Partially upheld: unauthorized transactions and continuous payment authority (CPA) consent complaint against Bank of Scotland plc trading as Halifax

Decision detail

Summary

Mrs C complained that Halifax declined to refund disputed payments she claimed she did not authorize. The first payments to two merchants were authenticated via one-time passcodes sent to her registered phone number and made from her registered device; the ombudsman found these were authorized as no evidence of account compromise existed. However, subsequent payments were taken via continuous payment authority (CPA) subscriptions, and Halifax failed to investigate whether Mrs C knew or consented to these CPAs. The ombudsman partially upheld the complaint, directing Halifax to refund all CPA transactions with interest while upholding the initial OTP-authenticated transactions.

The Ombudsman's reasoning

Under the Payment Services Regulations 2017, Halifax must show that payments were authenticated correctly and that Mrs C consented to them. For the initial OTP-authenticated transactions, the evidence showed they could only have been made with Mrs C's involvement or someone she authorized, and no point of compromise could be established. However, for subsequent CPA transactions, Halifax failed to satisfy itself that Mrs C knew or consented to the CPAs. The fact that the initial transactions were authorized did not entitle Halifax to treat subsequent CPA transactions the same way without investigating CPA consent. Therefore, the CPA transactions should be refunded.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website