HSBC UK Bank · DRN-5875682

The complaint Mr H complains that HSBC UK Bank Plc (‘HSBC’) won’t reimburse the funds he lost when he fell victim to a scam. What happened In July 2024 Mr H was sent details of an investment opportunity with a company I’ll call ‘C’, by a broker firm. Mr H was provided with a brochure and reviewed other information and reviews about C and the opportunity online. He was told funds would be used for a rent-to- rent property arrangement where money would be used to refurbish and pay deposits on rental units that would be occupied by social housing tenants. Mr H agreed to invest in five units which would return 22% per annum for three years. He made four payments totalling £65,000 from his bank account with HSBC to an account in the name of C. The first two payments were for £10 and £14,990 on 31 July 2024. The next two payments were for £25,000 each on 1 and 2 August 2024. Mr H expected to receive £9,000 per quarter in returns, after an initial 75-day grace period. Unfortunately, Mr H never received any of the expected returns or his capital back despite following up with C shortly after his first interest payment was due to be paid. C has since been liquidated. Mr H raised a claim, and later a complaint to HSBC. In response, HSBC told Mr H it couldn’t fully review his scam claim as it was waiting for industry guidance as to whether it could review the payments he made under the Contingent Reimbursement Model Code (‘CRM Code’). It also couldn’t give Mr H a timeframe. Mr H was unhappy with HSBC’s response and brought his complaint to this service. The investigator who considered this complaint recommended that it be upheld in full. He gave a summary of the information obtained from receiving accounts and noted that the majority of funds hadn’t been used for the intended purpose. He concluded that HSBC couldn’t rely on any of the exceptions to reimbursement under the provisions of the CRM Code. HSBC did not accept the investigator’s outcome. HSBC says that it is not appropriate to reach a finding at this time, as it does not consider there is adequate evidence available to decide in each individual case about C, whether that consumer has been the victim of a scam. It has also stated that it believes our service should dismiss this case due to its complexity, and that it believes we have relied on generic assumptions rather than specific individual evidence relating to Mr H’s payments. Our Investigator broadly addressed HSBC’s follow up points. But because an informal agreement could not be reached, the complaint has been passed to me to make a decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable

-- 1 of 7 --

in the circumstances of this complaint. In deciding what’s fair and reasonable in all the circumstances of a complaint, I’m required to take into account relevant: law and regulations; regulators’ rules, guidance and standards; codes of practice; and, where appropriate, what I consider to be good industry practice at the time. Where there is a dispute about what happened, and the evidence is incomplete or contradictory, I’ve reached my decision on the balance of probabilities – in other words, on what I consider is most likely to have happened in light of the available evidence. In broad terms, the starting position in law is that HSBC is expected to process payments that a customer authorises it to make, in accordance with the terms and conditions of the customer’s account and the Payment Services Regulations (PSR’s). But there are circumstances when it might be fair and reasonable for a firm to reimburse a customer even when they have authorised a payment. Is it appropriate to determine this complaint now? I have considered whether it would be appropriate to delay my decision in the interests of fairness, as I understand that a police investigation is still ongoing. HSBC has advised that our service should dismiss this complaint under the rules that govern our service (the DISP Rules) citing DISP 3.3.4A which states: “(5) dealing with such a type of complaint would otherwise seriously impair the effective operation of the Financial Ombudsman Service.” HSBC said that the complexity of the situation makes it inherently unsuitable to be dealt with by our service and it would be more suitable for the complaint to be dealt with by a court. I am aware there is an ongoing police investigation – but I don’t find that the police investigation in and of itself means it would be automatically appropriate to dismiss the complaint. Our service is an informal dispute resolution provider that is fair and impartial and aims to settle disputes between businesses and consumers. I have to consider the complaint before me and whether, based on the evidence available, it was fair and reasonable for HSBC to decline reimbursing Mr H under the provisions of the CRM Code. While there is an ongoing police investigation, for reasons I will go on to explain, I consider I am able to reach a final decision on what I consider is a fair answer to the complaint. So, I don’t consider it would be fair or appropriate to dismiss the complaint. Firms generally have 15 business days to respond to claims under the CRM Code. In this case, HSBC has effectively applied R3(1)(c) of the CRM Code which says: “If a case is subject to investigation by a statutory body and the outcome might reasonably inform the Firm’s decision, the Firm may wait for the outcome of the investigation before making a decision.” Based on the information that is already available, I don’t think it’s necessary or reasonable for HSBC to rely on R3(1)(C) of the CRM Code. There may be circumstances and cases where it’s appropriate to wait for the outcome of external investigations and/or related court cases. But that isn’t necessarily so in every case, as it may be possible to reach conclusions on the main issues on the basis of evidence already available. And it may be that the investigations or proceedings aren’t looking at quite the same issues or doing so in the most helpful way. I’m conscious, for example, that any criminal proceedings that may ultimately

-- 2 of 7 --

take place might concern charges that don’t have much bearing on the issues in this complaint; and, even if the prosecution were relevant, any outcome other than a conviction might be little help in resolving this complaint because the Crown would have to satisfy a higher standard of proof (beyond reasonable doubt) than I’m required to apply (which – as explained above – is the balance of probabilities). In order to determine Mr H’s complaint, I have to ask myself whether, on the balance of probabilities, the available evidence indicates that it’s more likely than not that Mr H was the victim of a scam rather than a failed investment. But I wouldn’t proceed to that determination if I consider fairness to the parties demands that I delay doing so. I’m aware that Mr H first raised this claim with HSBC in November 2024 and I need to bear in mind that this service exists for the purpose of resolving complaints quickly and with minimum formality. With that in mind, I don’t think delaying giving Mr H an answer for an unspecified length of time would be appropriate unless truly justified. And, as a general rule, I’d not be inclined to think it fair to the parties to a complaint to put off my decision unless, bearing in mind the evidence already available to me, a postponement is likely to help significantly when it comes to deciding the issues. I’m aware the above processes might result in some recoveries for Mr H; in order to avoid the risk of double recovery, I think HSBC would be entitled to take, if it wishes, an assignment of the rights to all future distributions to Mr H under those processes in respect of this investment before paying anything I might award to Mr H on this complaint. For the reasons I discuss further below, I don’t think it’s necessary to wait for the outcome of police investigations for me to fairly reach a decision on whether HSBC should reimburse Mr H under the provisions of the CRM Code. Has Mr H been the victim of an APP scam as defined by the CRM Code? Under the CRM Code, the starting principle is that a firm should reimburse a customer who is the victim of an authorised push payment (APP) scam, except in limited circumstances. But the CRM Code only applies if the definition of an APP scam, as set out in it, is met. I have considered whether Mr H’s claim falls within the scope of the CRM Code. The relevant definition of a scam from the CRM Code is that the customer transferred funds to another person for what they believed were legitimate purposes but were in fact fraudulent. In order to determine whether Mr H has been the victim of an APP scam as defined by the CRM Code I need to consider whether the purpose he intended for the payments was legitimate, whether the purposes he and C intended were broadly aligned and then, if they weren’t, whether this was the result of dishonest deception on the part of C. I haven’t seen anything to suggest Mr H didn’t consider he was investing funds for a legitimate purpose. So, I’ve gone on to consider what purpose C had in mind and whether it was in line with what Mr H thought. Like the investigator, and based on the evidence available, I’m satisfied it’s more likely than not Mr H’s funds weren’t used for the intended purpose and that C obtained the funds through dishonest deception. So, I’m satisfied the payments Mr H made from his HSBC account meet the definition of an APP scam and are covered by the CRM Code.

-- 3 of 7 --

I have seen confidential information that I’m unable to share for data protection reasons which shows that around £600,000 was spent in a way that appears consistent with property development. But C also received around £20,200,000 from investors. Given a standard unit price of £13,500, C would need to have entered into around 1,500 property agreements. The evidence isn’t consistent with C paying for refurbishments, furnishings and rent for this number of properties. Importantly, C told investors it had contracts with local authorities which would be required to fulfil its agreements. But I have seen no evidence of incoming payments from local authorities or housing providers. And several local authorities have confirmed that they didn’t have a working relationship with C. One also said that an invoice used by C to demonstrate such a relationship was fake. Around £440,000 C received could be legitimate income, but, as I have said above, none of this came from local authorities or social housing providers. But around £2,500,000 was paid to investors. These funds clearly didn’t come from income received from the investments – strongly indicating C was operating a Ponzi scheme. This service has the addresses of properties investors thought their investment was purchasing in around 100 cases. Around half of those addresses were in buildings where the owners have confirmed that they didn’t have a relationship with C. In other cases, properties remained derelict after the investment was made or were under construction when they were supposedly generating an income. And some units were sold to different investors. Returning to C’s accounts, around a third of the investment capital wasn’t used for the purpose of securing and developing properties to be used for social housing. There were cash withdrawals, payments to individuals operating C, payments to jewellers and relating to obtaining cars, amongst other things. An individual named as a director of C was removed by Companies House after it was discovered that the individual’s identity had been stolen and they had been added to the record without their consent. As I have said above, there is also an ongoing police investigation into C. Overall, the evidence leads me to conclude that most investor funds weren’t used for the intended purpose and any funds that were, were more likely than not used to encourage further investment as part of an overall scam. Returning to the question of whether in fairness I should delay reaching a decision pending developments from external investigations, I have explained why I should only postpone a decision if I take the view that fairness to the parties demands that I should do so. In view of the evidence already available to me, however, I don’t consider it likely that postponing my decision would help significantly in deciding the issues. As regards the police’s investigations, there is no certainty as to what, if any, prosecutions may be brought in the future, nor what, if any, new light they would shed on evidence and issues I’ve discussed. Is Mr H entitled to reimbursement under the CRM Code? Mr H’s vulnerability Mr H has said he feels he was vulnerable at the time he made the payment due to family financial concerns and a recent bereavement. Mr H has said these events and the

-- 4 of 7 --

associated pressure, emotional burden and grief severely affected his ability to think clearly or critically evaluate the information presented to him by C. In short, the CRM Code says a customer is vulnerable to APP scams, if it would not be reasonable to expect that Customer to have protected themselves, at the time of becoming victim of an APP scam, against that particular APP scam. I don’t know a lot of the detail, but I don’t doubt Mr H and his family were going through a difficult time. But based on the information I’ve been provided I’m not persuaded that what Mr H was going through at the time meant he was particularly vulnerable to this type of scam or that he couldn’t reasonably have taken steps to protect himself. Mr H has said that he did look into C and the investment, he had looked for and seen positive independent reviews, had spoken to a member of C’s team and asked questions about the scheme and understood the agreement he was entering. I think this shows he was able to take steps to protect himself. With that in mind, while I accept Mr H was affected by what was happening in his family life, I don’t find that it meets the CRM Code definition of vulnerability. It follows that I don’t think HSBC needs to reimburse Mr H under this particular provision of the CRM Code. Can HSBC rely on any exceptions to reimbursement? The CRM Code says that Mr H is entitled to a full refund unless HSBC can establish that an exception to reimbursement applies. The CRM Code says that a bank may choose not to reimburse a customer if it can establish that: - The customer made payments without having a reasonable basis for believing that: the payee was the person the customer was expecting to pay; the payment was for genuine goods or services; and/or the person or business with whom they transacted was legitimate - The customer ignored an ‘effective warning’ by failing to take appropriate steps in response to that warning There are further exceptions outlined in the CRM Code that do not apply to this case. In response to the Investigator’s assessment, HSBC said Mr H did not have a reasonable basis for believing C offered a genuine investment. In summary, HSBC said Mr H was unclear about the expected returns which showed a lack of caution, he was communicating with C by WhatsApp which is concerning, he didn’t check the FCA website or speak to an independent financial adviser and doesn’t recall seeing or taking notice of HSBC’s warnings at the time of payments three and four. But for much the same reasons given by the investigator, I’m satisfied that Mr H did have a reasonable basis for believing C offered a genuine investment opportunity. - Mr H received professional looking documentation and links to videos about the investment which set out that the agreements were government backed and there was a regulated solicitor acting as a trustee that would protect investors if anything were to happen to C. - Mr H was presented the opportunity by an independent broker, whom he says he spoke to on the phone, by email and WhatsApp. He confirmed he asked questions about the investment, including whether it was regulated and was assured by what the broker had told him – along with his own independent checks online. Mr H was also in contact with C directly by email as well as WhatsApp so I don’t agree that the WhatsApp communication should have been overly concerning to him.

-- 5 of 7 --

- Mr H signed a genuine looking contract setting out the agreement reached and had seen an example agreement on C’s website before going ahead. Mr H has said that at the time he made the payments he was aware of the expected returns having received a schedule setting them out and included in his contact. It seems to me that perhaps when Mr H reported the matter to HSBC he couldn’t remember the rate of return in that moment but was aware at the time he made the payments. - Mr H saw several positive independent reviews about C on a well-known online review website. Having checked that website, at the time of Mr H’s payments, the majority of reviews were positive and the scam allegations only started around the time Mr H reported the scam too. - C was also registered on Companies House and Mr H spoke directly with an individual from C before investing. So, given what Mr H had been told and had seen, and what he had found out himself, I think there was enough to reasonably convince Mr H that this was a genuine investment he could trust. With this in mind, I don’t think Mr H made the payments without a reasonable basis of belief that C was acting legitimately. I’m also not satisfied that Mr H ignored an effective warning. Mr H chose the option “Making Investments” when asked for the payment purpose. HSBC says it showed Mr H written warnings when he went to make the payments of £25,000 on 1 and 2 August 2024. The written warning provided each time was fairly broad. And while it highlighted common signs of investment scams in general, it essentially told Mr H to check and verify who he was sending money to and to look for signs that the payment request might not be legitimate – such as being told to mislead the bank about the reason for the payment, being pressured to move savings and using social media to build up trust. Most of the features and advice listed in the warnings didn’t relate to Mr H’s circumstances. While the warning suggested checking the company with the “FCA”, it didn’t explain that FCA refers to the Financial Conduct Authority, or why that would be important. All things considered, the warning didn’t give clear advice about the actions Mr H needed to take to address the specific risk he was facing, it didn’t bring to life the specific scam Mr H was falling victim to and was therefore not impactful. As I’m not satisfied HSBC provided an effective warning, it follows that I can’t say Mr H ignored such a warning. Given that I’m not satisfied that HSBC can rely on an exception to reimbursement, Mr H is entitled to be reimbursed in full under the provisions of the CRM Code. Overall, I’m satisfied that Mr H was the victim of an APP scam as set out in the CRM Code and should be reimbursed as set out below. Putting things right I uphold this complaint and require HSBC UK Bank Plc to: - Reimburse Mr H £65,000; and - Pay interest on the above amount at the rate of 8% simple per year, worked out from the date 15 days after the claim was first made, as this is the latest date HSBC should have provided Mr H with an outcome as per the CRM Code.

-- 6 of 7 --

I consider this to be fair as there was information available at the time which I think would have indicated to HSBC that this was most likely a scam. It therefore follows that Mr H should be compensated for being deprived of these funds from that time, in line with our usual approach. If HSBC UK Bank Plc is legally required to deduct tax from the interest award it should send Mr H a tax deduction certificate so he can reclaim it from HMRC if appropriate. As there is an ongoing investigation by the police, it’s possible Mr H may recover some further funds in the future. In order to avoid the risk of double recovery, HSBC is entitled to take, if it wishes, an assignment of the rights to all future distributions under other processes in respect of Mr H’s £65,000 investment before paying the award. If HSBC elects to take an assignment of rights before paying compensation, it must first provide a draft of the assignment to Mr H for his consideration and agreement. My final decision For the reasons given above, I uphold this complaint. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr H to accept or reject my decision before 21 May 2026. Mike Southgate Ombudsman

-- 7 of 7 --