HSBC UK Bank · DRN-6212636

The complaint X complains that HSBC UK Bank Plc (‘HSBC’) won’t refund her the money she lost after falling victim to a scam. What happened In 2023 X was introduced to an investment (I will refer to as V in this decision) by her partner – whose former work colleague (J) was running his own successful trading company. X’s partner’s investment was doing well with V - so she also decided to invest. Between 27 February 2023 and 2 March 2023 X transferred £20,000 over four incremental payments to V. On 18 May 2023, X received an email from V regarding on-going delays with withdrawals and deposits, as well as news that the FCA (Financial Conduct Authority) had asked V to pause any future trading until the situation was resolved. On 12 June 2023, a further email confirmed that the business had been engaging in regulated activities without authorisation from the FCA. So, she reported the matter as a scam to HSBC. HSBC didn’t give X a response to her claim. It has said there are ongoing investigations by external organisations, so it is unable to reach an answer on whether X was the victim of a scam and whether she is entitled to a refund. X was unhappy with the lack of response from HSBC and brought a complaint to our service. An investigator looked into X’s complaint and recommended that HSBC refund her in full. The investigator felt there was sufficient evidence to reach an answer on X’s complaint under the Contingent Reimbursement Model Code (CRM Code). The investigator found the evidence supported that it was unlikely X’s funds were used for their intended purpose and that they had been obtained by dishonest deception, so her claim was covered by the CRM Code. The investigator also wasn’t satisfied that HSBC could rely on an exception to reimbursement under the CRM Code. He therefore recommended a full refund of £20,000, as well as 8% simple interest from 15 business days after the scam was reported, to the date of the settlement. HSBC disagreed with the investigator’s opinion and raised the following points: The Financial Ombudsman Service (FOS) is acting prematurely in advancing these matters. In accordance with the CRM Code, specifically R3(1)(c), it is entitled to pause the outcome at this stage. FOS does not have access to the full breadth of information available to law enforcement and the Financial Conduct Authority (FCA), both of whom are conducting ongoing and complex investigations. In such circumstances, it is neither safe nor reasonable to draw conclusions based solely on the balance of probabilities. The criminal and regulatory investigations must be considered in order to reach a conclusion based on the actual facts whether there was an intent to scam from the outset. It is also concerned that premature conclusions by FOS could prejudice future criminal proceedings, for example, by discouraging victims from participating if they have already received compensation.

-- 1 of 6 --

It fundamentally disagrees with the notion that HSBC should be held liable for losses arising from a failed investment scheme that could not reasonably have been detected or prevented. At the time the payments were made, there was no opportunity for HSBC to provide an effective warning that would have disrupted the transactions. As the case could not be resolved informally, it’s been passed to me for a decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. When considering what is fair and reasonable, I’m also required to take into account: relevant law and regulations; regulatory rules, guidance and standards; codes of practice; and, where appropriate, what I consider to have been good industry practice at the relevant time. It’s important to highlight that with cases like this I can’t know for certain what has happened. So, I need to weigh up the evidence available and make my decision on the balance of probabilities – in other words what I think is more likely than not to have happened in the circumstances. In broad terms, the starting position in law is that a firm is expected to process payments and withdrawals that a customer authorises, in accordance with the Payment Services Regulations and the terms and conditions of the customer’s account. However, where the customer made the payment as a consequence of the actions of a fraudster, it may sometimes be fair and reasonable for the bank to reimburse the customer even though they authorised the payment. Of particular relevance to the question of what is fair and reasonable in this case is the Lending Standards Board’s (LSB) CRM Code for authorised push payment scams. The CRM Code was a voluntary code for reimbursement of authorised push payment scams which required firms to reimburse customers who have been the victims of APP scams - in all but a limited number of circumstances. HSBC was a signatory to the CRM Code at the time the payments in question in this case were made. Is it appropriate to determine this complaint now? HSBC says it couldn’t give X an answer on her claim, and that our service can’t fairly reach an outcome, due to ongoing investigations into V and its affiliated companies. Under the CRM Code HSBC could defer giving an answer on a CRM complaint in accordance with R3 (1)(c), which says: “if a case is subject to investigation by a statutory body and the outcome might reasonably inform the Firm’s decision, the Firm may wait for the outcome of the investigation before making a decision. I have considered whether it would be appropriate to delay my decision in the interests of fairness, as I understand that the FCA and police investigations are still ongoing.

-- 2 of 6 --

There may be circumstances and cases where it’s appropriate to wait for the outcome of external investigations and/or related court cases. But that isn’t necessarily so in every case, as it may be possible to reach conclusions on the main issues on the basis of evidence already available. And it may be that the investigations or proceedings aren’t looking at quite the same issues or doing so in the most helpful way. I’m conscious, for example, that any criminal proceedings that may ultimately take place might concern charges that don’t have much bearing on the issues in this complaint; and, even if the prosecution were relevant, any outcome other than a conviction might be little help in resolving this complaint because the Crown would have to satisfy a higher standard of proof (beyond reasonable doubt) than I’m required to apply (which – as explained above – is the balance of probabilities). The Lending Standards Board has said that the CRM Code does not require proof beyond reasonable doubt that a scam has taken place before a reimbursement decision can be reached. Nor does it require a firm to prove the intent of the third party before a decision can be reached. So in order to determine X’s complaint, I have to ask myself whether, on the balance of probabilities, the available evidence indicates that it’s more likely than not that X was the victim of a scam rather than a failed investment. But I wouldn’t proceed to that determination if I consider fairness to the parties demands that I delay doing so. I’m aware that X first raised her claim with HSBC on 13 November 2025 and I need to bear in mind that this service exists for the purpose of resolving complaints quickly and with minimum formality. With that in mind, I don’t think delaying giving X an answer for an unspecified length of time would be appropriate unless truly justified. And, as a general rule, I’d not be inclined to think it fair to the parties to a complaint to put off my decision unless, bearing in mind the evidence already available to me, a postponement is likely to help significantly when it comes to deciding the issues. I’m aware the above processes might result in some recoveries for V’s investors; in order to avoid the risk of double recovery, I think HSBC would be entitled to take, if it wishes, an assignment of the rights to all future distributions to X under those processes in respect of this investment before paying anything I might award to them on this complaint. For the reasons I discuss further below, I don’t think it’s necessary to wait for the outcome of the FCA or criminal investigation for me fairly to reach a decision on whether HSBC should reimburse X under the provisions of the CRM Code. Has X been the victim of an APP scam, as defined in the CRM Code? Under the CRM Code, the starting principle is that a firm should reimburse a customer who is the victim of an APP scam (except in limited circumstances). And it is for the firm to establish that any exceptions apply. The CRM Code also says it doesn’t apply to private civil disputes, such as where a customer has paid a legitimate supplier for goods or services but has not received them, they are defective in some way or the customer is otherwise dissatisfied with the supplier. So it wouldn’t apply to a genuine investment that subsequently failed. And the CRM Code only applies if the definition of an APP scam, as set out in it, is met.

-- 3 of 6 --

An “APP scam” is defined in the Definitions and Scope section of the CRM Code: “Authorised Push Payment scam, that is, a transfer of funds executed across Faster Payments, CHAPS or an internal book transfer, authorised by a Customer in accordance with regulation 67 of the PSRs, where: (i) The Customer intended to transfer funds to another person, but was instead deceived into transferring the funds to a different person; or (ii) The Customer transferred funds to another person for what they believed were legitimate purposes but which were in fact fraudulent.” I’ve considered the first part of the definition, and having done so I’m satisfied that X paid the account she was intending to send the funds to. And I do not think there was any deception involved when it comes to who she thought she was paying. So, I do not think the first part of the definition set out above affects X’s transactions. I’ve gone on to consider if X’s intended purpose for the payment was legitimate, whether the intended purposes she and V had were broadly aligned and, if not, whether this was the result of dishonest deception on the part of V. From what I’ve seen and what X has told us, I’m satisfied X made the payment with the intention of investing in V. And I haven’t seen anything to suggest that X didn’t think this was legitimate. I’ve considered whether there is convincing evidence to demonstrate that V’s intentions with X’s funds was significantly different to this, and so whether this was a scam or genuine investment. But I think the evidence I’ve seen suggests V didn’t intend to act in line with the purpose for the payments it had agreed with X. In reaching an answer on what purpose V had in mind, I’ve considered the wider circumstances surrounding V, and its directors and any linked businesses. The key information to this case is: • V claimed to be regulated by the CSSF (Commission de Surveillance du Secteur Financier) and that it was pending regulation from the FCA. However, both the CSSF and FCA have said this isn’t true. Even after the FCA’s intervention in April 2023, V still made claims to investors that it was with the CSSF, which also wasn’t true. • There is no evidence to substantiate V’s claims around the profits they say they were able to generate via Forex trading. • Investors were told that their funds would be immediately moved to a trading account and used for Forex trading. V’s account provider (the receiving bank for X’s payments) has provided evidence which shows none of the funds into V’s account were used for the intended purpose of being sent to a Forex trading account. Instead, approximately £2,000,000 was sent to a cryptocurrency exchange and around £900,000 was sent to investors as returns. • V’s account provider has shown that when V applied for accounts it lied at least twice, this was about partnering with a trading exchange and that it was regulated.

-- 4 of 6 --

Considering all of the above, I do not think V was using investor funds, such as X’s £20,000, for the purpose they were intended for. And I think this difference in purpose is down to dishonest deception on V’s part. It follows that I think this complaint meets the definition of an APP scam as set out in the CRM Code above. Returning to the question of whether in fairness I should delay reaching a decision pending developments from external investigations, I have explained why I should only postpone a decision if I take the view that fairness to the parties demands that I should do so. In view of the evidence already available to me, however, I don’t consider it likely that postponing my decision would help significantly in deciding the issues. In regard to the FCA’s investigations, there is no certainty as to what, if any, prosecutions may be brought in future, nor what, if any, new light they would shed on evidence and issues I’ve discussed. I should also add that in reaching my finding that V was likely a scam, I’m in no way seeking to take priority over any ongoing investigations. Nor would I expect this decision to impact any ongoing investigations. I do not name the company or individuals at the centre of the investigation, and even if I had, neither the FCA nor a police investigation would be bound to follow the outcome reached in this case. As I’ve mentioned the burden of proof differs between my consideration of this case and that required of the FCA and the police, which may be seeking to bring criminal charges against individuals associated with V. And so, it is entirely possible that we could reach different conclusions. Is X entitled to reimbursement under the CRM Code? There are two exceptions to reimbursement to consider here: - X ignored an ‘Effective Warning’ - X made the payments without a reasonable basis for believing that they were for genuine goods or services; and/or V was legitimate. The Code also says that the assessment of whether these matters can be established should involve consideration of whether they would have had a material effect on preventing the APP scam that took place. HSBC hasn’t provided any commentary, either in its file to us, or following the investigator’s view, as to whether it considers any exceptions to the CRM Code should be applied here. And, as explained, it’s for HSBC to establish that an exception applies. However, for completeness, I’ve provided a brief summary below as to why I think X’s complaint should be covered by the CRM Code. Did X ignore an effective warning? In its internal notes HSBC commented prior to the first payment here, X had attempted to transfer £20,000 giving the payment purpose ‘investment’. It paused the payment and eventually cancelled it, as it didn’t receive any contact from X. For the following payments, which X made to the same payee as the initial cancelled payment, a warning based on the payment purpose she selected was displayed. X selected ‘goods and services’. Such a warning would not have been relevant to the circumstances X found herself in, so I can’t say X ignored an effective warning. In any event, I’m not convinced any actions X could have taken in response to an effective warning would have had a material impact on preventing the scam given the sophistication of this particular scam. And so I find that the effective warning exception cannot be fairly applied.

-- 5 of 6 --

Did X have a reasonable basis for belief? I have also considered whether X had a reasonable basis for believing V was legitimate and was providing a genuine investment product. In doing so, I have considered X’s comments that her partner has previously worked with J – one of the directors of V. So this wasn’t a more typical ‘cold call’ investment scam. Indeed, this was a sophisticated scam, with lots of similarities to a genuine investment of this nature - with professional marketing, a website, a platform personalised to investors, regular updates and numerous staff members. V was registered on Companies House and X was of the understanding that it was undergoing registration with the CSSF - without any advice to the contrary from HSBC on the importance of being FCA registered, I can understand why this would have reassured her on V’s legitimacy. The documentation included a risk disclosure similar to a genuine investment. There was nothing in the public domain at the time about V or its associates that X could’ve reasonably inferred from, that a scam was taking place in an otherwise plausible set of circumstances. Given HSBC’s strength of feeling that this remains a genuine investment - it’s difficult to see how – at the time X made the payments - there was anything about the investment that should have caused her concern. Overall, for the reasons I’ve explained above, I think it is fair for our service to consider X’s complaint based on the evidence currently available and having done so, I think it is fair and reasonable for HSBC to fully reimburse her under the CRM Code. Putting things right In order to put things right for X, HSBC UK Bank Plc must reimburse X the £20,000 in full. It should also apply 8% simple interest on the sum above from the date of the view (13 January 2026) to the date of settlement. I say this because the information our service has relied upon to uphold X’s complaint was not readily available to HSBC when the scam claim was first raised. So, they would not have been able to identity the issues that led to the complaint eventually being upheld. As there is an ongoing investigation, it’s possible X may recover some further funds in the future. In order to avoid the risk of double recovery, HSBC is entitled to take, if it wishes, an assignment of the rights to all future distributions under the liquidation process in respect of this £20,000 investment before paying the award. If the bank elects to take an assignment of rights before paying compensation, it must first provide a draft of the assignment to X for her consideration and agreement. My final decision My final decision is that I uphold this complaint, and I require HSBC UK Bank Plc to put things right for X as set out above Under the rules of the Financial Ombudsman Service, I’m required to ask X to accept or reject my decision before 30 April 2026. Kathryn Milne Ombudsman

-- 6 of 6 --