Upheld: Fraud reimbursement (APP scams) complaint against State Bank Of India (UK) Limited

Decision detail

Summary

Mr S complained that SBI UK failed to refund 15 unauthorised transfers totalling £49,104 made from his account between 15-16 April 2023 following compromise of his online banking credentials. The bank argued Mr S must have authorised the payments or been grossly negligent in protecting his security credentials. The ombudsman found the transactions were unauthorised based on IP geolocation evidence showing India-based access while Mr S was in the UK, malware detected on his device, and a suspicious email sent from his compromised account. The ombudsman rejected arguments that Mr S was grossly negligent, finding malware infection does not meet the high threshold for gross negligence. Additionally, the ombudsman found SBI UK breached its fraud prevention obligations by failing to intervene on the first £15,000 payment, which was out of character and to a new payee. The ombudsman upheld the complaint and ordered full refund plus 8% interest and £1,250 compensation for distress and inconvenience, reduced from an initial £1,500 after finding the bank had taken reasonable steps to enable access to remaining funds.

The Ombudsman's reasoning

The ombudsman found that Mr S did not authorise the payments based on: (1) IP geolocation evidence showing India-based access while Mr S was in the UK; (2) the implausibility of such high-volume activity in the middle of the night; (3) the suspicious email sent from his compromised account; and (4) Mr S's consistent testimony. The ombudsman rejected SBI UK's arguments that Mr S was grossly negligent, finding that while malware likely infected his device, this does not constitute gross negligence as malware is designed to appear legitimate. The ombudsman also found SBI UK breached its fraud prevention obligations by failing to intervene on the first £15,000 payment, which was out of character and to a new payee. The ombudsman determined Mr S was vulnerable in the aftermath of the fraud and that the bank's ambiguous response to his complaint was unhelpful. However, the ombudsman reduced compensation for distress from £1,500 to £1,250 after finding the bank had taken reasonable steps to enable access to remaining funds.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website