National Westminster Bank Plc · DRN-6068085

The complaint A charity I’ll refer to as E complains National Westminster Bank Plc won’t reimburse them for transactions they say they didn’t make. They’d like the funds returned to them. E is represented by Mrs W, a trustee. What happened E holds an account with NatWest. In July 2024 Mrs W contacted NatWest to say she couldn’t find the debit card, and didn’t recognise several ATM withdrawals totalling just under £3,000 the card. NatWest investigated, but declined to reimburse E. They said the withdrawals had been made using the card and PIN, at ATMs close to Mrs W’s house. They said there was no indication how someone could have come to have known the PIN, so they declined to reimburse E. NatWest issued a new card for E’s account. However in October 2024 Mrs W reported transactions on the second card as unrecognised – including ATM withdrawals, card payments and online payments. NatWest investigated but again declined to reimburse E. Mrs W complained to our service, saying she believed there were over £9,000 worth of fraud on E’s account. One of our investigators looked into what happened. He couldn’t see there was a reasonable explanation for how the transactions took place, as Mrs W had said she hadn’t shared the card and PIN with anyone. He felt it was reasonable for NatWest to decline any transactions made using the physical card. But he felt the payments online were different – except for one that had involved SMS authorisation, he thought it was likely these hadn’t been authorised by Mrs W and asked for them to be reimbursed. NatWest accepted, but Mrs W disagreed. She asked for the complaint to be considered by an ombudsman and also highlighted that she’d had difficulty getting statements for E’s accounts. As such the complaint has now been passed to me to decide. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, I broadly agree with the conclusions reached by the investigator. I’ll explain why. The key regulation about payments in the UK are the Payment Services Regulations 2017 (PSRs). Broadly these say that a bank can only deduct funds from a customer’s account if the payments have been properly authorised – which typically means a person with authority to act on the account telling the bank to make payment using an agreed method. Generally if a payment is authorised then NatWest don’t need to refund it, but they are expected to refund unauthorised transactions. But there are also caveats, such as where an

-- 1 of 3 --

individual has failed to keep their security details safe – either intentionally or with gross negligence. If that’s the case the bank can decline to refund unauthorised transactions. We know the first set of disputed transactions were all carried out at ATMs, so will have required the genuine card and PIN. We also know the ATMs used were close to Mrs W’s house. So, it would seem likely the withdrawals were being carried out either by Mrs W, or someone who would have had access to the card. The transactions on the second card also involved use of the genuine card and PIN. There are also transactions made using the same card Mrs W hasn’t disputed interspersed within the disputed ones. So, again it would seem to me that whoever was carrying out them out would require regular access to Mrs W’s card to take it and replace it regularly. There doesn’t seem to be any attempt to make significant purchases, or drain the entire balance of the account, which may suggest the work of a third-party fraudster. NatWest have questioned Mrs W about who else had access to the card, but she has been consistent that nobody else used the card and she had not shared the PIN. She’s also said the PIN wasn’t recorded anywhere in such a way that would allow someone else to use it. Our service has also questioned this, but there still isn’t a clear explanation of how the transactions could have come to be. In the absence of any reasonable explanation of how the physical card transactions could have been carried out by a third party, the only reasonable conclusion I can draw is they were more likely than not made by Mrs W, or someone who she had allowed to use the card. As such, I’m satisfied that it’s reasonable that NatWest treat them as authorised, and it’s not unreasonable for them to decline to refund them. The online transactions Mrs W has reported are slightly different. One of them was to a merchant that seems to be in line with the operation of E, and the technical evidence shows was approved using an SMS message sent to the contact details NatWest had on file. So, I think this is more likely than not an authorised transaction. The rest look to be to an online taxi service. There is not a great deal of information to tie these transactions directly to either Mrs W or E. I accept NatWest’s point that given the findings on the transactions made with a the physical card it seems possible these were carried out by Mrs W, or someone known to her. But here it doesn’t appear NatWest have any information from the taxi service to show who’s account was being used. And there is no indication there was additional authorisation carried out – such as a one-time passcode, or in-app verification. It’s considerably easier for fraudsters to steal and misuse card details rather than the physical card. So, on balance here I’m persuaded it would be reasonable for NatWest to refund these transactions – I make the total amount to be £125.50. My final decision My final decision is that National Westminster Bank Public Limited Company should refund E £125.50. Under the rules of the Financial Ombudsman Service, I’m required to ask E to accept or reject my decision before 20 April 2026. Thom Bennett Ombudsman

-- 2 of 3 --

-- 3 of 3 --