Not upheld: Fraud reimbursement (APP scams) complaint against Santander UK Plc

Decision detail

Summary

Ms G complained that Santander refused to refund £24,000 in transactions she did not authorize. The money was transferred to a fraudulent account opened in her name with third-party bank W after her phone was reset at a repair shop on 24 September 2025. Santander held Ms G liable because the transactions were made using her genuine mobile banking app from her usual device with proper authentication. The ombudsman found no plausible evidence that a third party could have accessed Ms G's device and guessed her five-digit app passcode, and concluded Ms G most likely authorized the transactions. Although the transaction should have triggered fraud detection systems, this did not determine liability under the Payment Service Regulations 2017. The complaint was not upheld.

The Ombudsman's reasoning

The ombudsman applied the Payment Service Regulations 2017, which require a business to prove a payment was authenticated and that the consumer consented to it. While the payments were properly authenticated using Ms G's genuine device and app, the critical issue was whether Ms G consented. The ombudsman found no plausible explanation for how a third party could have accessed both Ms G's device and her five-digit passcode without her involvement. Although Ms G suggested remote access via a browser update, no supporting evidence was provided. The ombudsman concluded that with thousands of possible passcode combinations, it was implausible a third party guessed the code on their first attempt. The existence of the fraudulent account at W, while concerning, did not itself prove the Santander transfers were unauthorized. Although the transaction should have triggered fraud detection systems, this does not determine liability where a payment has been authorized.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website