DRN-6317561

The complaint Mrs B complains about the way Santander UK Plc treated her when she fell victim to a scam and made a claim for her financial loss. What happened Mrs B explains that: • She has a serious health condition and, as she takes steroids, this sometimes affects her sleep and thinking. • She has a son and she knew that he’d been experiencing problems with his mobile phone. • On 27 October 2025, Mrs B received an inaudible call followed by text messages which, as they referred to her as ‘mum’, used affectionate language and asked caring questions, she thought was from her son and didn’t realise it was from a scammer. • Pretending to be her son, the scammer said he was in a mobile phone repair shop as he’d damaged his phone and he couldn’t get access to his bank app and needed money to pay for the repair, he needed her to make an urgent payment of £410 to the person in the shop. • Mrs B attempted to pay the account number she was given but it was blocked. Following a call with Santander Mrs B obtained another account number and paid the scammer £410 using her bank card. • Mrs B realised she’d been scammed when she mentioned the above events to her friend. Mrs B then contacted Santander to claim a refund and, as she’d paid by card, she was given the impression this might be possible. Mrs B became upset when she was told her claim had been rejected. This is because, on two occasions, she’d given Santander personal information on her health condition which she found difficult. She feels Santander were disrespectful and lacking in compassion in asking her questions about her health when they had no intention of paying her claim. So, Mrs B complained to our service about the way she‘d been treated. The outcome she is seeking is a full refund. Our investigator considered that Santander should’ve recognised Mrs B was at risk of financial harm as the payment that was blocked was due to fraud concerns. As the disputed payment was soon after and for the same amount, he thought they should’ve intervened. And this would’ve led to the scam being unravelled. So, he said Santander should provide a full refund. He didn’t think contributory negligence applied, mainly due to Mrs B’s vulnerability. However, Santander disagree and when requesting an Ombudsman make a final decision, their points included the following: A. The payment was small, wasn’t unusual and was made through another method to a

-- 1 of 6 --

different bank and payee to the blocked payment. B. Although they recognised Mrs B’s health issues they thought there were some red flags she and her partner, who seemed to have been present, should’ve noticed. I issued a provisional decision on 10 April 2026, and this is what I said: What I’ve provisionally decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, my provisional decision is that I’m partially upholding this complaint. I’ll explain why. I should first say that: • I’m very sorry to hear that Mrs B has been the victim of this cruel scam. Also, that she has been caused distress and inconvenience. • Having reviewed the file notes, including Mrs B’s dialogue with the scammer, I’m satisfied that the payment went to a scammer. • In making my findings, I must consider the evidence that is available to me and use it to decide what I consider is more likely than not to have happened, on balance of probabilities. • Unfortunately, the APP Scam Reimbursement Rules, introduced by the Payment Systems Regulator in October 2024, for customers who have fallen victim to an APP scam, don’t apply here. This is because card payments are excluded. • I wouldn’t have expected Santander to have been able to process a chargeback as the payment was fraudulent and person to person rather than for goods and services. • The Payment Services Regulations 2017 (PSR) and FCA’s Consumer Duty are relevant here. PSR Under the PSR and in accordance with general banking terms and conditions, banks should execute an authorised payment instruction without undue delay. The starting position is that liability for an authorised payment rests with the payer, even where they are duped into making that payment. There’s no dispute that Mrs B made the payment here, so it is considered authorised. However, in accordance with the law, regulations and good industry practice including the Consumer Duty, a bank should be on the look-out for and protect its customers against the risk of fraud and scams so far as is reasonably possible. If it fails to act on information which ought reasonably to alert a prudent banker to potential fraud or financial crime, it might be liable for losses incurred by its customer as a result. Banks do have to strike a balance between the extent to which they intervene in payments to try and prevent fraud and/or financial harm, against the risk of unnecessarily inconveniencing or delaying legitimate transactions. So, I consider Santander should fairly and reasonably: o Have been monitoring accounts and any payments made or received to counter various risks such as anti-money laundering and preventing fraud and

-- 2 of 6 --

scams. o Have systems in place to look for unusual transactions or other signs that might indicate that its customers were at risk of fraud (among other things). This is particularly so given the increase in sophisticated fraud and scams in recent years, which banks are generally more familiar with than the average customer. o In some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks before processing a payment, or in some cases declined to make a payment altogether, to help protect customers from the possibility of financial harm from fraud. Consumer Duty From July 2023, Santander had to comply with the Financial Conduct Authority’s Consumer Duty which required financial services firms to act to deliver good outcomes for their customers. Whilst the Consumer Duty does not mean that customers will always be protected from bad outcomes, Santander was required to act to avoid foreseeable harm by, for example, operating adequate systems to detect and prevent fraud. Also, Santander was also required to look out for signs of vulnerability. With the above in mind, I first considered if Santander should’ve recognised Mrs B was at risk of financial harm and put in place a proportionate intervention. Ordinarily I wouldn’t have expected Santander to have had any concerns about the payment. This is because I can’t see that Santander were aware of any vulnerability at the time of payment and prior to it being made had an opportunity to discuss any banking risks and mitigation. Also, there were no fraud markers and it wasn’t unusual for Mrs B to make a payment for this amount (£410) which is a relatively low amount for a bank that processes thousands of payments each day. However, although I recognise the payment was by a different method, to a different bank and payee and Santander’s fraud prevention system didn’t pick up a risk, I’m in agreement with our investigator that there was a risk here that needed to be mitigated. This is because a short time earlier a payment for exactly the same amount had been blocked because of clear fraud concerns. So, due to the amount being specific and not a round number, I think there was a high probability that the subsequent payment could be fraudulent – which was the case here. I can’t see that Santander did this analysis, considered questioning this payment or have provided sufficient evidence to persuade me they intervened or that the payment wasn’t unusual, and it wasn’t proportionate for them to intervene. And if a bank doesn’t question payments that might be at risk, then it can’t fulfil its duty to protect customers. I’m not saying that means it must check every payment out of its customers’ accounts. But here, considering the individual circumstances, I believe it ought to have contacted Mrs B to check she wasn’t at risk of falling victim to fraud. As I think the risk level was high, even though the amount was relatively low, I think a proportionate intervention should’ve been a human intervention. If a fraud and scam agent, trained to ask probing questions to detect fraud and scams, spoke to Mrs B I think she would’ve fully explained what she was doing. And because this is a common scam and there were a number of red flags (that I’ll cover in the Contributory Negligence part of this decision paper) I think they would’ve immediately suspected a scam and stopped Mrs B making the payment.

-- 3 of 6 --

Having established that a human intervention would’ve more likely than not uncovered the scam and prevented any further loss, I then looked at whether there was more Mrs B could’ve done more to protect herself. Contributory negligence The concept of contributory negligence centres around whether or not a consumer should have done something to mitigate their losses or should share some responsibility for them. In considering this point, I’ve taken into account what the law says about contributory negligence as well as what’s fair and reasonable in the circumstances of this complaint including Mrs B’s vulnerability. Regarding Mrs B’s vulnerability I noted that she doesn’t consider herself to be vulnerable as she works and there isn’t any medical evidence on file. But, having looked at file notes and listened to some of her calls with Santander and our service, although Mrs B sounds alert (and comments on this and how the scam was clever), I am persuaded that she has a vulnerability due to a health condition and that the medication she takes can cause a lack of sleep and on occasions this could possibly have an impact on her decision making. It’s difficult to know if the 27 October 2025 was such a day. However, Santander point out that her partner appears to have been involved in the messages and this does appear to be the case. On the basis that it’s unclear if her decision making was affected that day and, if it was, she appears to have had some support, I considered whether there were red flags that should’ve been noticed. Having done so, although there are some sophisticated elements to this scam, I think that together with an involved partner (if they are in good health), there were some clear red flags that combined should’ve alerted them to it being a scam, such as: A. Mrs B and her partner couldn’t hear their son when trying to speak to him on the new number and they received a message from the scammer saying that he could hear them but his microphone hadn’t been fixed. Yet they weren’t calling him on his known phone number which was faulty and being fixed. B. She asked the scammer if the payment was being made to a personal or a business account and was told a personal account despite it being made to the repair shop. C. When Mrs B’s first payment attempt was blocked she was told there was an issue at the receiving end and the individual would need to contact their bank to see what’s going on. So, having considered contributory negligence, I think both parties made errors here, Santander in not intervening and Mrs B in not recognising some red flags. I therefore consider it to be both fair and reasonable for liability to be split liability and for Santander to pay 50% of Mrs B’s loss. Regarding Mrs B’s upset at feeling the personal health questions she was asked by agents of Santander were unnecessary, as they didn’t make a difference to the refund outcome, I can understand her upset. However, as their line of questioning is due to their internal procedures and necessary so they can fully evaluate and mitigate any future risks, I don’t think they acted unreasonably.

-- 4 of 6 --

My provisional decision For the reasons mentioned above, my provisional decision is to partially uphold this complaint, and I require Santander UK Plc to: • Provide Mrs B with a refund of 50% of her loss which is £205. • Pay simple interest using time-weighted average Bank of England base rate plus one percentage point on the refund from the date of loss until the date of settlement. This is subject to any comments that either Mrs B or Santander UK Plc may wish to make. These must be received by 24 April 2026. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Further to my above provisional decision, I received responses from both parties. Mrs B commented on my above contributory negligence point ‘that together with an involved partner (if they are in good health), there were some clear red flags that combined should’ve alerted them to it being a scam’. She said: • She was alone throughout the day. It was her who responded to messages which referred to ‘dad’. ‘I just answered the text, as I was more concerned my son's phone wasn't working’. • Her friend told her it sounded like a scam. Santander said they still disagreed and their comments included the following: • ‘The beneficiary account of the declined bill payment had previously been placed into the negative list and it was for this reason the payment was declined not because it was flagged by the banks fraud system as suspect and therefore there was no contact strategy in place’. • ‘The following payment in dispute was made to a different individual, different bank via a different payment method and therefore has not been linked. The payment being disputed has been made and authorised by the customer, is in keeping with usual account spend and therefore was not deemed suspect by the bank’. With the above comments in mind, I considered everything again. I recognise the first beneficiary was declined because it was ‘placed into the banks negative list’ rather than ‘being flagged by the banks fraud system as suspect. But Santander have said: • ‘The bank had previously received a claim against a payment sent to this destination account as fraud and therefore the account was added to the negative list to prevent further payments being sent there’. Therefore, for the reasons set out in my above provisional decision, I still think Santander should’ve recognised Mrs B was at risk of financial harm and put in place a proportionate intervention on the subsequent payment which she attempted soon after for the exact same amount.

-- 5 of 6 --

I appreciate the subsequent payment was for a low amount to a different bank via a different payment method and their system didn’t pick it up. But I still think a combination of the timing and identical amount were risk indicators that should’ve been mitigated through a human intervention. And for the reasons stated above, I think such an intervention would’ve unravelled the scam and prevented Mrs B’s loss. I again considered contributory negligence. In my above provisional decision, I referred to three red flags (see points A to C) and although I don’t have enough information to add the mention of ‘dad’ as an additional red flag, Mrs B has confirmed she was alone and it was her who responded as she was concerned about her son. And I’m persuaded that there wasn’t an involved partner to support her. I further considered Mrs B’s vulnerability and her comments about her condition, strong medication, lack of sleep and text comment (to the scammer) about her feeling unwell and seeing a GP (on the day in question), together with her being on her own. Although I think there were red flags, with the additional information received from Mrs B following my provisional decision, I now agree with our investigator’s view that contributory negligence shouldn’t apply here and Santander should provide a full refund. Putting things right So, to put things right, I require Santander UK Plc to: • Provide Mrs B with a refund of £410. • Pay simple interest using time-weighted average Bank of England base rate plus one percentage point on the refund from the date of loss until the date of settlement. My final decision For the reasons mentioned above (including my provisional decision) my final decision is that I’m upholding this complaint against Santander UK Plc. And my requirements are detailed in the above ‘Putting things right section’ of this decision paper. Under the rules of the Financial Ombudsman Service, I’m required to ask Mrs B to accept or reject my decision before 22 May 2026. Paul Douglas Ombudsman

-- 6 of 6 --