Upheld: Fraud reimbursement (APP scams) complaint against Caxton Payments Limited

Decision detail

Summary

Ms K lost £9,850 when a third party fraudulently accessed her email account, reset her Caxton password, and instructed an unauthorised payment. Caxton refused to refund the money, arguing its terms and conditions meant it was not responsible. The ombudsman upheld Ms K's complaint, finding that under the Payment Services Regulations 2017, a business cannot treat any instruction as authorised merely because it has been authenticated using the account holder's personalised security information. Ms K did not give any authority to another person and did not breach her obligations with intent or gross negligence. Caxton was instructed to refund £9,850 plus interest at 0.24% per annum from the date of loss to settlement.

The Ombudsman's reasoning

Under the Payment Services Regulations 2017, Ms K is only responsible for transactions she has authorised. A business cannot treat any instruction as authorised merely because it has been authenticated using the account holder's personalised security information; it must demonstrate the person instructing the payment either was, or had the authority of, the payment service user. Ms K did not give any authority to another person, and her password was reset fraudulently. Therefore, the transaction was not authorised by Ms K and Caxton is responsible for the loss. Ms K did not breach her obligations with intent or gross negligence, as she did not intentionally share sensitive information and there is no evidence she failed to maintain anti-virus protection. Caxton's terms and conditions cannot override the regulatory framework.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website