Upheld: unauthorised transaction / scam complaint against PayPal UK Ltd
Financial Ombudsman decision DRN-5907866 of 2026-05-29T00:00:00+00:00. unauthorised transaction / scam complaint against PayPal UK Ltd. Outcome: Upheld.
Decision detail
| Reference | DRN-5907866 |
|---|---|
| Decision date | 2026-05-29T00:00:00+00:00 |
| Firm | PayPal UK Ltd |
| Product | Other regulated product |
| Claim type | unauthorised transaction / scam |
| Outcome | Upheld |
| Remedy | PayPal UK Limited must: (1) re-work Mrs H's PayPal account such that the disputed transaction was never made; (2) remove any interest, fees or charges applied as a direct result of the transaction; (3) arrange to remove any adverse information recorded on Mrs H's credit file by PayPal or the debt collection agency. |
Summary
Mrs H fell victim to a social engineering scam in April 2025 when a fraudster posing as technical support tricked her into granting remote access to her computer, resulting in an unauthorised £924.73 visa payment through her PayPal account. PayPal declined her claim, arguing the account was accessed using her credentials and OTP. The ombudsman upheld Mrs H's complaint, finding that while the OTP was used, PayPal failed to provide sufficient technical evidence to prove the transaction was correctly authenticated and consented to. Under the Payment Service Regulations 2017, the transaction qualifies as a distance contract, meaning PayPal remains liable regardless of Mrs H's actions. PayPal was ordered to reverse the transaction, remove associated charges, and remove any adverse credit file information.
The Ombudsman's reasoning
The ombudsman found that Mrs H was the victim of a common scam targeting vulnerable individuals. While PayPal demonstrated that an OTP was used, it failed to provide sufficient technical evidence to prove the transaction was correctly authenticated and consented to by Mrs H. Under the Payment Service Regulations 2017, a payment is only authorised if correctly authenticated and consented to. The ombudsman determined that regulation 77(4)(d) of the PSRs applies, as the transaction was a distance contract (online visa payment), meaning PayPal remains liable for the unauthorised transaction regardless of Mrs H's actions in granting remote access.
How this compares
| Group | Decisions | Uphold rate |
|---|---|---|
| PayPal UK Ltd, all decisions | 238 | 18% |
| Other regulated product, all decisions | 52,408 | 30% |
Source
Read the original decision on the Financial Ombudsman Service website