National Westminster Bank Public Limited Company · DRN-5881910

The complaint Mr W complains about National Westminster Bank Public Limited Company’s decision to decline to refund him for a transaction he says he didn’t authorise. What happened On 11 June 2025, Mr W made a genuine cash withdrawal using his NatWest debit card at the counter in a merchant I’ll call P. Later the same day, Mr W says he realised he had lost his card and used his banking app to freeze his card. He says he noticed there was a transaction at another merchant, I’ll call C, for just over £460 which had happened around four hours after Mr W’s cash withdrawal at P. Mr W says he didn’t make the payment to C so he reported it to NatWest on 13 June 2025. NatWest declined to refund Mr W for the payment to C as it had been made using chip and PIN. They said since Mr W hadn’t indicated there had been a compromise to his PIN number, the payment was likely authorised by Mr W. Unhappy with this, Mr W referred his complaint to our service. One of our Investigators reviewed the complaint and thought NatWest had acted fairly. In summary, they said that the technical evidence showed the transaction to C was completed via chip and PIN and Mr W hadn’t provided a reasonable explanation as to how someone would know his PIN number. They felt “shoulder surfing” (where a PIN number is obtained by covertly watching someone enter their PIN) was unlikely to have happened to Mr W at P, because the transaction was made at the counter so the cashier would have noticed. NatWest didn’t respond to our Investigator’s view. Mr W disagreed but provided no further evidence to our Investigator. So, Mr W’s complaint has been passed to me. I requested further information from Mr W regarding additional transactions that had occurred on 12 June, which hadn’t been disputed. Mr W confirmed to me that he lost his card on 11 June and froze it the same day and no further transactions took place. However, NatWest provided further technical evidence about the activity on Mr W’s account on 12 June showing Mr W’s card was frozen on 12 June at 12:36pm but unfrozen again at 3:32pm on the same day. Then, a contactless card transaction happens at 3:35pm for just over £100 at a supermarket. I shared my initial thoughts with Mr W that I wouldn’t be asking NatWest to do anything further because the evidence showed that Mr W’s card was unfrozen via his mobile app and used for a genuine transaction the day after Mr W says he lost the card. In response, Mr W suggested that the payment at the supermarket was him, but it was made via a digital wallet. So, I’ve considered Mr W’s response below. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint.

-- 1 of 2 --

I know this will disappoint Mr W, but having reviewed the evidence, I won’t be asking NatWest to do anything further, and I’ll explain why below. Generally speaking, a bank is entitled to hold a consumer liable for authorised transactions, and the bank is liable for unauthorised transactions. Those rules are set out in the PSRs 2017. I have seen evidence that the transaction at C was made via chip and PIN so I am satisfied it was properly authenticated. But on its own this isn’t enough to say Mr W authorised the payments, I also need to be satisfied that he consented to the payments. So I need to consider if it’s possible that someone else could have completed the transaction with the correct form and procedure without Mr W’s knowledge. I’ve thought about this considering the evidence available and I’m not persuaded this is possible. Mr W suggested he was shoulder surfed while making the withdrawal at P. However, I find it unlikely that the cashier at P wouldn’t notice if another customer was standing close enough to Mr W to read his PIN and not subsequently advise Mr W of this. If that had happened, the fraudster would then need to obtain the card without Mr W’s knowledge. The chance of a fraudster shoulder surfing someone who then loses their card, and the fraudster being the person who finds it, is relatively low. It would also be unusual for opportunistic fraudster to only make one payment in four hours rather than draining the account. My view on this is strengthened by evidence from NatWest that shows Mr W’s card was frozen via Mr W’s mobile banking app at 12:36pm on 12 June but unfrozen again at 3:32pm on the same day. Then, a contactless card transaction happens at 3:35pm for just over £100 at a supermarket. The card is then cancelled at 9:07pm. Mr W’s testimony has differed around when the card was frozen and when the last genuine transaction was made. Mr W now believes the payment at the supermarket was made via his digital wallet without the card present. However, the evidence I’ve seen says the card was present for the transaction. Even if Mr W completed the transaction via his digital wallet, I find it surprising that Mr W would unfreeze the card that he believed was in a third-party fraudster’s possession, potentially allowing further payments to be made. I’m satisfied the evidence shows, on balance, Mr W authorised the transaction at C on 11 June. Therefore, I find NatWest were fair to conclude that Mr W is liable for the payments and I won’t be asking them to do anything further. My final decision My final decision is that I don’t uphold this complaint. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr W to accept or reject my decision before 16 April 2026. Cheryl Dior Ombudsman

-- 2 of 2 --