Not upheld: disputed transactions / alleged unauthorized payments complaint against Nationwide Building Society

Decision detail

Summary

Mrs B complained that Nationwide Building Society failed to refund two cryptocurrency transactions totalling £9,200 that she claimed she did not authorize, while Nationwide prevented a third similar transaction. Mrs B was in Pakistan when the transactions occurred and claimed she had been locked out of her online banking. Nationwide investigated and held Mrs B liable because they could not identify how a third party could have accessed her online banking without her knowledge or consent. The ombudsman's investigator initially sided with Mrs B, but the ombudsman's final decision upheld Nationwide's position, finding that the technical evidence—including successful device registration using Mrs B's credentials and OTPs, payments originating from a location consistent with Mrs B's tablet location, and transfers to Mrs B's genuine cryptocurrency account using her credentials—indicated that Mrs B most likely authorized the transactions despite her denials.

The Ombudsman's reasoning

The ombudsman applied the Payment Service Regulations 2017, which require that a business prove a payment was both authenticated and authorized by the consumer to hold them liable. While the ombudsman acknowledged that the payments were properly authenticated through Mrs B's app on her registered device, the critical question was whether Mrs B consented to the payments. The ombudsman found it implausible that a third party could have obtained Mrs B's banking credentials, customer number, personal details, and intercepted OTPs sent to her genuine phone and email without her knowledge or involvement, particularly given that the device registration and payments originated from a location similar to where Mrs B's tablet was located. The ombudsman rejected Mrs B's alternative explanations, including that the technical evidence showed login attempts rather than successful logins, that a phone rather than tablet was used, and that IP addresses are inconclusive. The ombudsman concluded that on balance, the evidence indicated Mrs B most likely authorized the transactions, even though the ombudsman acknowledged this was not a situation with absolute certainty.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website