DRN-6295824

The complaint Mr S is complaining that Santander UK Plc hasn’t refunded payments that were made as part of a scam. What happened Mr S was tricked into making two debit card payments of £891.99 and £392.61 to two different travel agencies, thinking he was booking flight tickets for himself. He realised he’d been scammed shortly after the payments had been made, and he contacted Santander to report what had happened. Santander thought Mr S had authorised the payments and it didn’t agree to refund them. It did ask Mr S for some more evidence so it could raise chargeback claims to dispute the payments with the merchants, but it says Mr S didn’t supply all the information it needed. So, it didn’t raise the chargeback claims. Mr S complained to the Financial Ombudsman Service. Our Investigator thought that Mr S hadn’t authorised the payments, so she asked Santander to refund them, with 8% simple interest per year. She also asked Santander to pay £100 in compensation. Santander didn’t agree. It said, in summary, that Mr S had approved the card payments via stronger authentication in its app, and so he had authorised them. So, it didn’t think it was obliged to refund them. The complaint was passed to me for review and a decision. I issued a provisional decision on Mr S’s complaint. This is what I said. “I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, I don’t agree with the Investigator’s findings. From what I’ve seen so far, I don’t think that there are any reasonable grounds for me to direct Santander to refund the disputed payments. But I do think it should pay Mr S £100 in compensation. I’ll explain why. Did Mr S authorise the payments? The relevant law here is the Payment Services Regulations 2017 – these set out what is needed for a payment to be authorised and who has liability for disputed payments in different situations. With some exceptions, the starting point is that the consumer is responsible for authorised payments, and the business is responsible for unauthorised payments. The PSRs specify that authorisation depends on whether the payment transactions were authenticated correctly – and whether Mr S, or someone acting on his behalf, consented to them. Consent must be in the form and in accordance with the procedure agreed between the consumer and the payment service provider. In other words, consent is provided when the consumer completes the agreed steps for making a transaction or allows someone else

-- 1 of 6 --

to complete some or all of them. To establish the agreed form and procedure, I’ve reviewed the terms and conditions of Mr S’s account with Santander. These don’t set out in detail how Mr S consents to making payments using his card. So, I’ve thought about what practical steps are needed to make payments using a card. It seems Mr S (or someone with his permission) needed to provide his card details to the merchant and if prompted, provide the CVV and complete a stronger authentication process. Mr S was tricked into sharing his card details with the scammer over the phone, and then the scammer entered his card details into the merchants’ websites to make the payments – so here it seems it was the scammer who gave the payment instructions using Mr S’s card details. Santander says the payments were authorised by Mr S because he confirmed the payments in its app. It doesn’t seem to be in dispute that Mr S was aware he was making the payment of £392.61 when he approved it in the app. He says he made this payment thinking he was booking a discounted ticket for himself. But he says when he made the payment of £891.99, he was told it was a clearance code and to press accept; he didn’t expect a payment to be taken. Santander has sent us some screenshots to show that the process flow here has steps which involve being shown a notification which says, “you’ve requested a card payment” and includes the amount of the payment. There’s an option to select “I requested this” and if this is selected, the next screen says, “authorise card payment” and sets out the payment amount and who it’s being made to with an option to authorise or cancel the payment. So, I think it would have been clear that Mr S was approving a payment of £891.99 when he pressed authorise. I’m satisfied that both payments here were correctly authenticated using Mr S’s card information and the stronger authentication process. I think that by completing these steps, Mr S represented to Santander that both payment instructions were genuine, even though he had been told the payment for £891.99 was a clearance code rather than a payment. I understand that Mr S was tricked into making the payments, but this isn’t a relevant consideration in whether they were authorised under the rules. So, it’s reasonable for Santander to treat the payments as having been authorised and as such it isn’t obliged to provide a refund. Should Santander have identified a scam risk and intervened? I’ve concluded that the payments were authorised, so I’ve gone on to consider if Santander should have done anything else to prevent the payments Mr S made as a result of the scam. When a payment is authorised, Santander has a duty to act on the payment instruction. But in some circumstances, it should take a closer look at the circumstances of the payment – for example, if it ought to be alert to a fraud risk, because the transaction is unusual, or looks out of character or suspicious. And if so, it should intervene, for example, by contacting the customer directly, before releasing the payment. But I’d expect any intervention to be proportionate to the circumstances of the payment. I’ve also kept in mind that Santander processes high volumes of transactions each day. There is a balance for it to find between allowing customers to be able to use their account and questioning transactions to confirm they’re legitimate. I wouldn’t have expected Santander to have intervened here. The value of the payments was not significant in the context of the payments Santander processes every day and Mr S

-- 2 of 6 --

had made payments of a similar value before. I don’t think these payments ought to have caused Santander to be sufficiently concerned about a scam risk that it ought to have intervened with a warning, or by contacting Mr S directly. So, I don’t think Santander ought reasonably to have done anything here to prevent Mr S from making the payments. Could Santander have done more to recover the payments? The payments were made by debit card, and as such once they had been authorised it wasn’t possible for Santander to cancel them, even in a pending state. It’s possible to dispute a debit card payment through chargeback, which can sometimes be attempted if something has gone wrong with a debit card purchase, subject to the relevant card scheme’s rules. Santander didn’t raise chargebacks through the card scheme when Mr S disputed the payments, but I would only expect it to do so if there was a reasonable prospect of them being successful under the chargeback rules. And I’m satisfied that there would have been little prospect of chargebacks being successful here. I say this because I’ve concluded the payments were authorised by Mr S, so chargebacks for the reason they weren’t authorised wouldn’t have succeeded. And from what we know about how these types of scams operate, it’s likely the merchants concerned would have provided the service Mr S’s payments paid for, but to a third party (and would have been able to demonstrate this in the event of receiving a chargeback claim). So, chargebacks for the reason that goods or services weren’t provided wouldn’t have succeeded either. I can see that Santander did consider raising chargebacks, but it asked Mr S for more evidence which it says it didn’t receive. The evidence it says is still outstanding is confirmation from the travel agency the £891.99 payment was made to that it had agreed a refund of the payment. Mr S says Santander is asking for evidence that he can’t reasonably supply because it will involve him contacting the company who had scammed him, and that it kept asking him for more pieces of evidence after he thought he’d supplied everything. From what I have seen, the company Mr S made this payment to is a legitimate travel agency, although I can fully understand why he would have thought they were involved in the scam. But I don’t think Mr S would have been able to provide the evidence Santander requested here about the travel agency agreeing a refund. This is because the travel agency itself hadn’t agreed to refund the payment – it was the scammer who had told him he’d receive a refund of the first payment to induce him to make the second payment. I appreciate that this is evidence stipulated as a requirement under the chargeback rules and that Santander was no doubt just trying to help Mr S by following the chargeback claim process, but I do think Santander could have engaged with Mr S at an earlier point in the chargeback process and explained to him why chargebacks wouldn’t have been likely to succeed here under the chargeback rules. But Santander repeatedly sent out what appear to be standard letters asking for different pieces of evidence, each including a new disclaimer for Mr S to sign and return. In its letter of 1 June 2024 Santander asked Mr S to provide confirmation from the airline that no booking was made under his name and to provide correspondence with the merchant regarding the claim. Mr S says he spoke to Santander, and he was told this was the last piece of information he needed. Mr S then contacted the airline for confirmation he hadn’t flown, and once he’d received that he sent it to Santander. He had also supplied the correspondence he’d had with what he believed to be the genuine merchant at the time. But once he had sent this in, Santander then sent another standard letter asking Mr S for “Dated confirmation from [the travel agency] that you are due a refund showing refund amount and card number - copy of credit voucher”.

-- 3 of 6 --

I can understand why this process caused Mr S frustration and why he felt the goalposts were changed once he’d supplied what he thought was the final piece of information. I think Santander should recognise the impact this has had on him by paying him £100 in compensation. I’ve listened to the call of 20 September 2024 which Mr S has complained about and although the call did appear to cut out after Mr S had been put on hold, I’ve not found that the adviser was rude or unhelpful. I’m really sorry to disappoint Mr S – I understand this won’t be the outcome he had hoped for or expected. As the victim of a cruel scam, I can understand why he’d think he should get his money back. But I’ve not found that there are any grounds for me to direct Santander to refund the disputed payments to him.” Santander replied to say that it agreed to pay Mr S £100, in line with my provisional decision. Mr S provided detailed submissions to explain why he disagreed with my provisional decision. I have summarised the main points of his response, focusing on the central issues of his complaint. • Mr S didn’t consent to the payments because his consent was obtained by deception. This consent wasn’t genuine, informed or intentional and so the payments can’t be considered to be authorised. • Santander’s evidence is not sufficient to demonstrate Mr S’s genuine consent. • Santander’s repeated and inconsistent document requests constitute a failure to deliver a fair outcome under the Financial Conduct Authority’s consumer duty. Its management of the chargeback process prevented any reasonable prospect of recovery. • Even if I were to conclude the payments were authorised, Santander can’t refuse reimbursement because Mr S wasn’t grossly negligent. • Mr S was a vulnerable customer due to the distressing event of being defrauded. • Although these payments don’t fall under the Authorised Push Payment (APP) scam reimbursement rules, Santander cannot provide lower levels of protection due to this. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I’ve considered everything Mr S has said and provided in response to my provisional decision. And having done so, I’m not changing my provisional decision. I’ll explain why.

-- 4 of 6 --

I’m aware that I’ve summarised Mr S’s response to my provisional decision briefly, in less detail than has been provided, and in my own words. No discourtesy is intended by this. Instead, I’ve focussed on what I think are the central issues of his complaint. If there’s something I’ve not mentioned, it isn’t because I’ve ignored it. But, I’m satisfied I don’t need to comment on every individual point or argument to be able to reach what I think is the right outcome. Our rules allow me to do this. This simply reflects the informal nature of our service as a free alternative to the courts. To start with Mr S’s point about consent, I should explain that under the PSRs consent is an objective test, and it doesn’t rely on a consumer being fully aware of the details of the payment. The concept of consent that is referred to in the PSRs is not the same as “informed consent” which can apply in other contexts, because it doesn’t rely on a payment transaction being fully explained. This means that if a consumer has been tricked or coerced into making a payment or deceived about the purpose or amount of a payment that, in itself, doesn’t usually mean the payment was unauthorised. As I’ve set out in my provisional decision, I think Santander has provided sufficient evidence to show that these payments were authorised. I would only need to consider if Mr S had been grossly negligent if I had concluded that the payments were unauthorised. As this isn’t the case here, gross negligence isn’t a relevant consideration. Turning to Mr S’s points about the chargeback claim, I don’t think that Santander’s requests for further documents prevented the funds being recovered, because as I’ve explained, there was no reasonable prospect of chargeback claims succeeding under the card scheme’s rules. I do understand how distressing it must have been for Mr S to have been defrauded, but I don’t think this means Santander ought to have done anything differently here – apart from in relation to its handling of the chargeback claims which I have already set out. And I still think that £100 is fair and reasonable compensation to reflect what went wrong in relation to its handling of the chargeback claims. As the payments don’t fall under the APP scam reimbursement rules, I can’t consider if they ought to be refunded under their provisions. I’ve already explained why I don’t think Santander ought to have been concerned about a fraud risk when these payments were made. Once again, I’m sorry to disappoint Mr S. But I’ve not found that there are any grounds for me to direct Santander to refund the disputed payments to him. My final decision My final decision is that I uphold this complaint, in part. To put things right, Santander UK Plc should pay Mr S £100. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr S to accept or reject my decision before 21 May 2026. Helen Sutcliffe

-- 5 of 6 --

Ombudsman

-- 6 of 6 --