National Westminster Bank Public Limited Company · DRN-5833666

The complaint Mr S complains that National Westminster Bank Public Limited Company (‘NatWest’) has declined to refund disputed transactions that were made from his account. What happened In March and April 2025, a number of ‘card not present’ transactions debited Mr S’ account totalling £370.68. When Mr S noticed these transactions, he contacted NatWest on 28 April 2025 to explain he hadn’t made them, and asked the bank to investigate fraud. NatWest said the transactions had all been made from Mr S’ genuine device and advised him to speak with the merchants involved. It also said it wouldn’t pursue a fraud claim unless Mr S agreed to blacklist his device, which he wasn’t prepared to do. Mr S raised a complaint. In response, NatWest said: • When Mr S raised his fraud claim, the agent could see that the transactions were coming from his own Apple Pay. The agent went through all the disputed transactions and explained how they were made, either from Mr S’ own Apple account or from his device. It is therefore required to ask Mr S to speak with the retailers involved. • This is because if the bank had issued a refund for genuine transactions, Mr S would’ve been backlisted with that retailer. • The bank followed its process correctly. No transactions were raised as fraud because it would not do so without the device being blacklisted first. Mr S then referred his complaint to this service where it was considered by one of our investigators. She upheld the complaint in part and recommended that NatWest refund two of the disputed transactions totalling £149.00 on the basis that the bank hadn’t evidenced that Mr S had authorised them. But she was satisfied that Mr S had authorised the remaining transactions, totalling £240.68. So she felt it was reasonable for NatWest to hold Mr S liable for them. NatWest partially agreed with our investigator. But Mr S did not. Via his representative, as well as other things, he said there was insufficient technical evidence to show that Mr S had authorised a majority of the transactions. As no agreement could be reached, the complaint has been passed to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint.

-- 1 of 4 --

Having done so, I’ve reached the same conclusions as our investigator, for broadly the same reasons. The relevant regulations here are the Payment Services Regulations 2017 (PSRs). In general terms, the bank is liable if the customer didn’t authorise the payments, and the customer is liable if they did authorise them. So, the issue for me to determine is whether Mr S carried out the disputed transactions himself or authorised someone else to make them on his behalf. Continuous payment authorities Our investigator identified that five individual merchants had processed transactions as ‘recurring.’ So it seems Mr S’s card details were entered into a Continuous Payment Authority (‘CPA’). From visiting their websites, the use of a CPA appears to be as part of individual subscriptions. Our investigator concluded that Mr S most likely authorised the initial transaction for all five retailers, in view of the way NatWest says they were authorised. This was either using a historic Apple Pay token using Mr S’s card information, or by 3DS – which would’ve required Mr S’s active participation via his NatWest app. In view of this, and on the balance of probabilities, I’m in agreement with our investigator that Mr S most likely authorised the initial transactions to each retailer. So I don’t find that NatWest should issue a refund for those amounts. However, In December 2012, the Office of Fair Trading (OFT) issued principles for using CPAs. Although the OFT doesn't exist anymore, the Financial Conduct Authority has said that these principles still apply so we should still take them into consideration. The points relevant to Mr S's dispute are: Setting up CPAs: • The merchant should make it clear they're using a CPA. The consumer should positively agree to the amounts and frequency of the payments. 'Opt-out' clauses are not good enough. • The key parts of the CPA (e.g. dates, amounts) must be displayed clearly and not just hidden in the terms and conditions. • Failure to get the consumer's positive, informed consent may mean the contract is unenforceable and the consumer is entitled to a refund of all payments. So in view of the above, in order to hold Mr S liable for the subsequent transactions under the CPAs, NatWest needs to evidence that Mr S knowingly entered into a CPA for each retailer, which would mean the subsequent transactions were authorised by him. NatWest provided our investigator with information in relation to each merchant. I understand our investigator has shared this information with Mr S’ representative and I’ve also looked at this very carefully. Whilst I don’t know exactly what Mr S would’ve been presented with in March 2025 when the initial transactions were made, the websites clearly explain the CPA terms. For example, one of the websites details the following on its front main page: ‘I hereby confirm that I am 18 years of age or older and I accept the Terms, Privacy Policy and Cancellation and Refund Policy. I agree that my membership will be renewed automatically every month for a price of £29.90 until I unsubscribe.’

-- 2 of 4 --

On the balance of probabilities, considering this is the exact amount Mr S was then charged after the initial payment to that particular merchant, I’m satisfied the terms were made clear to Mr S at the time. And because I’m satisfied on balance that all five websites outlined the terms clearly, whilst I accept, for whatever reason, that Mr S may not have seen it, I’m satisfied NatWest can treat all subsequent CPA transactions as authorised by him. And that’s despite his comments that Apple has confirmed it wasn’t his Apple account that was charged – because they were still charged to his card details. Card not present transactions As well as the CPA transactions, Mr S also reported two ‘card not present’ transactions as unauthorised. These transactions were processed using Mr S’ card details rather than the physical card, and were made to a clothing company as well as a London borough - supposedly for a parking or speeding penalty. Mr S has been in contact with the London borough, and it’s confirmed that no penalties were linked to Mr S’ car. NatWest has not provided any evidence to the contrary, nor has it provided any evidence that the clothing company transaction was linked to or authorised by Mr S in any way. So I’m in full agreement with our investigators’ recommendations that these two transactions, totalling £149.00, should be refunded to Mr S. Customer service I realise Mr S has complained about being referred back to the merchants by NatWest. He also felt it was unreasonable for it to insist he blacklists his device before it was willing to raise a fraud claim for him. Whilst I can appreciate why NatWest asked Mr S to speak with the retailers directly, the insistence he blacklists his device before it was willing to raise a fraud claim has somewhat confused me. Nothing in the PSR’s say Mr S was required to do this before NatWest was able to consider his fraud claim. And I accept that this would’ve been frustrating for Mr S to hear. However, NatWest had already explained to Mr S that the transactions were made using his own device, so it was effectively telling Mr S from the outset that it wasn’t accepting the transactions as fraudulent, and that it felt he’d authorised them. Overall, I do agree that NatWest could’ve handled Mr S’ fraud claim better. But for the reasons I’ve mentioned above, I won’t be asking it to refund all the transactions he’s disputed. But as it hasn’t been able to provide evidence that Mr S authorised the two card not present transactions totalling £149.00, I find it’s fair for NatWest to refund this amount to Mr S. I realise Mr S says his account entered into an overdraft as a result of the disputed transactions, but from reviewing his account statements, I don’t find this to be the case as Mr S’ account was already in its overdraft facility. Putting things right For the reasons mentioned above, I require National Westminster Bank Public Limited Company to: • Refund £149.00 to Mr S. That is the value of the two disputed ‘card not present’ transactions. • As these two transactions took place when Mr S’ account was within its overdraft

-- 3 of 4 --

facility, it should re-work the account as if the disputed transactions had never happened. My final decision My final decision is that I uphold this complaint in part. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr S to accept or reject my decision before 9 March 2026. Lorna Wall Ombudsman

-- 4 of 4 --