Northern Bank Limited trading as Danske Bank · DRN-5700978

The complaint Mr C complains that Northern Bank Limited trading as Danske Bank will not reimburse the funds he lost to a scam. Mr C is professionally represented, but for ease I have only referred to Mr C in this decision. What happened The details of this complaint are well known to both parties so I will not repeat them all here. In summary, Mr C saw an advertisement on social media for a cryptocurrency investment opportunity. And between January and March 2023 he made payments for over £125,000 from a joint account and a sole account with Danske to an account he holds with another business that I’ll refer to as R. Mr C used the funds to purchase cryptocurrency before then sending it on to the scam platform. When Mr C realised it had been a scam, he reported the matter to Danske but it did not uphold his complaint. Our Investigator upheld the complaint in relation to Mr C’s sole account (which is the subject of this complaint), and the account with R. He thought both Danske and R ought to have intervened in the payments Mr C made and had they had done so, the scam would have been prevented. He thought Mr C should also bear some responsibility for the loss he incurred. However our Investigator did not uphold the complaint in relation to Mr C’s joint account. Mr C and R accepted our Investigator’s opinion, but Danske did not agree and in summary it said that customers making transfers to accounts they hold with other Payment Service Providers is a very common occurrence and low risk when the customer has advised that they are transferring to their own account. It also said that had Mr C chosen an appropriate payment purpose it would have provided a more relevant warning and screened the payments in a different manner. Our Investigator maintained their opinion on the matter, and as an agreement could not be reached the complaint has been passed to me for a final decision. I wrote to both businesses letting them know that while I agreed with what our Investigator said, I thought the complaints ought to be settled differently. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. Danske states that Me-to-Me scams are out of scope of the Authorised Push Payment (APP) refund scheme. However, the APP Scam Reimbursement rules apply to payments made after October 2024 and are not relevant to this complaint as the payments were made prior to the applicable date. Even so, the rules do not mean that Danske should not be held liable where there are failings on its part which are material to the loss its customer incurred as a result of a scam.

-- 1 of 3 --

Taking into account the law, regulators rules and guidance, relevant codes of practice and what I consider to have been good industry practice at the time, I consider Danske should: • Have been monitoring accounts and any payments made or received to counter various risks, including anti-money laundering, countering the financing of terrorism, and preventing fraud and scams. • Have had systems in place to look out for unusual transactions or other signs that might indicate that its customers were at risk of fraud (among other things). This is particularly so given the increase in sophisticated fraud and scams in recent years, which banks are generally more familiar with than the average customer. • In some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks, or provided additional warnings, before processing a payment – as in practice all banks do. • Have been mindful of – among other things – common scam scenarios, the evolving fraud landscape (including for example the use of multi-stage fraud by scammers and the use of payments to cryptocurrency accounts as a step to defraud customers) and the different risks these can present to consumers, when deciding whether to intervene. I accept that when asked, Mr C stated that he was paying his own account. Considering the payments were made to an account in his name with R, I’m satisfied he answered accurately and I don’t find his response unreasonable. In any event, I am satisfied that by January 2023 Danske ought reasonably to have been aware of the prevalence of multi-stage scams particularly involving payments to Electronic Money Institutions such as R, and the use of these accounts to purchase cryptocurrency. Multi-stage fraud involves money passing through more than one account under the consumer’s control before eventually being sent to a fraudster. And although the funds were transferred to an account in Mr C’s name, it does not absolve Danske of its responsibility to be on the lookout for fraud and to have systems in place to make checks and deliver appropriate warnings. I find Danske ought reasonably to have been concerned about the second payment from his sole account made on 23 February 2023 for £20,000. I say this because, I find this payment was out of character when considering his historic account activity. And taking into account the value of the transaction, that Mr C had recently received a large deposit which quickly debited from the account to a new payee, and the recent increase in activity in his sole account, I find the payment of £20,000 ought reasonably to have raised suspicions that Mr C might be at an increased risk of financial harm from fraud and warranted intervention by a member of staff. Had it intervened and asked appropriate open questions and probed Mr C’s answers, there is nothing to suggest Mr C would not have been honest. As such, I think it is likely that the scam would have been uncovered and the subsequent loss prevented. And I find it is fair and reasonable to hold Danske responsible in such circumstances. Considering the funds did not remain in Mr C’s account with R but were sent on to cryptocurrency platforms, I am satisfied there were no prospects for successfully recovering the funds at the time Danske was made aware of what happened. In order to reach a fair outcome on this case I’ve also thought about whether Mr C’s actions, or in-actions, mean he should share liability for his loss. I agree with our Investigator that Mr C acted negligently and ignored several red flags, therefore he ought to share responsibility for the loss he incurred. Considering the amount of money he was investing, I would expect

-- 2 of 3 --

Mr C to have undertaken independent research into the firm. Mr C said he conducted his own research, so I would expect him to have taken heed of several negative reviews and indications that the investment was a scam, which were available online prior to him making the disputed payments. The scammer also encouraged Mr C to take out a loan to fund the investment, which is not something a genuine and professional investment advisor would do. Putting things right Comparing Mr C’s actions against those of both Danske and R, I think that a fair deduction to the amount reimbursed is 50%. I’ve looked at the mistakes made by both businesses and I’ve found them to be very similar in nature – they both should have recognised that Mr C was at risk of financial harm from fraud and prevented some of his loss. Where two businesses have made the same or similar mistakes, I don’t think their combined mistakes mean that they are more at fault than they would be if only one of them had made that mistake. In light of this, I think Danske should refund 25% of the loss Mr C incurred from the second payment onwards. It should also pay 8% simple interest per annum on the amount reimbursed from the date of loss to the date of settlement to compensate Mr C for loss of use of these funds. My final decision My final decision is that I uphold this complaint and require Northern Bank Limited trading as Danske Bank to: • refund 25% of the loss Mr C incurred from the second payment onwards. That is £9,417.50. • Pay 8% simple interest per annum on the amount reimbursed from the date of loss to the date of settlement. If Northern Bank Limited trading as Danske Bank considers that it’s required by HM Revenue & Customs to deduct income tax from that interest, it should tell Mr C how much it’s taken off. It should also give Mr C a tax deduction certificate if he asks for one, so he can reclaim the tax from HM Revenue & Customs if appropriate. Under the rules of the Financial Ombudsman Service, I’m required to ask Mr C to accept or reject my decision before 1 April 2026. Oluwatobi Balogun Ombudsman

-- 3 of 3 --