Barclays Bank UK PLC · DRN-5950025

The complaint Mr K complains that Barclays Bank UK PLC allowed unauthorised transactions on a company account for which he is a director. Background Mr K is a director of a limited company, which I will call C. C is the complainant but for ease I will refer to Mr K throughout this decision, as he is bringing the complaint on C’s behalf. Mr K has said that that he didn’t authorise numerous transactions on his new business account between November and December 2023 – totalling £15,500. Mr K has explained that in 2023 he opened a new company account and was issued with a new debit card. He attended a branch to complete a transaction and believes that a bank employee took his debit card and failed to return it. Mr K believes this employee saw him enter his PIN and kept his card and subsequently used it to complete a series of unauthorised transactions. Barclays responded to Mr K’s complaint, saying that it was unable to identify any wrongdoing by a member of staff. Having reviewed the transactions in detail and taking into account the level of security required to complete them, Barclays was satisfied it had acted fairly in treating the transactions as authorised. I issued my provisional decision on 18 February 2026. As Mr K disagreed, I am issuing a final decision. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Having done so, I’m intending to reach the same conclusions as our Investigator and for materially the same reasons. I’ll explain why. Before I set out my thoughts, I want to acknowledge that I have summarised this complaint briefly and in less detail than has been provided. I’ve focused on what I think is the heart of the matter. While I may not comment on every point raised, I have considered it. I’m satisfied that I don’t need to comment on every individual point or argument to be able to reach what I think is the right outcome. Our rules allow me to do this and reflect the fact that we are an informal service and a free alternative for consumers to the courts. Where evidence is incomplete, inconclusive or contradictory, I reach my decision about the merits of this complaint on the balance of probabilities – in other words, what I consider is most likely to have happened in the light of the available evidence and the wider circumstances.

-- 1 of 4 --

As a starting point, Barclays is required to refund any unauthorised payments made from C’s account, and Mr K (on behalf of C) should only be responsible for transactions made on the account that were authorised. Those rules are set out in The Payment Service Regulations 2017. Mr K said he didn’t carry out the transactions in dispute. So, I have to decide whether or not Barclays acted fairly in treating the transactions as authorised. The disputed transactions were completed two separate ways. ATM withdrawals and Assisted Service Counter (ASC) withdrawals which Barclays has explained are withdrawals that occur in branch and are unmanned. However, a Barclays representative is on hand to provide assistance if required. Barclays has provided evidence to show that the card’s chip was read and PIN was entered correctly for a number of the disputed transactions. And given the amounts being withdrawn Barclays confirmed a PIN would have been needed to complete all the transactions in dispute. And based on what I’ve seen I’m persuaded that both Mr K’s card and PIN would have been needed to complete the transactions. Mr K hasn’t provided an explanation as to how anyone (apart from the Barclays member of staff) could have had access to his card and PIN. And I’ve gone on to consider if there is enough for me to say on balance a Barclays member of staff completed the transactions. I appreciate Mr K’s strength of feeling and have carefully reviewed all the information given. And I’ve carefully considered if there is enough information from me to say on balance a Barclays’ member of staff failed to return his card, saw him enter his PIN and subsequently completed a series of unauthorised transactions on the account. Mr K went into branch on 31 October 2023, and he says he entered his PIN in front of the Barclays member of staff. He believes his card wasn’t returned to him when Barclays returned his ID documents. He realised on 5 December 2023 that he no longer had the card in his possession – over a month later. He explained that he didn’t immediately report the card as lost to Barclays as he thought it was at home. I can also see that Barclays internal notes show a unique device ID was regularly logging into the account during the period in which the disputed transactions occurred. I’m satisfied this device ID belongs to Mr K’s device, as the phone number linked to the device matches the number we hold for Mr K. The first unauthorised transaction on the account occurred on 29 November 2023. I appreciate Mr K’s point that the reason the transactions didn’t occur sooner was because the Barclays member of staff was waiting for the CCTV footage to be deleted, however in my experience when a fraudster obtains the means to access funds - they tend to take as much out of the account as soon as possible. As every day that passes means that the victim could realise their account has been compromised, for example by realising they no longer have possession of their card – or noticing suspicious activity on their account. So they tend to want to make the most of the limited window they have to access the funds. I’ve also reviewed the interview notes from the member of staff Mr K has accused. I’ve noted that they don’t remember the specific interaction which isn’t unusual given the length of time that has passed. They also explain that if a debit card is left it is normally easy to spot and they keep the card in a drawer for safe keeping, and ask the consumer to pick the card up. They confirmed that they were unaware of any cards being left on the desk by Mr K. After carefully considering the information given there isn’t enough information for me to say on balance that the Barclays member of staff Mr K mentioned completed the transactions. I

-- 2 of 4 --

also haven’t been provided with anything else which persuades me that an unknown third party was able to obtain Mr K’s card and PIN. Mr K has provided a detailed timeline showing that he wasn’t in the area of where the disputed transactions occurred. While this may be true, he would still be liable for the payment if he allowed someone else to make it. And without another explanation for how a third party obtained his card and PIN, I don’t think Barclays has acted unreasonably in concluding that he authorised the payment. Given my findings, I do not consider is necessary to address whether Barclays ought to have intervened in the transactions. However, for completeness I would not have expected Barclays to have intervened given that it was a new account and the amounts involved. I don’t think the transactions were unusual enough to warrant further intervention or that there was a spending limit on the account that should have prevented the transactions. It is for these reasons that I am not asking Barclays to do anything more. Responses to my Provisional decision Mr K did not accept the provisional decision, and I’ve carefully reviewed the comments he has made. And the additional information Barclays has provided. Having done so I’m not departing from my provisional decision as detailed above. I do however want to address the concerns Mr K has raised about his account withdrawal limit, as Barclays has provided some further clarification around this and his comments about the transfers. Mr K has provided a screenshot of Barclays’ app showing card ending 1075, which I understand he is saying is linked to C’s account. The screenshot says that the daily cash withdrawal limit is £750. I can understand Mr K’s point that the screenshot does not specify that this limit applied only to ATM withdrawals. However, I don’t think it would be fair to rely on this screenshot in isolation. Barclays has provided a copy of its debit card application form which, in the summary of features preceding the form, says that customers can access cash of up to £750 per day, 24/7 from cash machines in the UK, and the next bullet point goes on to say “certain Barclays self- service devices support high value withdrawals . . .” Barclays has confirmed that the £750 cash withdrawal limit applies specifically to ATM withdrawals. An Assisted Service Counter is not an ATM, and therefore the £750 withdrawal limit does not apply. After carefully reviewing the information given, I’m satisfied that the £750 withdrawal limit does not apply to withdrawals made from Assisted Service Counter machines. Mr K has also said that on 1 December 2023 his ATM limit was exceeded by £500. However, the subsequent entry on the account is entitled “correction . . . .”. Barclays goes on to apologise for the error on his account which it has corrected – this entry shows £500 being added to the account. So, I’m satisfied that Barclays doesn’t need to do anything more in relation to this. Mr K believes that on 4 December 2023 more than the £750 was withdrawn from ATMs. I’ve carefully reviewed Mr K’s statement and can see that on 4 December 2023 there are numerous entries. However, if you read the description for those entries, it’s clear that not all the entries occurred on 4 December 2023. The two that did occur, happened at roughly 2.30pm and were for £500 and £250 so didn’t exceed the £750 ATM limit. The other ATM

-- 3 of 4 --

withdrawals occurred on the 2 December 2023 and 3 December 2023, and the withdrawals that happened on those days did not exceed the £750 ATM limit. I’m therefore satisfied that no breaches of the account conditions have happened based on the terms I’ve seen. And I’m satisfied that C’s genuine card and PIN was used for the withdrawals. Mr K has requested that Barclays provide internal notes showing details about the online transfer of funds into C’s account. Barclays is unwilling to share a lot of the information (such as IP address) with Mr K as it considers it confidential. However, I reviewed its internal notes and can see that the transfers were completed online and, for the reasons below, I’m satisfied it was fair for Barclays to treat those transfers as authorised by Mr K. Barclays confirmed that in order for a person to log onto online banking (and complete the transfers) they would require a lot of specific credentials. The person would require either mobile PIN sentry, PIN sentry card reader or a five-digit passcode alongside specific digits from a memorable word. They would also need the membership number, card number or sort code and account number. Having carefully reviewed the information provided, I have not been given a plausible explanation as to how the security details needed to access online banking could have been compromised. And after carefully reviewing the information given, I’m satisfied that Barclays acted fairly in treating the transfers as authorised given the amount of security credentials that needed to be completed before they went through. I have to make a finding on the balance of probabilities and taking everything into account to decide if Barclays fairly concluded that the transactions were authorised. Having done so I’m satisfied that Mr K’s genuine card and PIN were used for the withdrawals and the security details detailed above were used when completing the transfers online. And I haven’t been provided with a plausible explanation as to how an unknown third party was able to access these credentials without Mr K’s consent. For the reasons explained, I’m persuaded that Barclays acted fairly in treating the transfers and withdrawals as authorised. My final decision My final decision is that I do not uphold this complaint Under the rules of the Financial Ombudsman Service, I’m required to ask C to accept or reject my decision before 16 April 2026. Sureeni Weerasinghe Ombudsman

-- 4 of 4 --