 29 October 2024 onwards. The above being said, I’m also satisfied that it would be reasonable for Mr H to bear some responsibility for his losses from this point onwards too. I say this because: • The investment Mr H was offered did not sound genuine and it’s unclear how the investment was supposed to work or how it could generate the significant proposed profits. • Many of the conversations Mr H had with the supposed broker took place over a text- messaging service - which is not a method used to arrange and agree legitimate high value investments. I therefore think that the nature of the messages, in combination with the other factors, ought reasonably to have led Mr H to have concerns. • The rate of return Mr H was offered and the timescale to receive it in were too good to be true - Mr H had been promised returns of around £500,000 over a 7-week period. And so, I’m satisfied that what was being offered here was so unrealistic and unlikely that Mr H ought reasonably to have had significant concern about the legitimacy of the opportunity that was presented to him from the outset. That, in turn, ought to have led to a greater degree of checking on his part. • Numerous conversations took place between Mr H and HSBC over the telephone during the course of the scam and Mr H misled HSBC as to the real reason he was making the payments. Mr H not being honest with HSBC played a role in preventing HSBC uncovering the scam. Overall, HSBC should’ve done more to prevent Mr H’s losses from the 29 October 2024 onwards and if it had, Mr H’s loss could’ve been prevented from this point onwards. However, I think it’s fair for Mr H to also share the responsibility for his loss with HSBC for the reasons I’ve set out above. HSBC should therefore refund 50% of Mr H’s overall loss from 29 October onwards. Mr H should bear responsibility for the rest. Could HSBC have done anything else to recover Mr H’s money? I’ve also thought about whether HSBC could have done more to recover the funds after Mr H reported the fraud. However, Mr H had sent the funds on from his accounts at C, B and T soon after they were transferred in. As the funds had already left the accounts they were initially transferred into, there wasn’t anything HSBC could’ve done to recover the Mr H’s funds in these circumstances.” What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint.

-- 5 of 7 --

Having done so, I’m minded to reach the same overall conclusion as I reached in my provisional decision. I’ll explain why. Mr H responded to my provisional decision to say he accepted my findings. HSBC responded to my provisional decision to say it did not accept my findings. In summary, it said: • When questioned, Mr H provided plausible and confident responses to the questions posed to him. He was given multiple opportunities to be honest with HSBC but he was not. HSBC believe Mr H would’ve continued with the transactions regardless of any intervention by HSBC. • The third-party account Mr H referred to during his conversations with HSBC does offer cashback. Regardless, many financial institutions offer something similar so this would not have seemed unusual to HSBC’s advisor at the time. It seems HSBC’s advisor would’ve understood Mr H saying he was transferring his funds to a “working account” to mean an everyday type of account / not a savings account. • HSBC disagreed that its advisors were focused on providing scam warnings rather than seeking to understand whether Mr H was falling victim to a scam or not. It said the advisors asked specific questions in order to understand the purpose of the payments and if Mr H had been honest with HSBC, it would’ve been better placed to uncover the scam. • The Banking Protocol is only invoked when HSBC has a concern that their customer is at risk of serious harm. HSBC did not identify this was the case in this instance. Having reviewed HSBC’s additional comments, I am satisfied that the majority were addressed as part of my provisional decision. However, I will briefly address each point in turn below now. I acknowledged throughout my provisional decision that when asked questions about the payments, Mr H chose to mislead HSBC. This was one of the reasons I recommended Mr H also bear some responsibility for the success of the scam. However, as the industry expert, HSBC should be aware that a common tactic used by scammers is to tell customers to mislead their bank or provide a “cover story” if questioned in order to maximise the chances of a payment being processed. So, Mr H misleading HSBC about the reason behind the payments is not the end of the story. HSBC should have been on the lookout for potential tell-tale signs that Mr H may not being truthful and not automatically have taken his answers at face value, especially given the concerning activity that was taking place on his account. I have thought about what HSBC has said about Mr H proceeding with the payments despite any intervention by HSBC but HSBC hasn’t provided any evidence to support this conclusion. And as I said in my provisional decision, I don’t think Mr H’s cover-story would’ve stood up to scrutiny had HSBC probed further or had The Banking Protocol been invoked. I haven’t been provided with any evidence that supports Mr H would’ve continued making payments to the scammer(s) had he spoken with law enforcement. I acknowledge HSBC’s arguments about the third-party account offering cashback (although this appears to on card purchases not transfers) and what its advisor most likely understood the term “working account” to mean. But HSBC’s comments fail to take into account that Mr H’s answers should’ve been considered in conjunction with the overall activity taking place on his account. It is the circumstances as a whole that are suspicious and indicative of a scam - Mr H was attempting a third high value payment in a 14-day period. This payment was for a significant amount. It was also being made following high value transfers into the

-- 6 of 7 --

account including significant loan funds. Mr H had told HSBC that the initial transfer he was making was to a new payee for shopping abroad. This was now a second new payee and Mr H is saying he is making payments for a car. Both of these payments were being made via payment processers which are often associated with cryptocurrency scams and the activity on Mr H’s account was suggestive of the account being used as an intermediary to facilitate the movement of funds from one account to another. This is in addition to the somewhat vague answers Mr H is providing about the account he is sending funds to. So, overall, I remain of the opinion that the activity on Mr H’s account, alongside his answers, should’ve raised suspicion at HSBC. I’m not persuaded Mr H’s answers should’ve been taken at face value or provided HSBC with reassurance that he wasn’t falling victim to a scam. I set out in my provisional decision why I felt HSBC’s advisors were focused on reading from a script rather than uncovering the scam so I won’t repeat what I said again here. It is sufficient for me to say that I acknowledge HSBC did ask a number of questions designed to uncover whether a customer was about to fall victim to a scam or not. However, having listened to the calls, I wasn’t persuaded that the answers provided by Mr H were actively engaged with. In some instances, Mr H wasn’t asked the purpose of the payment until ten minutes or so into the call. I don’t think this supports that HSBC was proactively trying to uncover the circumstances behind the payments. And, overall, I’m not satisfied HSBC’s advisors should’ve been reassured by the answers Mr H gave. I understand HSBC believe The Banking Protocol should only be invoked if it is concerned that its customer is at risk of serious harm. However, this isn’t correct. The Banking Protocol can, and should be, invoked even when there is only a suspicion that a customer might be at risk of financial harm from fraud. And I’m satisfied there was enough going on here given the activity on Mr H’s account that HSBC should’ve had such concerns. My final decision For the reasons given above, I uphold this complaint in part and direct HSBC to pay Mr H: • 50% of his overall loss, from and including, the second successful scam payment made on 29 October 2024. • 8% simple interest per year on that amount from the date of each payment to the date of settlement.* *If HSBC considers that it’s required by HM Revenue & Customs to deduct income tax from that interest, it should tell Mr H how much it’s taken off. It should also give him a tax deduction certificate if he asks for one, so he can reclaim the tax from HM Revenue & Customs if appropriate. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr H to accept or reject my decision before 12 March 2026. Emly Hanley Hayes Ombudsman

-- 7 of 7 --