DRN-6270621

The complaint Mr R complains Lowell Portfolio I LTD have: • Pursued a debt he’d paid off with the original lender • Not provided documents to prove the outstanding debt and contacted him when they shouldn’t have • Emailed his full 16-digit credit card number in an unsafe way What happened I issued a provisional decision setting out what’d happened, and what I thought about that. I’ve copied the relevant elements of this below, and they form part of this final decision. As I understand it, Mr R took out a credit card account with a lender I’ll refer to as C on 7 November 2022. The account was sold by C on 19 September 2024 to Lowell. Mr R was notified of this in a Notice of Assignment (NOA) dated 7 October 2024. The amount of the debt was £308.88. Mr R says he disputes this debt is owed, because he paid it off with C – but due to the time that’s passed he doesn’t have a receipt or confirmation of this. Mr R says he’s asked for documents to prove the debt is owed, but Lowell have repeatedly refused to provide this. Mr R is also very unhappy Lowell emailed the full 16-digit credit card number to him insecurely. He says this is an incredibly serious breach of data security and that the risk to him financially from this kind of exposure is enormous. Additionally, in an email of 7 January 2025 Mr R said he wanted all the information held on file about him or his case to be sent to him – and said if Lowell needed a subject access form to be completed, to let him know. Lowell issued two responses to Mr R – 4 February 2025 and 10 June 2025. In summary they said: • They thought they’d communicated fairly • To consider that the debt had been repaid, they’d like Mr R to provide evidence he paid off the balance with C • They didn’t think they’d done anything wrong in emailing the full credit card number to him For an issue about how Mr R was able to make his complaint, they paid him £30. Lowell also processed Mr R’s data subject access request (DSAR) – which didn’t include proof of the debt, so Mr R also complained about this. Unhappy with Lowell’s responses, Mr R asked us to look into things. While we were doing so, Lowell told us that on 4 September 2025 they’d provided the documents to Mr R. Lowell also accepted they’d made an error in not asking for documents when Mr R first asked and offered him £100 compensation.

-- 1 of 9 --

Ultimately Mr R didn’t accept this, so we considered his complaint in full. Having done so, our Investigator thought the £100 offered by Lowell was a fair outcome to the complaint. Mr R has provided a number of responses since our Investigator’s outcome not accepting the Investigator’s conclusions. His email of 14 October 2025, with four annexes, appears to be Mr R’s substantive response to the outcome our Investigator issued. I have read all of the other submissions, but they’ve largely focused on the service we’ve provided to Mr R and why he thinks we’ve not handled things correctly. In terms of Mr R’s thoughts on the outcome against Lowell our Investigator reached, I’ve summarised what I consider to be the key points in my own words: • All of his concerns from January 2025 should be considered • Mr R asked for a DSAR on 3 January 2025 and this was a clear request for proof of the debt • Asking Mr R to prove he repaid the debt isn’t fair or reasonable – Lowell should hold the evidence of the debt before pursuing an account • Mr R asked for evidence of the debt but it wasn’t provided and should have been • Threatening legal action while there was a dispute ongoing isn’t acceptable • Saying Mr R asked for the account number isn’t a defence to insecure transmission of sensitive information • Matters have been delayed for two years causing harm over this period of time – including being denied mainstream credit and an impact on his employment • Compensation of £750-£1,500 would be a fairer outcome and reflective of the issues So, the complaint’s been passed to me to decide. For Mr R’s reassurance, we have an electronic file for each case – and communication he sends is added to that case. I’ve not seen anything to suggest I’ve not been provided with all his submissions about his complaint that he’s sent to both our Investigators and other colleagues who have responded to him. I can see for example on 7 November 2025 Mr R asked for confirmation his emails of 22, 30 October and 2 November 2025 had been added. I can confirm I’ve seen all of those emails. In addition, for Mr R’s benefit, the evidence I’ve relied on is the emails he’s exchanged with Lowell, which I’m satisfied he’s seen. If there is anything Mr R thinks he hasn’t seen, I’d ask him to let us know. What I’ve provisionally decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I think it’s important to explain I’ve considered all of the information provided by both parties in reaching my decision. If I’ve not reflected or answered something that’s been said it’s not because I didn’t see it, it’s because I didn’t deem it relevant to the crux of the complaint. This isn’t intended as a discourtesy to either party, but merely to reflect my informal role in deciding what a fair and reasonable outcome is. Mr R has quoted a substantial amount of law as well as rules and regulations in his submissions to us. In doing so, Mr R has made it clear he understands our remit is to consider things on a fair and reasonable basis. That is what I’m required to do, and in the interests of brevity I won’t refer to every element he has raised when explaining my outcome.

-- 2 of 9 --

Lowell pursuing a debt Mr R has already paid off I appreciate Mr R has said he’s already paid off the account with C. He doesn’t dispute the account is his, but he does dispute there was an outstanding amount owed to C – and, after the account was sold – to Lowell. Lowell asked Mr C to provide evidence of this payment – and Mr R has suggested it’s for Lowell to prove the debt is owed, not for him to prove it’s been repaid. I’ll come back to Lowell’s obligations about the proof of the debt – but dealing with Lowell’s request for Mr R to show evidence of this I don’t think that’s unreasonable. I say that because Mr R opened this account in November 2022, so at the time of the conversations with Lowell it’ll have been between two and three years when he was likely to have made the payment. With financial records such as bank statements generally being kept for six years by banks and other providers, it seems quite plausible at face value Mr R would be able to prove he’d paid off the debt. And I’d absolutely expect Lowell to be open to the possibility of them being sold a debt they shouldn’t have been and fully investigate that dispute. But, without evidence from Mr R of the payment he says he made to C – and setting aside their obligations for proof of the debt for the moment – it’s quite reasonable for Lowell to continue to ask Mr R to repay it. Because, without any information to show he did pay it off, it’s not unreasonable for Lowell to believe the debt is still owed. I’m conscious Lowell asked Mr R for his bank statements to show the payment in June 2025, and then when our Investigator was reviewing matters they also asked if Mr R had evidence of this. On 20 August 2025 Mr R told us he’d applied for statements, but it was difficult because he’d moved banks. As at the date of this decision, no evidence has been provided showing Mr R had paid off the account with C. So, for this point alone, I’m satisfied Lowell aren’t doing anything wrong by asking Mr R to repay the debt – because they’ve no evidence he paid it off with C. Request for proof of the debt, and continued contact On 8 November 2024 Mr R messaged Lowell through their online form. In this message, he said: Hi. Apologies for all the missed contact attempts I don’t really know what to do. Please could you provide me with some options I would like to clear this as quickly as possible. Thank you In his communication with us, Mr R has said this was a request for evidence of the debt. I don’t agree. I think a reasonable interpretation of this is Mr R asking for how to repay the debt – and I’ve seen Lowell did reply to him explaining how to do this. On 2 January 2025 Mr R contacted Lowell again through their online form. When doing so, he said he’d only had one account with C, believed it’d been paid off in full, and thought this might be a mistake. Mr R said: Please could you forward me on the account details so I can check them with my account. Mr R also asked for the account to be put on hold at this point.

-- 3 of 9 --

Lowell replied explaining it was an account with C, provided the full credit card number, and said the outstanding balance was £308.88. Lowell also explained the account was taken out in November 2022, the last payment was August 2023, and it defaulted in January 2024. So, I think Lowell have replied appropriately to Mr R’s request for information about the account. They’ve provided him with essentially the information he asked for. In context at this point Mr R accepts he had an account with C, and says this could be a mistake. So, I think Lowell’s reply was helpful as it provided the account details Mr R himself had asked for. Whether Lowell should or shouldn’t have provided the full credit card account number is something I’ll come back to. On 8 January 2025 Lowell said they’d placed Mr R’s account on hold for 30 days for him to get back to them with the evidence of him having made the payment. Lowell’s systems show Mr R raised a complaint on 7 January 2025, but it wasn’t logged with them for some reason until 9 January 2025. In terms of Lowell contacting Mr R, what I need to consider is whether their contact around this time or after has been unreasonable. Mr R refers to contact he received 6 January 2025 which he says was threatening. Given Mr R had already asked for his account to be put on hold at this time, and Lowell then later confirmed this to Mr R – I think they shouldn’t have contacted him. I’ll come back to this at the end. But, importantly, I don’t think Mr R had asked for documentary evidence of the debt at this point in time. He asked for information about the debt – which is what Lowell provided. I appreciate Mr R may have meant he wanted evidence of the debt in the form of documents, but I don’t think this could have been clear to Lowell at this time. So, at this point, I don’t agree with Mr R saying he asked for evidence of the debt at this point. On 23 February 2025 Mr R said he’d not been given any information about the debt. And he understood it was for Lowell to prove he owed the debt, not for him to prove he didn’t owe the debt. There is an obligation on Lowell to provide evidence of the debt to Mr R if asked – or at least try and get the evidence from C of the debt. Mr R makes another request for these documents on 3 March 2025. In this email, Mr R says Lowell saying they’d put the matter on hold for 30 days isn’t acceptable – and he’ll contact our service. At this point, I’m satisfied Mr R has asked for proof of the debt in his contact with Lowell on 23 February 2025. So, I wouldn’t have expected them to then contact Mr R after this asking for repayment of the debt. I understand Lowell did so on several occasions – including a letter saying it’s not too late to avoid legal action. I also think there has been a delay in the documents being provided – as Mr R first asked for them on 23 February 2025, and they weren’t provided until around 4 September 2025. That’s a delay of just over six months. These elements are disappointing and shouldn’t have happened. I’ll come back to them at the end. Emailing the 16-digit credit card number

-- 4 of 9 --

I can see Mr R is aware that I can’t decide whether Lowell breached data protection laws by emailing this – and he’s clarified that’s not what he’s asking. He’s asking us to consider the impact on him. I’ve looked back at Mr R’s complaint form, and he’s talked about feeling sick because Lowell were so careless with his personal data. He’s also said this has caused him stress and risks his financial safety. As a starting point, Mr R asked for details of the account which Lowell then provided. And, when I think about the information shared this was a credit card number which it seems Mr R thought he’d paid off. The account has also been sold – which Mr R knows at this point – meaning the account with C was closed. So, effectively, the card number couldn’t be used in the usual way anymore. Because of that, I’m unclear on how this can risk his financial safety. But, I agree it’s common practice to disguise account details in some way – and Mr R has made it clear not doing so upset him. So, I think there was some impact to Mr R because of how it’s made him feel. I’ll factor this in at the end. DSAR In Mr R’s complaint of 7 January 2025 he said: Finally, I would like all information held on file in reference to myself or my case to be sent to me, if you require a subject access form to be completed, please let me know. Mr R has said no documents were provided as part of this and said this is a breach of the law. To be clear, I wouldn’t expect the documents to be held by Lowell at this time. I’ll explain. As I’ve found above, Mr R didn’t ask for proof of the debt until 23 February 2025. So, at the point he did his DSAR on 7 January 2025 Lowell didn’t have these documents. That’s because generally a debt company won’t proactively get these documents when asking someone to repay a debt – they’ll usually only get them when someone makes a request. I can’t decide if Lowell complied with Mr R’s DSAR in relation to the provision of documents, but I thought it’d be helpful to explain this. I can see Mr R is aware the correct party to consider any data protection breaches is the Information Commissioner’s Office (ICO) – and he’s already raised concerns with them. If Mr R has any further information he’d like to provide about their investigation in response to this outcome he’s welcome to do so. Summary Mr R has regularly referred to harm being caused over two years by Lowell. Based on his comments, I understand this to relate to the application of the default. But, the default was applied by C, not Lowell. So, if Mr R thinks the default wasn’t applied correctly, he can raise this with C initially. From what I can see Mr R first asked for evidence of the debt in his contact with Lowell on 23 February 2025 – earlier contacts didn’t, so I don’t agree Mr R asked for evidence of the debt before this date. But, I do uphold: • Lowell shouldn’t have contacted Mr R asking for repayment of the debt from 2 January 2025 onwards – bar a short period 30 days after this date (when Lowell

-- 5 of 9 --

said they’d put the account on hold) and up to 23 February 2025 (the day Mr R first asked for evidence of the debt) • Lowell delayed asking C for evidence of Mr R’s account – he first asked Lowell on 23 February 2025 and the evidence wasn’t provided to him until around 4 September 2025 • Lowell sending the full card number to Mr R by email without disguising it When deciding compensation, I need to consider the impact on Mr R. I’m aware he’s referred to other cases, which he says shows the harm caused is worth significantly more than the £100 currently awarded. But, each case is decided on its individual merits, so I won’t comment further on that. When thinking about the impact on Mr R I am sorry to have read about how this issue has made him feel. I agree he’ll have experienced a level of frustration and disappointment at Lowell’s poor customer service. Deciding compensation isn’t an exact science – there is no ‘that event’ equals ‘this amount of compensation’. In thinking about things, I don’t think £100 is sufficient – taking into account the length of time this matter went on for. But I’m also not persuaded Mr R’s case justifies the compensation of £750 to £1,500 he’s suggested. I say that because ultimately the account was his, and Lowell weren’t given anything to show he’d paid off the debt. I think these facts naturally mitigate the impact on Mr R. Overall, I think a total compensation amount of £200 is a fair outcome – factoring in the requests for repayment of the debt that shouldn’t have happened, the delay in requesting the proof of debt, and sending the full credit card number over email. Responses to my provisional decision Lowell replied and said they didn’t agree with my provisional decision. They said: • Mr R contacted them on 2 January 2025 and they worked it on 7 January 2025 – five days later which also included a weekend. They didn’t think it was wrong to have a few days to reply to contact from a customer. • They accepted they’d delayed asking for evidence and awarded £100 accordingly. • The 16 digit card number is no longer usable, and poses no security risk, and don’t agree it should be upheld. Overall, Lowell felt £100 was a fair outcome. Mr R also didn’t agree with my provisional decision. He said: • The documents provided in September 2025 don’t constitute adequate proof of debt • There have been repeated threats of legal action – including in April 2025 when we were looking into his complaint • It’s unfair to use the November 2024 message to assume he accepts the debt is valid and owed • Sending the full 16-digit credit card number has been seriously minimised • The DSAR wasn’t compliant • His credit file only records adverse information from Lowell and it’s their actions which have perpetuated the damage • Lowell have accepted they made an error which is significant and needs to be considered more carefully in my overall outcome

-- 6 of 9 --

Overall, Mr R felt I should say Lowell should write off the debt, remove the CRA reporting, and never contact him again. If I didn’t do that, then Mr R asks I reconsider the compensation and reiterated his thoughts that £750 to £1,500 was a fairer outcome. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Request for proof of debt, the documents provided and the DSAR Mr R says the credit agreement doesn’t prove the debt was correctly assigned or that the balance is accurate. And he says the statements can’t be verified because they’re not on headed paper and are lacking in other verifiable data. I’ve previously explained Lowell wouldn’t routinely gather all of the information Mr R has subsequently asked for – they have to get this from the original lender, C in this case. This means C also provide those documents to Lowell. Whether the documents are compliant or not, in line with the relevant law, isn’t something I can decide – only a court can do that. Lowell’s obligation is to ask for the information, and then pass it on once it’s been received. I can’t fairly hold Lowell responsible for the quality of the information C gives them. So, if Mr R has further concerns over this, he can raise a complaint with C if he’d like to. This means I don’t think Lowell did anything wrong in terms of the quality of the documents – though I’m still upholding the delay in requesting them in the first place. In respect of the DSAR Mr R says the proof of debt documents and internal notes were asked for but not supplied. I’ve explained previously Lowell wouldn’t hold the proof of debt documents and nor would they be expected to. So, I can’t agree with Mr R’s concerns on this point. Thinking about the internal notes, this isn’t something I can decide. I say that because I can consider the customer service around a DSAR – but there are exemptions to information Lowell is required to provide. My understanding is the ICO is the right body to look into that. Lowell’s contact threatening Mr R with legal action Mr R has provided three emails which he says are threatening: • 9 December 2024 – an email sent saying he’d not been in contact and threatening legal action, even though he had already been in touch • 6 January 2025 – an email again saying they’re considering taking legal action • 22 April 2025 – an email again saying they’re considering taking legal action despite the complaint being active with us at this point Mr R has said the 22 April 2025 contact is particularly serious, because threatening legal action while a complaint is with us is a significant and deeply troubling pattern of conduct. Looking at the 9 December 2024 email first I agree this is unhelpful – as Mr R had already been in contact with Lowell. So, I agree this is incorrect.

-- 7 of 9 --

In respect of the email of 6 January 2025, I take Lowell’s point they should be allowed a few days to respond to contact. So, I won’t uphold this any further. Finally, I can’t agree with Mr R about the 22 April 2025 email. Mr R says this was sent when his complaint was with us – but it wasn’t. Mr R didn’t contact us until 8 July 2025. Overall, I agree at times Lowell’s communication could have been better. November 2024 contact Mr R has said I’ve interpreted his message in November 2024 to conclude he wasn’t disputing the debt at the time. Mr R says it’s not fair or legally sound to treat it as an admission of liability when he reasonably believes the debt has been repaid. I take his point, it’s possible that’s what Mr R meant when he wrote that message to Lowell on November 2024. But, I think this comes back to the main issue as Mr R originally raised – which is he believes he’s paid off the debt. And, my finding – which is Mr R hasn’t provided evidence of repaying this amount, so it’s fair for Lowell to continue to ask him to repay it. 16-digit card number Lowell say sending the full 16-digit card number poses no risk, because the account is closed and can’t be used. Mr R says he’s concerned I’ve significantly minimised the seriousness of sharing the full card number. Mr R has said the risk posed by the full card number being shared isn’t limited to usage of the account – it was sent alongside other information which could be used to carry out identity fraud and phishing. Mr R says his distress at this was real. I’ve acknowledged how Mr R felt in receiving the full card number, and I’m sorry he feels I’ve minimised this. That isn’t my intention, but I can’t agree the disclosure of the full card number is as serious as he says it is. I say that because – as before – the account can no longer be used so the risk of any financial impact on the account is extremely limited. In terms of identity fraud Mr R hasn’t mentioned this as a concern before. I’ll accept it’s possible in some circumstances for a credit card number to be a factor in identity fraud. But, Mr R also hasn’t said he has experienced this. I can’t compensate Mr R for something that’s not happened – identity fraud. But, I can compensate him for the concern of something might happen which I’ve taken into account in my overall recommendation. Credit file impact Mr R says Lowell are the only party reporting negative information, and it’s Lowell’s conduct that has perpetuated the harm to him. I’ve already found above Lowell didn’t do anything wrong in continuing to ask Mr R for payment – and I also don’t think they’ve done anything wrong in not having proof of debt documents when he first asked. While Lowell haven’t handled everything as I’d expect, these issues are administrative in nature – and I wouldn’t expect any of the issues I have

-- 8 of 9 --

identified to mean the account information should be removed or otherwise amended on his credit file. Summary Mr R remains of the opinion £750 to £1,500 is a fair outcome – but I still can’t agree with this. As both Lowell and Mr R have said – Lowell accept they’ve made an error. Lowell think £100 is fair, Mr R says Lowell’s admission is significant and hasn’t been properly considered in their overall pattern of conduct. The issues I’m upholding are: • There was a delay in requesting proof of debt documents • The communication could have been better • I accept Mr R has been impacted by sharing the full credit card number While I’ve taken on board all of Mr R’s comments, I’ve not seen the impact he’s been caused warrants the amount of compensation he’s requested. When considering this I’ve also taken into account our published guidance on our website about compensation. So having reviewed all the facts of the case, alongside this, I’m satisfied £200 is fair compensation for the administrative issues that have occurred. My final decision I uphold this complaint and require Lowell Portfolio I LTD to pay Mr R £200 compensation. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr R to accept or reject my decision before 30 April 2026. Jon Pearce Ombudsman

-- 9 of 9 --