Not upheld: unauthorised payment / fraud complaint against HSBC UK Bank Plc trading as first direct

Decision detail

Summary

Mr H disputed a £1,026 payment made via Apple Pay on his HSBC credit card, claiming he did not authorise it and was abroad at the time. HSBC declined to refund the payment, arguing the Apple Pay token was set up using an OTP sent to Mr H's registered phone number. The ombudsman found the payment was authorised because while Mr H did not make it himself, there was no credible explanation for how a fraudster could have obtained the OTP needed to set up the token, given Mr H's phone security and his testimony. The ombudsman also found HSBC had no obligation to prevent the payment as it was not unusually suspicious. The complaint was not upheld.

The Ombudsman's reasoning

The ombudsman applied the Payment Services Regulations 2017, which establish that consumers are liable for authorised payments and firms are liable for unauthorised ones. The key issue was whether the payment could fairly be treated as authorised. The ombudsman found that while Mr H did not make the payment himself (evidenced by his being abroad), there was no plausible explanation for how a fraudster could have obtained the OTP needed to set up the Apple Pay token, given that Mr H's phone was password-protected and used only by him, and he denied sharing any OTP. Without such an explanation, the ombudsman concluded it would not be reasonable to treat the payment as unauthorised. Regarding fraud prevention, the ombudsman found the payment value was not unusual, it was made to a legitimate merchant, and HSBC did decline subsequent payment attempts. Therefore, HSBC had no obligation to intervene. The ombudsman also found no service failings in HSBC's response timing or tone.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website