Not upheld: Card / payment disputes complaint against PayPal UK Ltd

Decision detail

Summary

Mr P complained that PayPal should refund 655 transactions made by his son between November 2023 and July 2025, which he claimed were unauthorised. PayPal refused, citing the 13-month reporting deadline under the Payment Services Regulations 2017 for transactions reported late, and arguing remaining transactions were authorised as an OTP was sent to Mr P's phone and used for the first payment, with subsequent payments made from the same device to the same merchant. The ombudsman upheld PayPal's position, finding the firm fairly applied the statutory reporting deadline and that the transactions were authorised as Mr P either made them himself or gave his son apparent authority by sharing the OTP code and failing to withdraw access.

The Ombudsman's reasoning

The ombudsman applied Regulation 74(1) of the Payment Services Regulations 2017, which requires unauthorised payment claims to be reported within 13 months of the debit date. For transactions reported after this deadline, PayPal fairly refused to investigate. For transactions within the deadline, the ombudsman found them authorised because: (1) an OTP was sent to Mr P's registered phone and used to approve the first payment, indicating Mr P either made the payment or shared the code with his son; (2) all subsequent payments used the same device and merchant, suggesting Mr P gave apparent authority; (3) Mr P made no attempts to withdraw consent by logging out; (4) the Payment Services Regulations contain no minimum age requirement for authorisation.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website