HSBC UK Bank PLC · DRN-6241096

The complaint Miss S complains that HSBC UK Bank PLC (‘HSBC’) hasn’t refunded all the money she lost after falling victim to a romance scam. What happened The circumstances of the complaint are well-known to both parties. So, I don’t intend to set these out in detail here. However, I’ll provide a brief summary of what’s happened. Between 2 February 2021 and 4 May 2023, Miss S made a large number of payments from her accounts with HSBC as part of a romance scam. Miss S sent three international payments from her HSBC currency account, totalling $28,674.50 (plus $14 in fees) to two third parties. The remaining payments, which I’ll summarise below, were made from her HSBC current account: • seven international payments to third parties, totalling £59,491.59 (plus £50 in fees); • a £9,600 faster payment to a UK-based third party; • three faster payments, totalling £13,600, to unknown bank accounts in her own name; • ten faster payments, totalling £127,120, to her account with a financial firm, which I’ll refer to as ‘Bank R’; • three debit card payments, totalling £2,260, to her account with Bank R; • 12 faster payments, totalling £269,000, to her digital wallet with a cryptocurrency exchange, which I’ll refer to as ‘Company G’; • two debit card payments, totalling £22,700, to her digital wallet with a cryptocurrency exchange, which I’ll refer to as ‘Company N’; • ten debit card payments, totalling £9,300, to her digital wallet with a cryptocurrency exchange, which I’ll refer to as ‘Company B1’; • 20 debit card payments, totalling £31,205, to her digital wallet with a cryptocurrency exchange, which I’ll refer to as ‘Company B2’; and • five debit card payments, totalling £30,160, to a cryptocurrency exchange, which I’ll refer to as ‘Company M’. Miss S received two payments from Company B2, totalling £2,110.76. She also received funds from her accounts with other banking providers. As she’s moved funds between multiple bank accounts and cryptocurrency exchanges, I’ve not been able to establish what Miss S’s exact loss is, although it is clearly substantial.

-- 1 of 8 --

In September 2024, Miss S made a complaint to HSBC and asked it to refund her loss. HSBC considered Miss S’s complaint and concluded that it wasn’t responsible for all of the scam payments. HSBC also didn’t think Miss S had acted reasonably when making the scam payments. However, HSBC did agree to reimburse 50% of some of the payments, after deducting a £1,881 credit Miss S received from Company B2. The total amount HSBC offered to reimburse is £209,987.80. Here is a detailed timeline of the scam payments Miss S made from her current and currency accounts with HSBC, along with the amounts HSBC agreed to refund: Date Amount Payment type Beneficiary Refund 1 02/02/2021 £3,184.91 International payment Payee 1 £1,592.45 2 16/02/2021 £10,000 International payment Payee 1 £5,000 3 26/02/2021 £3,706.68 International payment Payee 2 £1,853.34 4 26/03/2021 £300 Debit card Company B1 £150 5 29/03/2021 £10,000 International payment Payee 2 £5,000 6 06/04/2021 £800 Debit card Company B1 £400 7 09/04/2021 £300 Debit card Company B1 £150 8 21/07/2021 £10,000 Faster payment Self (unknown) £0 9 06/08/2021 £1,200 Debit card Company B1 £600 10 06/08/2021 £1,200 Debit card Company B1 £600 11 10/08/2021 £700 Debit card Company B1 £350 12 27/08/2021 £1,200 Debit card Company B1 £600 13 27/08/2021 £1,200 Debit card Company B1 £600 14 27/08/2021 £1,200 Debit card Company B1 £600 15 27/08/2021 £1,200 Debit card Company B1 £600 16 03/09/2021 £23,100 International payment Payee 3 £11,550 17 20/09/2021 £100 Debit card Company B2 £50 18 20/09/2021 £3,000 Debit card Company B2 £1,500 19 01/10/2021 £2,000 Debit card Company B2 £1,000 20 04/10/2021 £2,500 Debit card Company B2 £1,250 14/10/2021 £229.76 Credit Company B2 £0 21 18/10/2021 £3,000 Debit card Company B2 £1,500 22 18/10/2021 £5,000 Debit card Company B2 £2,500 23 18/10/2021 £5,000 Debit card Company B2 £2,500 24 18/10/2021 £5,000 Debit card Company B2 £2,500 26/10/2021 £1,881 Credit Company B2 £0 25 08/11/2021 £1,500 Debit card Company B2 £750 26 15/12/2021 £500 Debit card Company B2 £250 27 16/12/2021 £555 Debit card Company B2 £278 28 16/12/2021 £150 Debit card Company B2 £75 29 12/01/2022 £400 Debit card Company B2 £200 30 24/01/2022 £300 Debit card Company B2 £150 31 26/01/2022 £400 Debit card Company B2 £200 32 04/02/2022 £300 Debit card Company B2 £150 33 18/02/2022 £1,000 Debit card Company B2 £500

-- 2 of 8 --

34 24/03/2022 £100 Debit card Company B2 £50 35 04/04/2022 £200 Debit card Company B2 £100 36 04/04/2022 £200 Debit card Company B2 £100 37 08/07/2022 £9,600 Faster payment Payee 4 £0 38 18/07/2022 £10 Debit card Bank R £0 39 18/07/2022 £2,100 Debit card Bank R £0 40 28/07/2022 £1,000 Faster payment Bank R £0 41 24/08/2022 £500 Faster payment Bank R £0 42 05/09/2022 £700 Faster payment Bank R £0 43 16/09/2022 $18,874.50 International payment Payee 5 £0 44 20/09/2022 £300 Faster payment Bank R £0 45 22/09/2022 £600 Faster payment Self (unknown) £0 46 14/10/2022 £1,200 Faster payment Bank R £0 47 27/10/2022 £240 Faster payment Bank R £0 48 07/11/2022 £150 Debit card Bank R £0 49 17/11/2022 £5,000 Faster payment Bank R £0 50 06/02/2023 £3,000 International payment Payee 6 £1,500 51 06/02/2023 $5,000 International payment Payee 6 £0 52 13/02/2023 £6,500 International payment Payee 6 £3,250 53 21/02/2023 £2,980 Faster payment Bank R £0 54 21/02/2023 $4,800 International payment Payee 6 £0 55 22/02/2023 £880 Debit card Company M £440 56 09/03/2023 £8,500 Debit card Company M £4,250 57 10/03/2023 £3,780 Debit card Company M £1,890 58 24/03/2023 £15,200 Faster payment Bank R £0 59 27/03/2023 £16,000 Debit card Company N £8,000 60 27/03/2023 £8,500 Debit card Company M £4,250 61 27/03/2023 £6,700 Debit card Company N £3,350 62 27/03/2023 £8,500 Debit card Company M £4,250 63 04/04/2023 £25,000 Faster payment Company G £12,500 64 05/04/2023 £25,000 Faster payment Company G £12,500 65 06/04/2023 £20,000 Faster payment Company G £10,000 66 13/04/2023 £25,000 Faster payment Company G £12,500 67 18/04/2023 £14,000 Faster payment Company G £7,000 68 19/04/2023 £25,000 Faster payment Company G £12,500 69 19/04/2023 £100,000 Faster payment Bank R £0 70 20/04/2023 £25,000 Faster payment Company G £12,500 71 20/04/2023 £3,000 Faster payment Self (unknown) £0 72 21/04/2023 £25,000 Faster payment Company G £12,500 73 22/04/2023 £24,000 Faster payment Company G £12,000 74 02/05/2023 £25,000 Faster payment Company G £12,500 75 03/05/2023 £25,000 Faster payment Company G £12,500 76 04/05/2023 £11,000 Faster payment Company G £5,500

-- 3 of 8 --

Miss S wasn’t happy with HSBC’s response and so she referred her complaint to this service. Our Investigator considered the complaint but didn’t recommend it should be upheld. In summary, they didn’t think HSBC reasonably could’ve prevented Miss S from making any of the scam payments and so they didn’t think HSBC could fairly be held responsible for Miss S’s loss. So, they considered HSBC’s offer was more than fair in the circumstances. Miss S didn’t accept our Investigator’s opinion. As an informal agreement couldn’t be reached, the complaint has been passed to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In deciding what’s fair and reasonable in all the circumstances of a complaint, I’m required to take into account relevant: law and regulations; regulators’ rules, guidance and standards; codes of practice; and, where appropriate, what I consider to have been good industry practice at the time. Miss S has made some detailed submissions in support of her complaint. I’ve read and considered everything she’s sent in, but I don’t intend to respond in similar detail. I’m very aware that I’ve summarised this complaint briefly, in less detail than has been provided, and in my own words. No discourtesy is intended by this. Instead, I’ve focussed on what I think is the heart of the matter here. If there’s something I’ve not mentioned, it isn’t because I’ve ignored it. I haven’t. I’m satisfied I don’t need to comment on every individual point or argument to be able to reach what I think is the right outcome. Our rules allow me to do this. This simply reflects the informal nature of our service as a free alternative to the courts. In broad terms, the starting position at law is that a firm, like HSBC, is expected to process payments and withdrawals that a customer authorises, in accordance with the Payment Services Regulations (in this case, the 2017 regulations) and the terms and conditions of the customer’s account. It’s not in dispute that Miss S made the scam payments and was aware that the funds were going to leave her accounts. So, the payments were authorised and under the Payment Services Regulations, the starting position here is that Miss S is responsible for the subsequent loss, despite the payments being made as the result of a scam. However, that’s not the end of the story. Good industry practice required HSBC to be on the lookout for account activity or payments that were unusual or out of character to the extent that they might indicate a fraud risk. On spotting such a payment, I’d expect it to take steps to warn the customer about the risks of proceeding. When a firm fails to identify a suspicious payment, or if the firm’s response to a suspicious payment wasn’t proportionate, full reimbursement of a customer’s loss isn’t guaranteed. I’d still need to be satisfied that the firm’s failing had a material effect on the scam not being prevented. Many of the scam payments demonstrated a fraud risk to HSBC, which required proportionate questioning through human intervention. However, HSBC only intervened and questioned Miss S on a handful of payments – and when that happened, I don’t think the questions asked were proportionate to the risk demonstrated by the transactions.

-- 4 of 8 --

So, in my opinion, HSBC failed to meet the standards expected of it. So, the key question I must ask myself here, is whether HSBC could, more likely than not, have prevented Miss S from making the scam payments through proportionate intervention – i.e., did HSBC’s failures to sufficiently question Miss S about suspicious activity directly contribute towards her loss. The scammer initiated contact with Miss S in late 2019. So, when Miss S started making scam payments from her HSBC account, she’d been communicating with the scammer for well over a year, during which time Miss S thought a serious romantic relationship had been formed. Miss S has said that during the scam she was emotionally invested in the relationship she had with the scammer. She said she was exposed to: long term coercive control; years of psychological manipulation; and sustained grooming. Miss S says she was conditioned to rationalise payment requests and coached to resist disclosing the truth about what she was doing. I don’t doubt this and I think it is strongly demonstrated by the sheer volume and value of the transactions she made as part of the scam. To fund the scam, Miss S had to borrow hundreds of thousands of pounds from relatives. It seems highly likely that someone lending Miss S vast amounts of money would question what the funds were intended to be used for. However, Miss S confirmed that she told her relatives she was making an investment in property and kept the scammer’s involvement a secret. This suggests that it’s likely that she wouldn’t have disclosed the scammer’s involvement to HSBC either, had she been adequately questioned about her activity. Miss S didn’t just make payments to the scammer from her accounts with HSBC. In total, she used at least five separate bank accounts and at least five different cryptocurrency exchanges. Despite making a large number of high value transactions, most of the transactions were processed without any intervention from those firms. However, Miss S did speak to HSBC about some of the transactions she made from her accounts with it. I’ve listened to the relevant call recordings, as I think they are crucial to reaching a conclusion about whether better intervention from HSBC would’ve revealed the scam and prevented Miss S from making the scam payments. During those calls, Miss S was unhappy that HSBC was asking her questions about the transactions she was attempting to make. She described the questions as “intrusive”, “intimidating” and “ridiculous”. She commented in one call that the reason she was making the payment was none of HSBC’s business and it had no right to interrogate her as it wasn’t the police. She said the questions were a breach of her human rights; she wanted to make a complaint; and she threatened to close her HSBC accounts and move her money elsewhere. Miss S only had to answer questions about a small number of transactions over a four-year period, despite making a large number of payments during the same time. So, this leads me to think that her hostile responses to questions from HSBC (and other firms) was likely the result of coaching from the scammer, along with frustration about being unable to do what she wanted to. I think this is a clear indicator that Miss S interpreted intervention from HSBC (and other firms) as an inconvenience, rather than genuine attempts to prevent her from falling victim to a scam.

-- 5 of 8 --

I haven’t been provided with any evidence that leads me to believe that if appropriately questioned by any of the firms involved that Miss S would’ve revealed the involvement of the scammer. And I think this is because she was being guided on how to answer questions, which is consistent with Miss S’s testimony. I think, because of the relationship she thought she had with the scammer, that she trusted them more than her banking providers and was prepared to follow the scammer’s advice to ensure the transactions were successful. And, as Miss S had multiple bank and cryptocurrency accounts, if HSBC had refused to process any transactions, it seems highly likely that she would’ve found a way to send the money through her other accounts instead. Miss S hasn’t been able to provide much evidence of the scam. She has provided some of the messages she exchanged with the scammer. Unfortunately, these messages begin in February 2024, by which time most of the scam payments had already been made. But these messages clearly show Miss S believed she was in a genuine relationship with the scammer. So, I think this demonstrates that Miss S was fully under the scammer’s spell and being controlled by him. I appreciate Miss S wasn’t given any romance scam warnings throughout the scam. That’s because Miss S didn’t provide any details to suggest that was a scam she was falling victim to. However, in any event, based on the evidence I’ve seen, I don’t think Miss S would’ve heeded any romance scam warnings, such was her belief that the scammer was genuine. In May 2024, Miss S received three payments, totalling over £21,000, from an unknown third party into another of her bank accounts. Those funds were subsequently reported as having been paid to Miss S as the result of a separate scam and Miss S was asked to provide evidence of entitlement to the funds. With the scammer’s assistance, Miss S fabricated evidence which was presented to her other bank. I don’t think Miss S knew the funds she’d received were from another scam victim at the time. But I think this demonstrates the extent of what Miss S was prepared to do for the scammer – i.e., not just lying to the bank, but providing evidence she knew wasn’t real to justify her actions. As a result, I think Miss S would, more likely than not, have lost her money regardless of any potential interventions from HSBC or her other banking providers. Miss S has argued that throughout the scam, she was vulnerable and should therefore be entitled to full reimbursement of her loss. I’ve seen nothing to suggest HSBC was aware Miss S may have been vulnerable when the scam payments were made, and so there weren’t any additional measures in place on Miss S’s accounts that HSBC failed to follow. As a result, I can’t say that HSBC should reimburse Miss S’s total loss because of her personal circumstances at the time. Financial firms based abroad have different rules and regulations to those firms based in the UK. This means, in practice, that it’s extremely unlikely that an overseas beneficiary bank would’ve returned any of Miss S’s funds that remained in their customer’s account. And the international payments weren’t reported until after a substantial amount of time had passed. So, the chances of any funds remaining in the beneficiary accounts, when the scam was eventually reported, are remote and I can’t say HSBC missed an opportunity here to mitigate Miss S’s loss. The remaining payments (with the exception of one payment which I’ll address below) went to Miss S’s own accounts elsewhere or to her digital wallets with various cryptocurrency exchanges. So, if any funds remained in those beneficiary accounts, Miss S could access and withdraw them without HSBC’s assistance, although HSBC was successful in recovering £10 from Company G.

-- 6 of 8 --

Some of the payments were debit card payments to cryptocurrency exchanges. It hasn’t been argued that the cryptocurrency exchanges failed to provide the goods and services they were paid for. As a result, I think if HSBC had raised chargebacks for those payments, it’s likely the merchants would’ve defended these. I wouldn’t expect HSBC to raise a chargeback that had little prospect of success and so I don’t think this was a necessary step in the circumstances. At the time of Miss S’s payments, HSBC was signed up to the Lending Standards Board’s Contingent Reimbursement Model (‘CRM’) Code, which required firms to reimburse customers who’d been the victims of authorised push payment (‘APP’) scams in all but a limited number of circumstances. However, the CRM Code didn’t apply to international payments, debit card payments or payments to a victim’s own bank account or digital wallet with a cryptocurrency exchange. So, the CRM Code only applies to payment 37 (a £9,600 payment on 8 July 2022). Under the CRM Code there are generally two exceptions to reimbursement that HSBC could rely on, which are that: • Miss S made the payment without a reasonable basis for believing that the scammer was legitimate; and/or • Miss S ignored what the CRM Code deems to be an “Effective Warning”. And, importantly, when assessing whether it can establish these things, HSBC must consider whether they would’ve had a ‘material effect on preventing the APP scam’. By the time Miss S made the £9,600 payment, she’d been communicating with the scammer for approximately two and a half years. During that time, she’d sent over £100,000 to the scammer from her HSBC account and received nothing in return. Whilst she regularly exchanged messages with the scammer and occasionally spoke on the phone or video call, she’d never met them in person. I’ve seen no evidence which explains why any of the payments prior to this one were made, so I’m not persuaded Miss S had a reasonable basis for believing that after making this specific payment, she would receive her funds back. As a result, I think this exception to reimbursement applies in these circumstances and HSBC was entitled to refuse full reimbursement of the payment. The payment was large and sent to a new payee. So, I think HSBC needed to provide an “Effective Warning” under the CRM Code when the payment was made. I’ve considered the warning HSBC says it gave Miss S and I don’t consider this meets the required standard under the CRM Code. It was vague and didn’t bring to life what a romance scam looks like in practice. However, HSBC went further than providing a written warning, to the extent that it blocked the payment and spoke to Miss S about the reason for it. I’ve referred to this specific call earlier in my decision. As set out above, Miss S wasn’t happy that her payment had been blocked and was frustrated at having to answer questions and reluctant to provide much detail about the payment. Miss S didn’t engage in the intervention process and was more concerned with expressing her dissatisfaction than answering accurately and in detail. This prevented HSBC from identifying that she was at risk of financial harm due to a romance scam or providing her with an “Effective Warning”. So, I can’t fairly say HSBC didn’t meet its standards under the CRM Code. And, for similar reasons to those explained above, I don’t think Miss S would’ve heeded any warnings such was her belief that the scammer was genuine.

-- 7 of 8 --

I’ve considered Miss S’s personal circumstances at the time this specific payment was made. I can’t agree she was unable to protect herself from the scam for the reasons she’s given as to why she may have been vulnerable at the time. As a result, I don’t consider she ought to be reimbursed this payment under the CRM Code because of her personal circumstances. Once it was aware of the scam, HSBC did attempt to recover this payment from the beneficiary bank. It didn’t notify the beneficiary bank as quickly as it could’ve done (it took several days). However, given the payment was made around two years before the scam was reported, I’m satisfied that the delay is unlikely to have made a difference or had a detrimental impact on Miss S, as those funds had, more likely than not, been withdrawn long before the scam was reported. Miss S has been the victim of a cruel scam, orchestrated by someone she thought she could trust. And it’s clear that the impact of the scam goes beyond just the financial loss she’s suffered. I have natural sympathy for Miss S, but I’m not satisfied HSBC can reasonably be held responsible for refunding Miss S in the circumstances. HSBC has agreed to reimburse 50% of some of the scam payments, but not all. Whilst HSBC has made errors, these haven’t been to Miss S’s detriment for the reasons I’ve explained above. As a result, I’m not persuaded HSBC needed to reimburse anything to Miss S. So, I think HSBC’s offer to resolve the complaint is more than fair and I’m not asking it to do anything more. My final decision For the reasons explained above, my final decision is that I don’t uphold this complaint. Under the rules of the Financial Ombudsman Service, I’m required to ask Miss S to accept or reject my decision before 17 April 2026. Liam Davies Ombudsman

-- 8 of 8 --