HSBC UK Bank Plc · DRN-6202620

The complaint A company which I’ll call ‘M’ complains that HSBC UK Bank Plc didn’t do enough to prevent the loss it suffered when it sent several payments to an account held with the bank as a result of a scam. The complaint is brought on M’s behalf by its director, who I’ll call Mr K. Mr K is represented throughout by Ms K, but for ease I’ll refer to Mr K throughout the decision. What happened Both parties are aware of the circumstances of the complaint, so I won’t repeat them all here. But briefly, on 25 November 2024, M received an email from an existing supplier’s email address requesting payment of some outstanding invoices. However, although it wasn’t identified by M at the time, the email hadn’t been sent from the supplier but from a scammer. The email said that the genuine suppliers bank details had changed, and M should make the invoice payments to its UK bank account – which belonged to the scammer. M didn’t think this was unusual as the genuine supplier had changed account details in the past. So, on 27 November 2024 it made the first payment for €28,783.36 from its bank in Bulgaria to a HSBC account in the UK which it thought belonged to the genuine supplier. M was then asked to pay the second invoice to a different account, and it made the second payment for €7,395.84 on 5 December 2024. On 30 December 2024, M was contacted by the genuine supplier to query why they hadn’t received payment for the goods they had provided. M then realised it had been the victim of a scam and complained to HSBC requesting the return of its funds. M also contacted its bank, the police in Bulgaria, and Action Fraud in the UK to assist with return of the funds. HSBC didn’t uphold the complaint. It acknowledged M’s report of fraud being committed but said that it couldn’t provide any details of its account holder. HSBC also said it was satisfied that it had taken the appropriate actions when opening the account and when being notified of the fraud. HSBC said that in line with industry regulations it would contact M’s bank and M should speak to its bank directly. M didn’t think this was fair and asked our service to look into its complaint. Our investigator didn’t recommend the complaint be upheld. He was satisfied HSBC had taken the action it should have when opening the beneficiary accounts and he also didn’t think the payments from M were sufficiently out of character that HSBC ought to have restricted the accounts when the payments were received. He said HSBC had intervened when some payments had been made from the first account, and there had been funds remaining which it would return when an indemnity had been received from M’s bank. He thought this was reasonable. M didn’t agree and asked for an ombudsman to review its complaint. It said sufficient evidence had been sent to HSBC from itself and different third parties showing the funds belonged to M and these should be returned without the need for an indemnity. It was also unhappy that HSBC wouldn’t answer questions about the beneficiary account holders.

-- 1 of 4 --

What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, I’m upholding the complaint as I think HSBC should return the funds it was able to recover without the need for an indemnity from M’s bank. However, I do not think HSBC should be responsible for refunding M in full because for me to fairly direct HSBC to pay redress, I’d need to be persuaded that any error’s it might have made was causal to the loss suffered (or it’s otherwise fair and reasonable that a payment should be made). As an account provider, HSBC has an obligation to be alert to various risks in relation to accounts with it. In line with its legal and regulatory obligations, it is expected to conduct its business with due skill, care, and diligence, and must fairly and reasonably have been monitoring accounts and any payments made or received to counter various risks including anti-money laundering and preventing fraud and scams. HSBC must also have systems in place to look out for unusual transactions or other signs that might indicate there is a risk of fraud. Ultimately, it is a matter for HSBC as to how it chooses to configure its fraud detection systems and strike a balance between allowing its customers to make business transactions and questioning these transactions to confirm they are legitimate. Here, it is alleged that HSBC didn’t do enough to prevent a loss which resulted from an authorised push payment scam which caused a loss to M. So, I need to decide based on the evidence from both parties, whether HSBC could and should fairly have done more to prevent the loss. HSBC has provided information to our service to allow us to investigate M’s complaint, but I’m limited on the information that I can share because it relates to different third-party accounts. I acknowledge M is frustrated HSBC would not share this information with it as well. However, HSBC has legal and regulatory obligations that it must meet including the protection of its customer’s information. So, I don’t think it’s unreasonable that HSBC wouldn’t provide information about its account holders to M. Indeed, the DISP rules our service follows allow us to receive information in confidence from either party. But I’d like to assure M that I’ve carefully reviewed everything when reaching my decision. I recognise that M’s director feels HSBC should be responsible for M’s loss as it opened accounts which were used by the fraudsters, but given the circumstances of this complaint, I don’t agree. HSBC is required to verify the identity of their account holders, and it has told us it is satisfied it did this. It has also said that there was nothing provided by its customer at the time of opening the account that reasonably could have put it on notice that the account was going to be used later to receive misappropriated funds. I’m satisfied HSBC did all it should and conducted appropriate checks prior to opening the account. It has shown evidence of the checks it undertook, and I can’t see that there were any potential causes for concern in relation to the documentation it was provided when opening the account. However, even if I were to find that HSBC ought not to have opened the accounts, or that its monitoring of the same accounts means it should have blocked or closed them prior to the arrival of any of the funds from M, I don’t think I could fairly say that these errors would’ve impacted the loss suffered by M. I say that because I can see that M followed the scammer’s instructions to make payments into two different accounts. and I can’t see that it queried this. Given the email exchange between M and the scammer, the immediate acceptance of the change of account details due to historic account changes by the genuine supplier, I think it’s likely that M would have made the payment to any account it was instructed to by the scammer. So, I’m sorry to disappoint M’s director, but I don’t think there is a fair and reasonable basis upon which I could tell HSBC to do more in view of this.

-- 2 of 4 --

However, the payments from M did arrive in the HSBC accounts, so I’ve gone on to consider whether anything reasonably could’ve been expected of HSBC in response to the activity on the accounts which would’ve meant more of funds would’ve been available for recovery. Account one Having reviewed the evidence provided by HSBC, I’m not persuaded that the two transactions stood out so significantly in the beneficiary accounts that it would reasonably have been expected to intervene. I can see that the first beneficiary account was opened a couple of months before M’s payment was received. The account had received credits from currency transactions of around £5,000 and £7,000 in the weeks before M’s transaction was received, and it had also made similar size payments from the account. So, the payment from M of £28,000 wouldn’t have appeared particularly suspicious when it was received. I can see that when the account owner made a larger payment than was usual for the account, the day after M’s payment was received, HSBC flagged this as unusual and restricted the account. HSBC has told us that it was able to ringfence £13,594.84 and this has been held, pending receipt of an indemnity from M’s bank. It’s not unreasonable for HSBC to ask for an indemnity against any future claims, especially when receiving international payments. But M isn’t party to the indemnity and can’t force its bank to issue one. I can see from the communication that HSBC has requested an indemnity on several occasions, but M has explained its bank wouldn’t generally provide this and has provided various other information to support its claim for the return of the funds instead. HSBC has accepted that the funds were received because of fraud, and there doesn’t appear to have been any further contact from its customer to dispute the specific ownership of these funds. I recognise HSBC is reluctant to release the funds due to potential conflicting requests for reimbursement, and I think initially this was reasonable. However, the funds have now been held for nearly fifteen months, and it appear no further claims or contact from the accountholder. Therefore, I see it as unfair to continue to deny M these funds, and it would be reasonable for HSBC to return them. Account two Looking at the second beneficiary account, this had been opened more than a year before M’s payment was received. It had also received credits from currency transactions prior to the credit from M, including a larger one of around £10,000. So, I don’t think the payment received from M would have appeared suspicious enough to HSBC to require it to undertake further investigation into the payment. Additionally, there hadn’t been any reports of fraud or anything that ought reasonably to have alerted it that it should have concerns about its account holder or the funds it had received from M. So, I think it was reasonable that HSBC payments to be made from the beneficiary account. I can see that the payment from M was credited to the account on 5 December 2024 and therefore there weren’t any funds remaining for HSBC to return to M when it was contacted about the fraud in January 2025. I don’t think HSBC could have done anything more here to recover the funds from received from M into this account. Putting things right I’m sorry to disappoint M’s director as I know they feel strongly about this complaint, and I understand that the fraud has a big financial impact on them. However, I can’t fairly hold HSBC responsible for M’s decision to make these payments simply because it had opened accounts for the scammer. So, whilst I sympathise with M for the situation it has found itself in, I’m not persuaded that its loss is as a result of failings by HSBC.

-- 3 of 4 --

However, HSBC has accepted its customer wasn’t entitled to the funds received from M and although it has requested an indemnity from M’s bank it seems unlikely given how much time has passed that it will receive this. I therefore think it’s reasonable for HSBC to return the £13,594.84 it was able to recover to M. My final decision My final decision is that I uphold this complaint and I instruct HSBC UK Bank Plc to refund M the recovered £13,594.84 in full. Under the rules of the Financial Ombudsman Service, I’m required to ask M to accept or reject my decision before 2 April 2026. Jenny Lomax Ombudsman

-- 4 of 4 --