Not upheld: unauthorised transaction / disputed payment complaint against PayPal UK Ltd

Decision detail

Summary

Mrs P complained that PayPal refused to refund a transaction of approximately £800 (147,699 Japanese Yen) to merchant F on 28 August 2025, which she claimed she did not authorise. PayPal maintained the transaction was authorised based on the correct use of a One Time Passcode sent to Mrs P's registered phone number, completion on a known device linked to her account, and use of a regular IP address. The ombudsman found that the security measures used by PayPal were sufficient to establish authorisation and that Mrs P must have either carried out the transaction herself, allowed someone else to use her device and OTP, or was grossly negligent in sharing security credentials. The complaint was not upheld.

The Ombudsman's reasoning

The ombudsman applied the Payment Service Regulations 2017 which require PayPal to refund unauthorised payments. However, the ombudsman found that the use of a One Time Passcode sent to Mrs P's registered phone number, combined with the transaction being completed on a known device via a regular IP address, constituted sufficient evidence of authorisation. The ombudsman concluded that only three possibilities existed: Mrs P carried out the transaction herself, she allowed someone else to use her device and OTP, or she was grossly negligent in sharing security credentials. In all three scenarios, Mrs P would be liable.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website