HSBC UK Bank Plc · DRN-5924927

The complaint Ms V complains that HSBC UK Bank Plc won’t reimburse her after she made payments towards an investment that she now considers to have been a scam. Ms V is professionally represented in bringing her complaint, but for ease of reading I’ll refer to all submissions as being made by Ms V directly. What happened Ms V has explained that she met an individual I’ll refer to as ‘Mr L’ on a committee, and they became friends. Through their friendship, Ms V met other friends who she heard had invested in Mr L’s company (which I’ll refer to as ‘G’) who said their investments were performing well. Ms V understood G to be an electrical installation company that had a sizeable contract with a hotel chain, to be its exclusive supplier of air conditioning units. After knowing Mr L for several years, Ms V was asked if she wanted to also invest, which she agreed to. Ms V was told she would receive returns of 1.06% every month and she appointed a solicitor to write a ‘guarantee document’, designed to guarantee her returns every three months when her loan renewed. Ms V made a payment of £1 to G in October 2022, followed by £66,097 the following month. On the same day, Ms V also sent over £115,000 from two accounts she held with other banking providers. Ms V then made a further payment of £70,000 in November 2023, and £7,149.28 in July 2024, both of which were from her HSBC account. Ms V received returns of £35,064.43 between January 2023 and June 2024. However, Ms V became concerned about her investment when her returns stopped and other investors alerted her to issues. Mr L told her that G’s bank account had been closed and so he couldn’t bank payments from the hotel chain. Administrators were appointed for G in September 2024. Believing she’d fallen victim to a scam, Ms V contacted her banking provider, HSBC, to make a claim. HSBC considered Ms V’s claim but declined to reimburse her. It said that Ms V had received returns from G and that it had now entered administration. HSBC therefore considered this was a civil matter between Ms V and G. Ms V remained unhappy and referred her complaint to our service. An Investigator considered the complaint and upheld it. He thought the available evidence supported that G was a scam, rather than a failed investment and that Ms V’s claim was therefore covered under the Lending Standards Board’s Contingent Reimbursement Model (CRM) Code. He didn’t think any valid exceptions to reimbursement under the Code applied and that Ms V was therefore entitled to a refund of payments made. As credits received from the scam totalled 12.58% of the overall money Ms V paid into the scam, the Investigator considered it fair that any redress owed by HSBC could be reduced by 12.58% also. Ms V agreed with the Investigator’s view, but HSBC didn’t. To summarise, it said the following: • It believed it could rely on R3(1)(c) of the CRM Code that states that ‘if a case is

-- 1 of 6 --

subject to investigation by a statutory body and the outcome might reasonably inform the Firm’s decision, the Firm may wait for the outcome of the investigation before making a decision’. It says our service is not party to the full facts, which is something that a criminal investigation will ascertain. It said a premature outcome by our service may prejudice future criminal proceedings. • Our service hasn’t explored whether Ms V’s specific funds were used for their intended purpose, but instead made an unreliable, holistic balance of probability. • HSBC disagrees with the principle that it should be liable for a failed investment scheme that it could not reasonably have detected or prevented, or that it couldn’t have disturbed with an effective warning. The complaint has therefore been referred to me for a final decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. It’s important to highlight that with cases like this, in deciding whether there was in fact a scam, I need to weigh up the available evidence and make my decision about what I think is likely to have happened on the balance of probabilities – in other words what I think is more likely than not to have happened in the circumstances. When considering what is fair and reasonable, I’m also required to take into account: relevant law and regulations; regulatory rules, guidance and standards; codes of practice; and, where appropriate, what I consider to have been good industry practice at the relevant time. In broad terms, the starting position in law is that a firm is expected to process payments and withdrawals that a customer authorises, in accordance with the Payment Services Regulations and the terms and conditions of the customer’s account. However, where the customer made the payment as a consequence of the actions of a fraudster, it may sometimes be fair and reasonable for the bank to reimburse the customer even though they authorised the payment. HSBC was a signatory of the Lending Standards Board’s Contingent Reimbursement Model (the CRM Code) which took effect on 28 May 2019 until it was retired on 7 October 2024. The Code required firms to reimburse customers who had been the victims of certain types of scams, in all but a limited number of circumstances. But customers are only covered by the CRM Code where they have been the victim of an authorised push payment (APP) scam – as defined within the CRM Code. Can HSBC delay making a decision under the CRM Code? HSBC has suggested that the exception R3(1)(c) of the CRM Code should be applied here, as there are ongoing investigations into G. While this exception provides a reason why firms may delay providing a claim outcome under the CRM Code, it doesn’t impact that customer’s right to refer the complaint to our service – and similarly it doesn’t impact our service’s ability to provide a complaint outcome when we consider we have sufficient evidence to do so. Additionally, this exception needs to be raised by the firm, prior to it having reached an outcome on the claim under the CRM Code, which HSBC hasn’t done in this case.

-- 2 of 6 --

I’ve therefore gone on to consider below whether we do have enough evidence to proceed at this time on Ms V’s complaint. Is it appropriate to determine Ms V’s complaint now? I am aware there is an ongoing investigation into G, and there may be circumstances and cases where it is appropriate to wait for the outcome of external investigations. But that isn’t necessarily so in every case, as it will often be possible to reach conclusions on the main issues on the basis of evidence already available. And I am conscious that any criminal proceedings that may ultimately take place have a higher standard of proof (beyond reasonable doubt) than I am required to apply (the balance of probabilities). The Lending Standards Board has said that the CRM Code does not require proof beyond reasonable doubt that a scam has taken place before a reimbursement decision can be reached. Nor does it require a firm to prove the intent of the third party before a decision can be reached. So in order to determine Ms V’s complaint I have to ask myself whether I can be satisfied, on the balance of probabilities, that the available evidence indicates that it is more likely than not that Ms V was the victim of a scam rather than a failed investment. I’ve reminded myself that Parliament has given ombudsmen the job of determining complaints quickly and with minimum formality. In view of this, I think that it would not be appropriate to wait to decide Ms V’s complaint unless there is a reasonable basis to suggest that the outcome of any external investigation may have a material impact on my decision over and above the evidence that is already available. However, for the reasons I discuss further below, I don’t think it’s necessary to wait until the outcome of the police investigation for me to reach a fair and reasonable decision. Has Ms V been the victim of a scam, as defined in the CRM Code? The relevant definition of a scam in accordance with the CRM Code is that the customer ‘transferred funds to another person for what they believed were legitimate purposes but were in fact fraudulent. ‘ DS2(2)(b) of the CRM Code says it doesn’t apply to: “private civil disputes, such as where a Customer has paid a legitimate supplier for goods, services or digital content but has not received them, they are defective in some way, or the Customer is otherwise dissatisfied with the supplier” So, it doesn’t cover a genuine investment or a genuine business that subsequently failed. I’ve therefore thought about whether the purpose for Ms V having made these payments was a legitimate one, whether her intentions broadly aligned with G’s, and if not, whether this was due to dishonest deception on the part of G. Ms V has provided evidence in the form of correspondence from the time of payments that she intended to invest in G, with her quarterly returns being credited to her and her main capital investment rolling over. I’ve therefore thought about what G’s intentions were when receiving Ms V’s funds. Having done so I agree with the outcome reached by our Investigator that G did not use investor funds in the manner it set out to investors and that this was due to dishonest deception. As these have already been set out in detail, I don’t intend to repeat them all here, but to highlight some of the key findings:

-- 3 of 6 --

• While a genuine contract with a hotel chain did exist, the value of the contract between 2021 and 2024 was £4.4m. However, when G went into administration, it owed £25.3m to investors. The levels of revenue quoted by G haven’t been seen on the receiving accounts. • Administrators have stated that “We cannot confirm with certainty how much of that (investor) money was used to purchase units or for the ordinary course of business, but it is significantly lower than the amount raised by the investors.” This raises concerns about why G continued to accrue such high levels of investment for work that wasn’t being completed on this scale. • G claimed to have a credit insurance policy which provided protection to investors. However, the insurer has confirmed that no such policy exists and that the reference number quoted doesn’t match its formatting. • Administrators have confirmed spending by G on the following: o Around $6m spent sponsoring a motor racing team; o £500,000 used by one of G’s directors for home improvements that has not been paid back; o Around £4m to international accounts that G claims was made towards an investment that turned out to be a scam; o A further £2m sent internationally for an investment that G also claims has committed fraud against G. • We’ve also seen evidence of G advising investors of a new contract worth £3.6m with the hotel chain in question, but administrators have found no evidence of the suggested contract. HSBC has argued that our service hasn’t determined specifically whether Ms V’s payments were used for their intended purpose, but I don’t consider that changes things here. The point remains that G was advertising a business model that investor’s funds were being used directly to fund air conditioning units with a quick turn around of returns which were passed straight back to investors, when actually this wasn’t what G was, on the whole, doing with those funds. Whether or not a small proportion of payments were used in this format doesn’t change the fact that the overall use of funds was entirely at odds with the proposal Ms V was presented with and based her decision to invest on. Based on how additional funds were used, it appears that this was the result of dishonest deception. Therefore, considering all evidence holistically, I am satisfied that it is more likely G was not acting legitimately, since its intentions did not align with Ms V’s intentions, and I am satisfied that G was dishonest in this regard. It follows that I’m satisfied Ms V was the victim of a scam. Is Ms V entitled to a refund under the CRM code? As referenced above, HSBC was a signatory of the CRM Code when these payments were made, which required firms to reimburse customers who had been the victims of APP scams like this, in all but a limited number of circumstances and it is for HSBC to establish that a customer failed to meet one of the listed exceptions set out in the CRM Code.

-- 4 of 6 --

I understand HSBC has disagreed with the principle that it should be liable for Ms V’s losses in a situation where an effective warning wouldn’t have disrupted Ms V’s payments. However, the CRM Code was a voluntary Code that HSBC was a signatory of at the time these payments were made, and the Code is clear in setting out that where there is no blame on either the customer or firm’s actions, the customer is still entitled to reimbursement. I therefore can’t agree with HSBC relying on this as a reason to not reimburse Ms V now. Under the CRM Code, a bank may choose not to reimburse a customer if it can establish that*: • The customer ignored what the CRM Code refers to as an “Effective Warning” by failing to take appropriate action in response to such an effective warning • The customer made payments without having a reasonable basis for believing that: the payee was the person the Customer was expecting to pay; the payment was for genuine goods or services; and/or the person or business with whom they transacted was legitimate *Further exceptions outlined in the CRM Code do not apply to this case. Did HSBC meet its obligations under the CRM Code and did Ms V ignore an effective warning? Ms V made her first two payments in branch, where some notes have been provided on what was discussed. In each of these I can see Ms V was honest that she was investing - and provided further information about G, as well as steps she’d taken to protect herself such as the use of a solicitor. For the third payment, Ms V initially made this online and received an on-screen warning about investments. This was followed up by a call with HSBC, which it has been able to provide our service. Having listened to the call, I can see Ms V was asked for a lot of information about how the investment worked and profited, how Ms V found out about the investment, checks were conducted to ensure Ms V was receiving credits that she stated and that the account details matched the intended beneficiary. Overall I don’t think there’s anything the caller could reasonably have done during this call to have identified that Ms V was falling victim to a scam, based on G still being an active firm this time, with no negative online presence. However, as already referenced, in a situation where HSBC couldn’t have prevented its customer’s losses, for HSBC to determine that it’s not liable to refund Ms V, I’d need to be satisfied that she therefore contributed to her losses from her own actions. I’ve therefore gone on to consider this. Did Ms V have a reasonable basis for belief? I’ve thought carefully about all the available evidence in deciding whether Ms V acted reasonably when making these payments. Ms V has said (and this can also be seen from email evidence at the time of the scam) that she had known Mr L for a number of years and was aware that others invested with him, but while this opportunity was open to her, he had never pressured her to do so. Ms V has also expressed that she knew other friends who had invested for several years and were happy with the performance of their investments. I think

-- 5 of 6 --

the basis of friendship over an extended period would have been powerful in convincing Ms V that this was a legitimate opportunity. I’m mindful that Ms V instructed a solicitor to review the contract she had with G – and the solicitor highlighted some concerns over its legitimacy and their similarity to scams (such as claiming to be ‘risk free’ and the lack of documentation given the size of the investment). However, the solicitor did also accept he wasn’t saying it was definitely a scam, but that he’d encourage getting comfortable with the basics of the investment before proceeding. Additionally, when Ms V explained her longstanding friendship with Mr L, as well as her knowledge of other investors he confirmed that was ‘really reassuring’ and worked with Ms V to adapt the contract to better protect her. I therefore don’t think this suspicion from her solicitor was so concrete in its nature that Ms V acted unreasonably to proceed, particularly as her own explanation of the circumstances seemed to allay the solicitor’s immediate concerns. Overall, for the reasons I’ve explained above, I think it is fair for our service to consider Ms V’s complaint based on the evidence currently available and having done so, I think it is fair and reasonable for HSBC to reimburse her under the CRM Code. Putting things right Ms V’s total investment into G across all of her banking providers was £278,748.28. Her returns of £35,064.43 therefore are equal to 12.58% of her losses. With this in mind, I think it’s fair for HSBC to deduct redress owed to Ms V by 12.58%. My final decision My final decision is that I uphold Ms V’s complaint against HSBC UK Bank Plc and I direct it to: • Refund Ms V the payments she made towards the scam (totalling £143,247.28), with a deduction of 12.58% to account for returns received. • Apply 8% simple interest, from the date it declined Ms V’s claim under the CRM Code, until the date of settlement. Under the rules of the Financial Ombudsman Service, I’m required to ask Ms V to accept or reject my decision before 12 March 2026. Kirsty Upton Ombudsman

-- 6 of 6 --