Upheld: unauthorised transaction and irresponsible credit agreement complaint against PayPal UK Ltd

Decision detail

Summary

Mr D's mobile phone was stolen in July 2023 while he was making a call. A third party used the stolen phone to take out an £1,099 credit agreement for a phone on Mr D's PayPal account. PayPal declined to cancel the agreement, claiming the transaction was authorised because Mr D's username and password were used. The ombudsman upheld Mr D's complaint, finding that while authentication was proven, consent was not. Evidence showed the password was reset via the 'forgotten password' function after the theft, allowing the thief to access Mr D's email and PayPal account. The transaction timing and unusual collection location further supported that the transaction was unauthorised. PayPal was directed to cancel the agreement, remove it from Mr D's credit file, and reimburse all payments with 8% interest.

The Ombudsman's reasoning

Under PSRs 2017, PayPal must prove both authentication and consumer consent. While authentication was proven (correct username and password used), consent was not. The password reset via 'forgotten password' function would have sent an email to the account holder's email address, which the thief could access via the stolen phone. The timing of the transaction (5:44am, shortly after password reset) and the unusual collection location (70 miles away, never used before) corroborate Mr D's account that the phone was stolen and he did not consent. Even if Mr D had failed to show reasonable care, under the Consumer Credit Act 1974, a consumer cannot be held liable for a credit agreement they did not consent to.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website