HSBC UK Bank Plc · DRN-5931621

The complaint Mr and Mrs S complain HSBC UK Bank Plc, trading as first direct (‘First Direct’), hasn’t reimbursed them following an Authorised Push Payment (‘APP’) investment scam they fell victim to. They say First Direct should reimburse them for the money they lost. What happened As both parties are familiar with the circumstances of this complaint, I’ve summarised them briefly below. Mr and Mrs S were introduced to a property investment opportunity with a company, that I’ll call ‘C’. Mr and Mrs S were introduced by someone Mr S knew, who had their own property company. Mr and Mrs S received brochures about C detailing the property investment opportunity. In short, C claimed to offer investments in specific units which they said they would be refurbishing and renting out as social housing through councils and housing authorities they held contracts with. Mr and Mrs S, interested in the investment opportunity, carried out some research of their own. They noted C was a registered company on Companies House and also saw that C had a website. Satisfied with what they had seen, Mr and Mrs S decided to invest £13,500 into the scheme. They expected to receive £600 per month as returns on their investment for three years and signed a contract to this effect. The investment contract was in Mrs S’s sole name; however the payment was sent from Mr S’s First Direct account on 26 July 2024. Mr and Mrs S were due their first return in October 2024, but it never materialised, with C citing unforeseen banking issues. Mr and Mrs S say they saw an announcement on C’s social media saying they couldn’t pay – but would reimburse investors. Mr and Mrs S say they were told to send their contract to C via email – but they received an out of office reply. Mr and Mrs S then looked at some forums on the internet and saw C was being reported as a scam. Mr and Mrs S believing they had been scammed decided to report the matter to First Direct in November 2024. First Direct wrote to Mr and Mrs S on 18 November 2024 explaining that the beneficiary bank (the bank that had received Mr and Mrs S’s payment) were carrying out an investigation – and it didn’t know how long it would take. Mr and Mrs S having not received an outcome or refund, formally complained to First Direct in July 2025. First Direct issued a final response advising that it was awaiting guidance from the banking industry and it had paused complaints relating to C. It explained that once an outcome had been reached it would get in touch with Mr and Mrs S.

-- 1 of 7 --

Unhappy, and seeing others receive refunds from other banking providers, Mr and Mrs S referred the matter to our service. Our Investigator considered the complaint. They explained that an applicable consideration in this case was the Lending Standards Board’s Contingent Reimbursement Model (‘CRM’) Code. This was a voluntary code which was in force at the time and which First Direct was a signatory to. The CRM Code required firms to reimburse customers who had been the victims of APP scams in all but a limited number of circumstances. The Investigator was persuaded there was enough evidence to demonstrate Mr and Mrs S’s payment to C met the CRM Code’s definition of an APP scam without needing to wait on the outcome of the police investigation. And they were persuaded Mr and Mrs S were eligible for a full refund of their outstanding loss under the CRM Code. The Investigator recommended First Direct should refund Mr and Mrs S’s loss – and pay additional interest (at 8% simple) to compensate them for its delay in refunding them. Mr and Mrs S accepted the Investigator’s findings but First Direct appealed. In summary, it says it’s reasonable to hold off on answering Mr and Mrs S’s scam claim pending the outcome of the police investigation, and the CRM Code has a provision within it which allows it to do so. As an informal agreement could not be reached, the complaint has been passed to me for a final decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. In deciding what’s fair and reasonable in all the circumstances of a complaint, I’m required to take into account relevant: law and regulations; regulators’ rules, guidance and standards; codes of practice; and, where appropriate, what I consider to have been good industry practice at the time. Having done so, I’ve reached the same outcome as our Investigator and for broadly the same reasons. Mr and Mrs S authorised the payments they are now disputing. The starting position in law is that they are liable for them. But First Direct was signatory to the CRM Code at the time of these payments – under which firms are generally expected to refund victims of APP scams. Is it appropriate to determine this complaint now? Firms must normally respond to a claim under the CRM code within 15 days. But First Direct argues it’s within its rights to delay giving a reimbursement decision to Mr and Mrs S at present, and this is in line with R3(1)(c) of the CRM Code, which says: “…if a case is subject to investigation by a statutory body and the outcome might reasonably inform the Firm’s decision, the Firm may wait for the outcome of the investigation before making a decision.” There is an ongoing police investigation into C. And First Direct says it would be unreasonable to make a decision without waiting for it to conclude. However, the specific details of the police investigation haven’t been shared with our service. It’s not clear whether any proceedings will concern charges that will have a significant bearing on the issues relevant to this complaint.

-- 2 of 7 --

As First Direct is aware, any criminal proceedings that may take place in connection with C will be based on the criminal burden of proof – whereas our service makes decisions on the balance of probabilities. And we don’t know how long the investigation will take; it could be months or years. In a similar vein, First Direct argues our service shouldn’t consider this matter due to the complexity involved (at present) in determining whether C were a scam. But I’d point out that our service must consider complaints quickly and with minimum formality. I don’t think it would be appropriate to delay giving an answer on this complaint, for an undefined period of time, unless doing so is likely to significantly help me decide this issue. What I need to decide here is whether, on balance, Mr and Mrs S were scammed. As R3(1)(c) explains, firms can only hold off on giving an answer under the CRM Code if the outcome of an ongoing statutory investigation might reasonably inform its decision. In looking at the information we already know about C, and Mr and Mrs S’s dealings with them, I’m not persuaded the outcome of the police investigation is likely to have a bearing on this decision. Overall, I’m persuaded it’s appropriate for us to look into this complaint – and I’m satisfied there is already enough to show the payment in question meets the CRM Code’s definition of an APP scam – and that First Direct should have refunded Mr and Mrs S when they first raised this claim. I’ll explain why. In order to reach a decision, I’ve considered the definition of an APP scam under the CRM Code. Under DS1(2)(a) an APP scam is defined as: “Authorised Push Payment scam, that is, a transfer of funds executed across Faster Payments, CHAPS or an internal book transfer, authorised by a Customer in accordance with regulation 67 of the PSRs, where: (i) The Customer intended to transfer funds to another person, but was instead deceived into transferring the funds to a different person; or (ii) The Customer transferred funds to another person for what they believed were legitimate purposes but which were in fact fraudulent.” DS2(2)(b) explains that the CRM Code does not apply to: “private civil disputes, such as where a Customer has paid a legitimate supplier for goods, services, or digital content but has not received them, they are defective in some way, or the Customer is otherwise dissatisfied with the supplier” The CRM Code only applies if the definition of an APP scam is met, as set out above. As I’ve also set out above, the CRM Code doesn’t apply to private civil disputes. So, the CRM Code wouldn’t apply to a payment made for a genuine investment that subsequently failed. As there’s no dispute that Mr and Mrs S’s funds were transferred to the intended recipient, I don’t consider section DS1(2)(a)(i) of the definition to be relevant to this dispute. Therefore, in order for there to have been an APP scam, Mr and Mrs S must have transferred funds to C for what they believed were legitimate purposes, but which were in fact fraudulent, as set out in section DS1(2)(a)(ii).

-- 3 of 7 --

I’ve therefore considered whether or not Mr and Mrs S’s intended purpose for the payment was legitimate, whether or not the intended purposes of Mr and Mrs S and C were substantially aligned and, if not, whether or not this was the result of dishonest deception on the part of C. I consider it is clear that Mr and Mrs S intended to pay C for what they believed was a legitimate purpose (for a property development investment). And, for the following reasons, I’m persuaded C’s purpose was different and it fraudulently deceived Mr and Mrs S into making the payment. C held accounts which show around £6,000,000 being spent in a way that appears consistent with property development. But it also received around £20,200,000 from investors. Given C’s standard unit price of £13,500, that means it would need to have entered around 1,500 property agreements. But the outgoing payments aren’t consistent with C paying for rent, refurbishments and furnishings for this many agreements. C claimed to hold contracts with local authorities – as they would need to have done to fulfil the investor agreements. But their beneficiary statements show no incoming payments from local authorities or housing providers. Additionally, several local authorities have confirmed they didn’t have a working relationship with C – with one confirming an invoice C used to supposedly demonstrate their working relationship was forged. A director of C was also removed from Companies House due to their identity being stolen; they had no connection to C. This speaks to a dishonest deception by C. Our service has seen evidence that at least six different units were sold to multiple investors. This comes from complainants providing the individual property addresses they thought their investment was purchasing across around 100 complaints. This information also shows around half of those addresses were in buildings where the owners have confirmed they didn’t have a relationship with C. We’ve also seen instances where the properties remained derelict after the investment was made or remained under construction when they were supposedly generating an income. All of this makes it seem unlikely C intended to use Mr and Mrs S’s payment for genuine property development investments. Turning back to C’s accounts, we can see around a third of the investment capital wasn’t used for the purpose of securing and developing properties to be used for social housing – ranging from cash withdrawals, to payments to individuals involved in operating C, to paying jewellers, restaurants and more. There are further substantial withdrawals and payments which the purpose for is unknown. Around £440,000 C received could be legitimate income, although none of this came from local authorities or social housing providers. But in comparison, £2,500,000 was paid to investors. It’s clear this didn’t come from genuine income – strongly indicating C were operating a Ponzi scheme. Overall, there is little to suggest any transactions are consistent with C completing property development for the benefit of investors, and much more to suggest C wasn’t using investors’ funds for the intended purpose. Even if any of the funds C received were used for property development, it seems likely this was done with the intention of encouraging further investment as part of an overall scam. For these reasons, I’m satisfied Mr and Mrs S’s payment to C meets the CRM Code’s definition of an APP scam – and it’s unlikely the outcome of the police investigation will impact this.

-- 4 of 7 --

So, as I’m satisfied Mr and Mrs S have most likely been the victims of an APP scam, I’ve considered whether they should be reimbursed under the CRM Code. Are Mr and Mrs S entitled to reimbursement under the CRM Code? The starting position under the CRM Code is that firms should refund victims of APP scams – as I’ve determined Mr and Mrs S were. However, there are some exceptions under the rules which, if applicable, firms can rely on to decline reimbursement. There are generally two exceptions to reimbursement: • Mr and Mrs S made the payment without a reasonable basis for believing that they were for genuine goods or services; and/or C was legitimate. • Mr and Mrs S ignored what the CRM Code deems to be an ‘Effective Warning’. And importantly, when assessing whether it can establish these things, First Direct must consider whether they would have had a ‘material effect on preventing the APP scam’. I have considered whether Mr and Mrs S had a reasonable basis to believe C was legitimate and was providing a genuine investment opportunity. In doing so, I have considered the following: • Mr and Mrs S were informed about C by someone Mr S had known for many years and was someone who was the director of their own property company. I think Mr and Mrs S had no reason to doubt the opportunity or its legitimacy when being introduced to it by someone within that sector. • Mr and Mrs S carried out some research into C, including checking Companies House, with C being registered, and checking the internet for C and seeing its website. • The paperwork, brochures Mr and Mrs S received relating to the investment appear professional and I don’t consider there were any clear warning signs or red flags present. • I don’t consider the rate of return that was set out was so high that it should have raised any suspicions when investors were told that the scheme was government backed – providing an assurance on rents. In the overall context of this sophisticated scam, and bearing in mind the investment was allegedly based around social housing provision, I don’t think it’s unreasonable Mr and Mrs S believed this and thought C were offering a legitimate investment. So, given how Mr and Mrs S had been introduced to C, and what they had been told and had seen, and what they had found out themselves, I think there was enough to reasonably convince Mr and Mrs S that this was a genuine investment. With this in mind, I don’t think Mr and Mrs S made the payment without a reasonable basis of belief that C was acting legitimately.

-- 5 of 7 --

I’ve also thought about the warning that was provided when Mr S made this payment. But having done so I don’t think I can fairly say that Mr S ignored an effective warning during the course of this scam as the written warning First Direct has said Mr S saw does not meet the definition of an effective warning as set out in the CRM Code. It appears that Mr S chose a payment purpose of ‘Cryptocurrency or Investments’ – but was shown a warning (according to First Direct’s audit trail) in relation to cryptocurrency investment scams. I’m therefore satisfied that Mr S did not see any warnings that could reasonably be expected to have affected his basis for belief that C was legitimate. I am also mindful the CRM Code explains that a firm, in assessing whether an exception to reimbursement applies such as ignoring an effective warning, has to take into account whether it would have had a ‘material effect on preventing the APP scam’. Here, Mr and Mrs S had no reason to believe that C wasn’t a genuine investment company at the time. So, I think it is fair to say that even had First Direct provided a more specific warning relating to ‘investment’, it wouldn’t have had a material effect on preventing the scam, such was Mr and Mrs S’s belief in things and that C was a legitimate property investment company. With the above in mind, I don’t think any of the exceptions to reimbursement under the CRM Code apply here. It follows that First Direct should re-imburse Mr and Mrs S’s outstanding loss in full. Outside the provisions of the CRM Code, I consider it unlikely that any intervention by First Direct at the time of the payment would have positively impacted Mr and Mrs S’s decision-making. I don’t think either party would have likely uncovered sufficient cause for concern about C at the time such that Mr and Mrs S would have chosen not to proceed. The investigator thought First Direct should pay 8% simple interest per year on top of the refund amount, running from 15 days after it received Mr and Mrs S’s claim to the date of settlement. That is the point at which they concluded First Direct should have refunded them under the terms of the CRM Code. Given the information available about C at the time of Mr and Mrs S’s claim, I’m persuaded First Direct had enough to consider and refund their claim within this timeframe. Summary Overall, I do not consider it necessary to await the outcome of the ongoing police investigations into C and any subsequent proceedings that may happen as a result. I am satisfied, based on the evidence available, that Mr and Mrs S were more likely than not the victims of an APP scam. And their fraud claim is therefore covered by the provisions of the CRM Code. I’m also satisfied no exceptions to reimbursement under the CRM Code apply. So, it follows that I’m satisfied First Direct should reimburse Mr and Mrs S under the provisions of the CRM Code. First Direct is entitled to take, if it so wishes, an assignment of the rights to all future distributions to Mr and Mrs S under any processes relating to the police investigation and any potential compensation that may be returned to victims.

-- 6 of 7 --

Putting things right I uphold this complaint. First Direct, should pay Mr and Mrs S: • £13,500 lost to the scam orchestrated by C; and • 8% simple interest per annum on this amount, from 15 days after the claim was first made. This is to compensate Mr and Mrs S for the loss of use of these funds from the point at which the funds should’ve been refunded by First Direct. • If First Direct considers that it’s required by HM Revenue & Customs to deduct income tax from that interest, it should tell Mr and Mrs S how much it’s taken off. It should also give them a tax deduction certificate if they ask for one, so they can reclaim the tax from HM Revenue & Customs if appropriate. • In order to avoid the risk of double recovery, First Direct is entitled to take (if it wishes) an assignment of the rights to all future distributions in relation to the scam payment we’re upholding that arise (such as from the police investigation and criminal proceedings), before paying the award. If First Direct elects to take an assignment of rights before paying compensation, it must first provide a draft of the assignment to Mr and Mrs S for their consideration and agreement. My final decision For the reasons given above, I uphold this complaint and direct HSBC UK Bank Plc, trading as first direct, to put things right in the way I’ve set out above. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr S and Mrs S to accept or reject my decision before 20 April 2026. Matthew Horner Ombudsman

-- 7 of 7 --