Not upheld: Card / payment disputes complaint against PayPal UK Ltd

Decision detail

Summary

Miss C complained that PayPal held her responsible for a transaction in March 2026 that she claimed she did not authorise. PayPal refused to refund the transaction. The ombudsman examined whether the transaction was authorised under The Payment Services Regulations 2017, which requires both authentication and consent. While the transaction was authenticated using Miss C's username and password, the ombudsman found that consent was also present because her credentials had not been shared, a one-time passcode was sent to her genuine registered phone number, her phone was password protected, and she did not share the passcode with anyone. The ombudsman concluded Miss C most likely authorised the transaction and upheld PayPal's refusal to refund it.

The Ombudsman's reasoning

Under The Payment Services Regulations 2017, PayPal must refund unauthorised transactions unless the customer authorised them. Authorisation requires both authentication and consent. While the transaction was authenticated using Miss C's credentials, the ombudsman found that consent was also present because: (1) her username and password were used, which she had not shared; (2) a one-time passcode was sent to her genuine registered phone number; (3) her phone is password protected with no known compromise; and (4) she received the passcode and did not share it. The ombudsman concluded Miss C most likely did authorise the transaction or consented to someone else making it, and therefore PayPal acted fairly in refusing to refund it.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website