Not upheld: disputed transaction / unauthorised payment claim complaint against Lloyds Bank Plc

Decision detail

Summary

Miss B complained that Lloyds Bank Plc wrongfully declined to refund a disputed £2,000 transaction made via her mobile banking app on 29 July 2025 at 3:21am. Lloyds maintained the transaction was authorised because it was authenticated using Miss B's facial biometrics on her registered mobile device. The ombudsman examined technical evidence, device registration history, IP address logs, and biometric authentication records, finding no evidence of compromise or unauthorised access. Although Miss B had left her phone unattended during a business meeting that day, the ombudsman concluded it was more likely than not that she had authorised the transaction. The complaint was not upheld, and no refund or compensation was ordered.

The Ombudsman's reasoning

The ombudsman applied The Payment Services Regulations 2017, which require refunds for unauthorised transactions but hold consumers liable for authorised ones. The ombudsman found it more likely than not that the transaction was authorised by Miss B because: (1) facial biometrics were used to authenticate the payment; (2) the same registered device was used; (3) no evidence of biometric compromise existed; (4) the same IP address as previously used was employed; (5) Miss B continued using the same device and biometrics afterwards without issue; and (6) while malware and device compromise were theoretically possible, no evidence supported these scenarios. The ombudsman acknowledged Miss B's concerns about biometric security vulnerabilities but found no specific evidence of compromise in this case.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website