HSBC UK Bank PLC · DRN-5982263

The complaint Mrs E is unhappy that HSBC UK Bank PLC (‘HSBC’) won’t refund the money she lost after she reported being the victim of a scam. What happened In October 2019, Mrs E decided to invest in a company which I shall call ‘B’. B offered investment opportunities to do with leasing cars. Investors were told their money would be used to fund the purchase of vehicles at a discount which would then be leased out, this would fund fixed interest payments back to the investors each month. The agreement also specified that investors would get back their capital at the end of the end of the agreed term. Mrs E had previously successfully invested in B with other family members. Mrs E made a payment of £14,000 to B in October 2019. She had agreed to invest this amount with B for a three year term. Mrs E was expecting to receive 36 monthly interest payments of £267.36 as a result. In reality, she received 15 monthly interest payments of £267.36 from a connected company (which I shall call ‘R’) up until January 2021. However Mrs E didn’t receive any further payments after this date as B and R had gone into administration. Since then there has been a criminal investigation by the Serious Fraud Office (‘SFO’) into the directors of B and R. They were subsequently charged with fraud and a court case has been scheduled for later on in 2026. Mrs E submitted a claim to the Financial Services Compensation Scheme (‘FSCS’) regarding R. Her losses weren’t reimbursed as part of that claim and in 2025 she was told to contact her bank to make a claim under the Contingent Reimbursement Model (‘CRM Code’). HSBC declined Mrs E’s claim as they said what happened was a civil dispute, and so isn’t covered under the CRM Code. Mrs E then brought her complaint to the Financial Ombudsman Service as she was unhappy with this response. Our Investigator looked through everything and upheld the complaint. He thought B and R were part of a scam and thought Mrs E should be reimbursed under the CRM Code. HSBC disagreed with the view as they felt it was too soon to make a decision, so the matter has come to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, I have decided to uphold this complaint. I’ll explain why. It isn’t in dispute that Mrs E authorised the payment to R. So, in line with the Payment Services Regulations 2017 – the starting position is that she is liable for the transaction. But

-- 1 of 6 --

Mrs E says that she has been the victim of an Authorised Push Payment (‘APP’) scam – so this isn’t the end of the story. HSBC signed up to the voluntary CRM Code which was in place until 6 October 2024. The CRM Code provided additional protection to scam victims and the starting principle was that a firm should reimburse a customer who is the victim of an APP scam (except in limited circumstances). Can HSBC delay making a decision under the CRM Code? HSBC’s submission suggests that they want a delay on making a decision on Mrs E’s case until the criminal court case involving the directors of B and R has concluded. The CRM code says firms should make a decision as to whether or not to reimburse a customer without undue delay but that, if a case is subject to investigation by a statutory body and the outcome might reasonably inform the firm’s decision, they may wait for the outcome of the investigation before making a decision. This is section R3(1)(c) of the CRM Code. But this provision only applies before the firm has made their decision under the CRM Code – they can’t seek to delay a decision they have already made. And HSBC only raised this after the case was referred to the Financial Ombudsman Service and they had already reached a decision on Mrs E’s claim. In their final response letter to Mrs E, dated 21 August 2025, HSBC said she made a payment to a legitimate company and this didn’t fall under the remit of the CRM code. So I don’t think they can now rely on this provision here. In any event, the SFO had been carrying out an investigation into B, R and several other connected companies. But that investigation concluded on 19 January 2024 when the SFO published the outcome of the investigation on its website. This included the charging of former company directors with fraud. The Lending Standards Board has also said that the CRM Code does not require a criminal test to have been met before a reimbursement decision can be reached. In other words, it doesn’t need to be demonstrated beyond all reasonable doubt that fraud has taken place. Nor does it require a firm to prove the intent of the third party before a decision can be reached. Since the SFO has concluded its investigation and the related court case isn’t scheduled to come to trial for a very long time, I don’t think it would be fair to delay making a decision on whether to reimburse Mrs E any further. There may be circumstances and cases where it’s appropriate to wait for the outcome of external investigations and/or related court cases. But that isn’t necessarily so in every case, as it may be possible to reach conclusions on the main issues on the basis of evidence already available. And it may be that the investigations or proceedings aren’t looking at quite the same issues or doing so in the most helpful way. I’m conscious, for example, that any criminal proceedings that may ultimately take place might concern charges that don’t have much bearing on the issues in this complaint; and, even if the prosecution were relevant, any outcome other than a conviction might be little help in resolving this complaint because the Crown would have to satisfy a higher standard of proof (beyond reasonable doubt) than I’m required to apply (which is the balance of probabilities). In order to determine Mrs E’s complaint, I have to ask myself whether, on the balance of probabilities, the available evidence indicates that it’s more likely than not that she was the victim of a scam rather than a failed investment. But I wouldn’t proceed to that determination if I consider fairness to the parties demands that I delay doing so. I’m aware that Mrs E first raised her claim with HSBC in June 2025 and I need to bear in mind that this service exists for the purpose of resolving complaints quickly and with minimum formality. With that in mind, I don’t think delaying giving Mrs E an answer for an unspecified length of time would be appropriate unless truly justified. And, as a general rule, I’d not be inclined to think it fair to the parties to a complaint to put off my decision unless, bearing in mind the evidence already available to me, a postponement is likely to help significantly when it comes to deciding the issues.

-- 2 of 6 --

For the reasons I discuss further below, I don’t think it’s necessary to wait for the outcome of any connected court cases for me fairly to reach a decision on whether HSBC should reimburse Mrs E under the provisions of the CRM Code. Has Mrs E been the victim of a scam? The relevant section of the CRM Code defines an APP scam as: The Customer transferred funds to another person for what they believed were legitimate purposes but which were in fact fraudulent. So for me to find that Mrs E had been the victim of a scam, rather than a civil dispute, I would need to be satisfied that: (a) There was a misalignment between Mrs E’s purpose for making the payment and the directors of B’s purpose for procuring the payment; and (b) The difference between the two purposes must be due to dishonest deception on the part of the directors of B. One of the key considerations here is thinking about what were the directors of B’s intentions from the start of the process – did they intend to dishonestly deceive Mrs E? Did they intend to use the investment money to purchase cars and lease them out? I appreciate there are challenges in establishing what another person’s intentions were and that I cannot know for sure. So I must consider all the available evidence and weigh this up in order to decide on balance what I think the directors of B’s intentions are likely to have been. I also want to make it clear that the threshold for me saying fraud has occurred is a high one, (though not as high as in criminal proceedings). My role is to decide if I think fraud is more likely than not to have happened. It isn’t enough for fraud to be one of a number of plausible theories for what happened, it has to have been more likely than not to have occurred. Having looked at everything submitted, I think it’s likely on the balance of probabilities that fraud occurred here. I’ll explain why below. - Mrs E says she was told that her investment would fund a specific vehicle and would be secured in her favour with a fixed charge until the lease was paid off. However there isn’t a fixed charge in her favour according to Companies House records and her agreement with B doesn’t list what car her funds are purchasing, it just says “TBC”. There are multiple sources of evidence suggesting that this was the case for the majority of investors. For example, the Financial Conduct Authority (‘FCA’)’s supervisory notice to one of B’s connected companies said that though there were 1,200 leases, there were only 69 registered charges on Companies House. This suggests to me that it’s likely the majority of investors didn’t have their investment protected by a charge in their favour. - In a similar vein, the administrator’s report for one of B’s connected companies said the total number of loan agreements was 3,609, relating to 834 investors, but at the time of the appointment of the administrators, there were only 596 cars owned by the companies associated with B, which is less than one car for every six loan agreements. So the evidence here strongly suggests that the majority of the funds paid weren’t being spent on cars as agreed.

-- 3 of 6 --

- The FCA also said that a significant number of leases started before the cars were put on the road and some vehicles weren’t found on the DVLA database at all. They also said that B’s valuation of its cars was unrealistic and that the companies associated with B’s liabilities significantly exceeded their assets. - B also claimed that they would be using investors’ money to purchase mainly new cars at a discount in order to lease them out. However, the FCA checked a sample of the vehicles B held on the DVLA database and found that a significant proportion of the fleet was second hand, which wouldn’t have qualified for the discount B claimed it could get. - The SFO’s press release from 19 January 2024 states they have accused the directors of B of having provided investors with false information, encouraging people to pay in whilst knowing that the investments were not backed up by the cars they had promised. This suggests that the directors of B procured payments for the investment with dishonest deception. Returning to the question of whether in fairness I should delay reaching a decision pending developments from an upcoming court case, I have explained why I should only postpone a decision if I take the view that fairness to the parties demands that I should do so. In view of the evidence already available to me, however, I don’t consider it likely that postponing my decision would help significantly in deciding the issues. I have relied on a number of publicly available reports and press releases to reach my conclusion, such as the FCA’s supervisory notice, the SFO’s press release from 19 January 2024 and the administrators report for one of B’s connected companies. And whilst the criminal court case for the directors of B hasn’t taken place yet, it’s unclear what, if any new light they would shed on the evidence and issues I’ve discussed. Based on the reasons above, I think B’s actions meet the definition of an APP scam under the CRM Code and so I have gone on to consider if Mrs E is entitled to a refund under the CRM Code. Is Mrs E entitled to a refund under the CRM Code? Under the CRM Code, a firm may choose not to reimburse a customer if it can establish that a reason stipulated in the Code applies, for example: • The customer ignored an effective warning in relation to the payment being made; or • In all the circumstances at the time of the payment, in particular the characteristics of the customer and the complexity and sophistication of the APP scam, the customer made the payment without a reasonable basis for believing that: o the payee was the person the customer was expecting to pay; o the payment was for genuine goods or services; and/or o the person or business with whom they transacted was legitimate Having considered the evidence, I don’t think that an exception applies and will explain why below. Did HSBC show an effective warning? HSBC hasn’t specifically said they showed Mrs E an effective warning, but they did provide a warning to her when she selected that she was paying for ‘services’ on her online banking: “Take Care When Sending Money Online Are you sure you want to make this payment?

-- 4 of 6 --

Stop, think and talk to someone you trust. Fraudsters can contact you unexpectedly and pressurise you into making a payment quickly. We may not be able to recover payments that turn out to be fraudulent. Is there are more secure way to make the payment, such as debit or credit card? Visit out Fraud Centre to find out more. [Link to guide] By clicking continue, you agree you have read our advice and are happy to proceed with the payment.” For avoidance of doubt, I considered if this warning is effective. The CRM Code gives minimum criteria for what makes a warning effective, and in this instance I don’t think it was impactful or specific enough to meet the minimum standards expected. The warning wasn’t impactful as it wasn’t relevant to Mrs E; she wasn’t being pressured into making payment. She was also introduced to the investment by her family, so the advice to speak to someone she trusted wouldn’t have helped in this situation. I appreciate that it would’ve been harder for HSBC to give an effective warning here as Mrs E said she was paying for a service, which may not have been the most appropriate selection to pick, but nonetheless, HSBC can’t decline reimbursement to Mrs E as she can’t be said to have ignored an effective warning. Did Mrs E have a reasonable basis of belief? I think that Mrs E had a reasonable basis for believing the investment opportunity was legitimate. I say this because: - she had successfully invested before and received money back, so she had no reason to think a second investment wouldn’t be successful. - she knew others who were receiving returns on their investments, which was also reassuring that the investment was legitimate. - she had previously checked Companies House, and was reassured that B was a legitimate company. Further to the points above, one of B’s associated companies was regulated by the FCA, so even if Mrs E had done further research, I think it would have been difficult for her to find any evidence that the matter was a scam at the time. I’m satisfied that she had a reasonable basis for believing the investment was legitimate. So, I don’t think HSBC has established that they have grounds not to reimburse Mrs E under the CRM Code, and I think they should refund the lost money in the way I will set out below. Putting things right Mrs E received 15 payments of £267.36 in the form or returns after making the payment for the investment. I think it would be fair for these returns to be deducted from her loss. I don’t think HSBC would have been able to detect the matter was a scam at the time the payment was made, so I don’t think they could have prevented Mrs E from making it. But I do think HSBC should’ve upheld Mrs E’s claim under the CRM Code, as they had enough information by this point to reach a conclusion that the matter was a scam. This is because at the time Mrs E made the claim to HSBC, the SFO had already published the outcome of their investigation. So I think HSBC should pay 8% simple interest on the reimbursement from the date the claim was declined to the date that Mrs E receives the money. The FSCS is also aware that we have issued recent decisions upholding complaints against banks related to B and its associated companies. Whether the FSCS pays any compensation to anyone who submits a claim to it is a matter for FSCS to determine, and under their rules. It might be that B and its associated companies have conducted activities

-- 5 of 6 --

that have contributed to the same loss Mrs E is now complaining to us about in connection with the activities of HSBC. As I have determined that this complaint should be upheld Mrs E should know that as she will be recovering compensation from HSBC, she cannot claim again for the same loss by making a claim at FSCS (however, if the overall loss is greater than the amount she recovers from HSBC she may be able to recover that further compensation by making a claim to FSCS, but that will be a matter for the FSCS to consider and under their rules.) Further, if Mrs E has already made a claim at FSCS in connection with B, and in the event the FSCS pays compensation, Mrs E is required to repay any further compensation she receives from her complaint against HSBC, up to the amount received in compensation from FSCS. FOS and FSCS operate independently, however in these circumstances, it is important that FSCS and FOS are working together and sharing information to ensure that fair compensation is awarded. More information about how FOS shares information with other public bodies can be found in our privacy notice here: https://www.financial- ombudsman.org.uk/privacy-policy/consumer-privacy-notice As there is an ongoing court case, it’s also possible Mrs E may recover some further funds in the future. In order to avoid the risk of double recovery, HSBC is entitled to take, if they wish, an assignment of the rights to all future distributions under the liquidation process in respect of this investment before paying the award. If the bank elects to take an assignment of rights before paying compensation, they must first provide a draft of the assignment to Mrs E for her consideration and agreement. My final decision My final decision is that I uphold this complaint against HSBC UK Bank PLC. If Mrs E agrees, HSBC UK Bank PLC should: - Reimburse Mrs E’s payments, minus the returns received. - Pay 8% simple interest per year from the date that the claim was declined to the date that the payment is reimbursed. Under the rules of the Financial Ombudsman Service, I’m required to ask Mrs E to accept or reject my decision before 24 April 2026. Paula Lipkowska Ombudsman

-- 6 of 6 --