Gregory Moniak, R (on the application of) v Financial Ombudsman Service Limited

This is a challenge brought by Gregory Moniak (“the Claimant”) against the Financial Ombudsman Service (“FOS”). The Claimant seeks to challenge a decision of one of the FOS’ ombudsman, Richard Drury (“the Ombudsman”), taken on 28 October 2024 dismissing his complaint against Barclays Bank (“the Interested Party”).

The background to the case is a sad one. In 2010 the Claimant inherited a significant sum of money, around £450,000, from his father. He was at the time very vulnerable. He was a drug addict who used crack cocaine, and was, in his own words, “high most of the time”. Unfortunately for him, he was befriended by two individuals. Over the course of a little over two months, in late 2010 and early 2011, they stole almost the entirety of his inheritance from accounts he held at Barclays Bank. The Claimant only discovered the fraud in 2015. He then sought to recover the money from Barclays and complained to the FOS when Barclays declined to reimburse him. The Ombudsman rejected his complaint (other than in relation to two relatively small sums). He did so based on two findings of fact. First, the Ombudsman concluded that Barclays was not liable to reimburse the Claimant, notwithstanding that the fraudulent payments were unauthorised, because he had intentionally allowed one of the fraudsters to access his card and PIN, or was grossly negligent in terms of ensuring his card and PIN were safe. Second, the Ombudsman concluded that the Claimant had provided one of the fraudsters’ phone numbers to Barclays as his contact number, and the bank consequently called the fraudster when it had concerns about some of the transactions. The Ombudsman therefore concluded that the bank was not at fault in failing to detect the fraud.

In these judicial review proceedings, the Claimant submits that both of those factual findings were irrational. He says they were based upon no, or insufficient, evidence. I deal with those submissions below. Nothing in this judgment, however, should detract from the very great wrong that was done to the Claimant. He was defrauded by people he thought he trusted at a time when, as the fraudsters would have been well aware, he was vulnerable, and they used that vulnerability and the trust he placed in them to steal almost the entirety of his inheritance. The fraudsters have, rightly, been prosecuted and convicted. That does not, however, determine Barclays’ responsibility. The issue before the Ombudsman was whether Barclays was required to refund the money stolen from the Claimant, and the issue before me is whether the Ombudsman’s decision that it was not required to do so was an unlawful decision that was not open to him to make.

I am grateful to counsel for the clear and helpful way they put the case in writing and orally. I set out my reasons and decision below.

The FOS was established by section 225(1) of the Financial Services and Markets Act 2000 (“FSMA 2000”) to provide a scheme under which “certain disputes may be resolved quickly and with minimum formality by an independent person”. The scheme is known as the “ombudsman scheme” (FSMA 2000 s 225(3)), and it seeks, in essence, to resolve complaints brought by customers about the provision of financial services.

FSMA 2000 s 225(4) and Schedule 17 paragraphs 13 and 14 provide that the Financial Conduct Authority (“FCA”) must make rules governing the jurisdiction of the ombudsman. These are contained in the FCA’s Handbook. It includes a section entitled “DISP”, or “Dispute Resolution: Complaints”.

The FOS has a “compulsory jurisdiction” in relation to “complaints” if certain conditions were met. They are set out in FSMA 2000 s 226 and DISP2 of the FCA Handbook. They provide that to fall within the ombudsman’s jurisdiction the complainant must be “eligible”, the respondent must be an “authorised person”, and the act or omission that is the subject of the complaint must relate to “regulated activities.” There is no dispute in this case that the complaint fell within the compulsory jurisdiction of the Ombudsman.

FSMA 2000 s 228(2) provides that “a complaint is to be determined by reference to what is, in the opinion of the ombudsman, fair and reasonable in all the circumstances of the case.” That is repeated in DISP 3.6.1R. DISP 3.6.4R further provides that:

In considering what is fair and reasonable in all the circumstances of the case, the Ombudsman will take into account:

(1)

relevant: (a) law and regulations; (b) regulators' rules, guidance and standards; (c) codes of practice; and

(2)

(where appropriate) what he considers to have been good industry practice at the relevant time.

A number of authorities have considered the ombudsman’s jurisdiction. As relevant to the present proceedings they, and other relevant provisions applicable to the ombudsman, are as follows:

The present case is not primarily concerned, as some are, with a challenge to the Ombudsman’s general assessment of whether the conduct of a financial service provider was “fair and reasonable in all the circumstances”. The Ombudsman in this case was dealing with a more hard-edged question. His decision specifically concerned whether Barclays Bank was required to repay money to the Claimant pursuant to the Payment Services Regulations 2009 (“PSR 2009”).

PSR 2009 provides that where a “payment transaction was not authorised … the payment service provider must immediately refund the amount of the unauthorised payment transaction to the payer” (Regulation 61). That, however, is subject to Regulation 62(2). Pursuant to Regulation 62(2), a payment service provider is not liable for “losses incurred in respect of an unauthorised payment transaction where the payer … has with intent or gross negligence failed to comply with regulation 57.” Regulation 57 provides that:

(1)

A payment service user to whom a payment instrument has been issued must—

(a)

use the payment instrument in accordance with the terms and conditions governing its issue and use; and

(b)

notify the payment service provider in the agreed manner and without undue delay on becoming aware of the loss, theft, misappropriation or unauthorised use of the payment instrument.

(2)

The payment service user must on receiving a payment instrument take all reasonable steps to keep its personalised security features safe.

A “payment instrument” is defined by Regulation 2(1) PSR 2009 as any “(a) personalised service or (b) personalised set of procedures agreed between the payment service user and the payment service provider, used by the payment service user in order to initiate a payment order”. As set out in Barclays’ Terms and Conditions, which the Ombudsman concluded applied at the material time, pursuant to paragraph 3.4 a “payment instrument” is:

(i)

a physical device, like a card; or

(ii)

a set of procedures involving, for example, the use of passwords, security keys, cards, personal identifier(s), codes, Personal Identification Numbers (PINs) or biometric data; or

(iii)

a physical device and a set of procedures (like a card used with a PIN).

Barclays’ Terms and Conditions further state at paragraphs 3.5-3.6 in relation to customers’ use of payment instruments:

You must do all that you reasonably can to make sure that, if the Payment Instrument is a device, it is kept secure, or, if it is a password or PIN (or something similar), it is kept secret. In particular, it is important that you follow any security instructions we give you.

You must not give anyone else your Payment Instrument or any information about your Payment Instrument that would enable them to use it. For example, this means you should not store information on a mobile phone, personal organiser, browser or other hardware or software that would allow anyone using the same equipment to see the stored details. In addition you must: (a) try to remember any personal identifiers such as a code or PIN; and (b) destroy the written details we send you and never record them in a way that might be recognised by someone else.

The approach which payment service providers should take when they consider whether a payer has intentionally or with gross negligence failed to comply with obligations regarding the security of a payment instrument is set out in FCA Guidance, “FCA’s role under the [PSR]”. It provides at paragraph 8.116:

If the payment service provider can show that the payer has acted fraudulently, or has intentionally, or with gross negligence, not complied with their obligations regarding the security of the payment instrument, the payer will be liable for all losses. To avoid doubt, it is not sufficient for the payment service provider to assert that the customer ‘must have’ divulged the personalised security features of the payment instrument, and to effectively require the customer to prove that he did not. The burden of proof lies with the payment service provider and if a claim that a transaction is unauthorised is rejected, the rejection must be supported by sufficient evidence to prove that the customer is guilty of fraud, gross negligence or intentional breach and the reason for the rejection must be explained to the customer.

The effect of PSR 2009 and Barclays’ Terms and Conditions is that, insofar as the transactions carried on the Claimant’s account were “not authorised”, the Bank would be required to repay the money to him. That is unless it could show that the Claimant had intentionally provided a Barclays “payment instrument” (here his card or PIN) to the fraudsters or had been grossly negligent in failing to keep the payment instruments safe. As set out further below, in the present case it is accepted that the fraudulent payments from the Claimant’s account were “not authorised” within the meaning of PSR 2009 Regulation 61. The key question for the Ombudsman, therefore, was whether Barclays had established, on the balance of probability, that the Claimant had not complied with the obligations regarding the security of his card and PIN, and whether that failure was either intentional or constituted gross negligence. It is not disputed that that required Barclays doing more than “assert[ing] that [the Claimant] ‘must have’ divulged the personalised security features of the payment instrument”. It was necessary for Barclays, supported by sufficient evidence, “to prove that the [Claimant was] guilty of … gross negligence or intentional breach”.

The meaning of “gross negligence” was set out in the Ombudsman’s decision. He stated “[t]he ordinary meaning of gross negligence goes beyond ordinary carelessness. It indicates more than just a lack of care sufficient to constitute negligence, and it may include a significant disregard or indifference to an obvious risk”. He described gross negligence as a requiring “a very significant degree of carelessness.” It was not disputed before me that that was an accurate description of the law.

One issue which was disputed, however, was the relationship between gross negligence and an individual’s vulnerability. Mr MacDonald referred me to a consultation by the Payment Systems Regulator in relation to reimbursement following Authorised Push Payment (“APP”) fraud. In relation to APP fraud, there is also an exclusion for the provision of reimbursements to those defrauded if there has been “gross negligence”. It was suggested in the consultation that gross negligence “is a very high bar” and that “gross negligence will never apply where a victim's vulnerability is a factor in them being defrauded.” I was told at the hearing that this aspect of the consultation is now reflected in Payment System Regulator’s guidance on APP fraud.

Mr MacDonald argued that I should read the “gross negligence” provisions in PSR 2009 in a similar way to the APP fraud provision, so as to preclude a finding of “gross negligence” where a victim’s vulnerability was a factor in their being defrauded. Mr Strachan invited me to reject the submission. He pointed out that the context of APP fraud is different. It arises in the specific circumstances of a person being tricked into sending money to a fraudster posing as a genuine payee, and there is no reason to think that provisions regarding gross negligence of customers in that context can simply be read across to the present context. I agree. Indeed, the fact there is no similar provision in the FCA’s guidance on the PSR 2009 might positively suggest a different approach is to be taken outside of the specific context of APP fraud. In any event, I can see no basis for giving the words “gross negligence” in PSR 2009 Regulation 62(2) anything other than their ordinary meaning. I accept, as the Ombudsman did, that it is a high threshold going beyond mere negligence. I see no reason for putting a further gloss on the definition by reference to the approach taken in guidance produced for a different context.

The Claimant’s challenge is to the rationality of the Ombudsman’s decision, and Mr MacDonald argued before me that he was relying upon what he described as “process” rather than “outcome” irrationality.

The distinction can be traced to R (The Law Society of England and Wales) v The Lord Chancellor [2018] EWHC 2094 (Admin); [2019] 1 WLR 1649. The Divisional Court, at paragraph 98, suggested that “irrationality” has two aspects. The first is concerned with “whether the decision under review is capable of being justified or whether in the classic Wednesbury formulation it is ‘so unreasonable that no reasonable authority could ever have come to it’” or to put it another way “whether the decision is outside the range of reasonable decisions open to the decisionmaker” (ibid). That is “outcome” irrationality. The second aspect of irrationality is that the decision contains “a demonstrable flaw in the reasoning” such as “reasoning involv[ing] a serious logical or methodological error” (ibid). That is “process” irrationality.

The distinction was further explained in R (KP) v Secretary of State for Foreign, Commonwealth and Development Affairs [2025] EWHC 370 (Admin). Mr MacDonald relied upon Chamberlain J’s judgment in KP at paragraphs 55-57:

55.

In most contexts, rationality is the standard by which the common law measures the conduct of a public decision-maker where there has been no infringement of a legal right, no misdirection of law and no procedural unfairness. It encompasses both the process of reasoning by which a decision is reached (sometimes referred to as “process rationality”) and the outcome (“outcome rationality”): see e.g. R (Law Society) v Lord Chancellor [2018] EWHC 2094 (Admin), [2019] 1 WLR 1649, [98] (Leggatt LJ and Carr J).

56.

Process rationality includes the requirement that the decision maker must have regard to all mandatorily relevant considerations and no irrelevant ones, but is not limited to that. In addition, the process of reasoning should contain no logical error or critical gap. This is the type of irrationality Sedley J was describing when he spoke of a decision that “does not add up – in which, in other words, there is an error of reasoning which robs the decision of logic”: R v Parliamentary Commissioner for Administration ex p. Balchin [1998] 1 PLR. In similar vein, Saini J said that the court should ask, “does the conclusion follow from the evidence or is there an unexplained evidential gap or leap in reasoning which fails to justify the conclusion?”: R (Wells) v Parole Board [2019] EWHC 2710 (Admin), at [33].

57.

Outcome rationality, on the other hand, is concerned with whether – even where the process of reasoning leading to the challenged decision is not materially flawed – the outcome is “so unreasonable that no reasonable authority could ever have come to it” (Associated Wednesbury Picture Houses Ltd v Wednesbury Corporation [1948] 1 KB 223, 233-4) or, in simpler and less question-begging terms, outside the “range of reasonable decisions open to a decision-maker ” (Boddington v British Transport Police [1999] 2 AC 143, 175).

For claimants there may be a perceived benefit in presenting a claim as a “process” rather than an “outcome” rationality challenge. The former feels more hard-edged and avoids the high hurdle, in particular when dealing with expert decision-makers, often associated with showing that a decision is one that no reasonable authority could reach. The two aspects of rationality can obviously overlap. A decision that is reached following a logical error may well be one that is outside the range of reasonable decisions open to a decision-maker. The two aspects are, however, distinct, and it is important to have in mind the distinction and the particular nature of the challenge being brought. A number of points are relevant to the present case.

First, when we speak of “process” or “outcome” rationality, that is referring to how a decision is being challenged rather than the nature of the decision. A reference to an “outcome” rationality challenge does not mean a challenge only to the final “outcome” of a decision (in the sense, for example, of a challenge to whether the ombudsman ultimately upholds or rejects a complaint). A factual finding that is made by a decision-maker as an element of his or her decision, like a final conclusion, can equally be challenged on the basis of outcome irrationality. It can be said that it is a factual finding that is outside the range of reasonable decisions open to a decision-maker. Similarly, a factual finding and a final conclusion, can also both be challenged on the basis of process irrationality. It can be said that the way in which the factual determination was made, or the final conclusion reached, betrays some flaw in reasoning or logical error.

Second, the present case is concerned with challenges to a decision-maker’s factual findings. There are differences between a process rationality and an outcome rationality challenge in that regard:

The factual background to the fraud is set out in more detail below in the discussion of the Ombudsman’s decision and the Claimant’s challenge to it. Essentially, the core facts are as follows.

The Claimant was, in 2010, and in the years thereafter, a drug addict who regularly used crack cocaine and heroin. He led a chaotic lifestyle and was “high most of the time”. The Claimant was befriended by a Mr Saeed. Mr Saeed became the Claimant’s drug dealer and took drugs with him. It is not clear whether the reason Mr Saeed befriended the Claimant was to enable him to perpetrate the fraud he ultimately committed, but it is clear Mr Saeed became aware that the Claimant was due to receive a significant inheritance. The inheritance was the proceeds of a sale of property owned by the Claimant’s late father. On 11 November 2010 the Claimant received around £450,000 comprising his share of the inheritance. He paid the money into his current account at Barclays. On 19 November 2010 he opened a savings account at Barclays and deposited £370,000 of the inheritance there.

In the following months the Claimant was a victim of a ruthless and efficient fraud perpetrated by Mr Saeed and his wife, Ms Jan. In ways set out in the Ombudsman’s decision and discussed below, the fraudsters contrived to arrange payments and withdrawals from the Claimant’s account to themselves or those connected to them. These payments began almost immediately after the inheritance was received by the Claimant in November 2010. The principal fraud, however, occurred from 23 December 2010 to 11 March 2011. Over those months Mr Saeed and Ms Jan effectively emptied the Claimant’s accounts. They did so through a mixture of cash withdrawals, card transactions, but the majority, the Ombudsman found, were internet banking payments. Large sums were taken from the Claimant’s account on a near daily basis. By March 2011 the balance in the Claimant’s savings account was 81 pence and over a three-month period the vast majority of the rest of the Claimant’s inheritance had been stolen by Mr Saeed and Ms Jan. As the Ombudsman found, that would have required access to the Claimant’s PIN and card.

A matter that was of significance for the Ombudsman’s decision, was that much of the fraud was perpetrated while the Claimant was outside the UK. Shortly after the fraud began, the Claimant travelled with Mr Saeed to Thailand on 30 December 2010. After a month in Pakistan in January-February 2011, the Claimant returned to Thailand where he remained for the next four years. As the Trial Judge noted in the subsequent criminal trial of Mr Saeed and Ms Jan, the Claimant “was a man who was completely disorganised about money”. He “led a chaotic lifestyle due to his drug addiction to Class A substances” and the Claimant was not aware that the fraud had been perpetrated while he was living abroad. In fact, he was not aware that the level of funds in his account had depleted until he returned to the UK in 2015. In part this was because he apparently never checked his account, but also because the fraudsters, over the years, deliberately added small amounts of money to the account. That ensured the account, as the Claimant withdrew money to live on, would not become overdrawn which would have led to the Claimant realising his inheritance had been stolen. The Claimant discovered the fraud only after returning to England on 7 March 2015 when he found his bank account had been effectively emptied.

The Claimant reported the matter to the police, and Mr Saeed and Ms Jan were arrested. In March 2018, following a two-week trial, they were convicted for the theft of the Claimant’s inheritance. The details of the trial and the Claimant’s submissions about it are set out below. It resulted, on 19 April 2018, in Mr Saeed being sentenced to 4 years in custody. In sentencing Mr Saeed, the judge described the Claimant as “vulnerable to exploitation” and Mr Saeed’s conduct as a “blatant breach of the trust [the Claimant] had placed in [him] as a long-term friend”, and he noted that Mr Saeed had “behaved in a thoroughly dishonest and manipulative way”. In recognition of Ms Jan’s serious, but lesser, role in the fraud, as well as mitigating factors, she was sentenced to 2 years suspended for 18 months.

Following the discovery of the fraud, the Claimant complained to Barclays and sought the refunding of what he claimed were unauthorised payments from his account procured by the fraudsters. He also contended that Barclays should have detected that many of the payments were suspicious and stopped the fraud. Barclays investigated the matter and concluded that, insofar as the relevant transactions were not authorised, they arose because the Claimant had failed to take reasonable steps to keep his card and PIN safe. As to the failure to detect the fraud in 2019, as part of their investigation, Barclays produced a “Money Management Form” (“MMF”) in the Claimant’s name which it was said he had signed in 2010. On the form Mr Saeed’s mobile was provided as the Claimant’s contact number. As a consequence, when Barclays raised concerns about a number of the transactions that formed part of the fraud, they called Mr Saeed’s number, and, it appears, he answered and assured the bank that the transactions were legitimate. On the basis of the MMF, Barclays concluded that it had reasonably relied upon the contact number provided and had taken reasonable steps to prevent the fraud.

Following Barclays’ refusal to reimburse the Claimant the money that had been stolen, he complained to the FOS. He made complaints in March 2015, June 2017, October 2019 and March 2020. The final of these complaints was investigated by a FOS investigator, followed by a provisional decision by an ombudsman on 30 July 2020 and a final decision of 18 February 2021. The ombudsman rejected the Claimant’s complaint (the “First Decision”). He concluded that the Claimant had “handed control of his account to Mr Saeed”. The Claimant contended that that conclusion was based on an inaccurate record of the Judge’s sentencing remarks at Mr Saeed’s trial, and asked that the FOS reopen the complaint and re-take the decision. That was refused and the Claimant brought judicial review proceedings. By a decision of 17 February 2023, Margaret Obi, sitting as a Deputy High Court Judge, allowed the Claimant’s judicial review and quashed the First Decision (see R (Moniak) v FOS [2023] EWHC 333 (Admin)). She remitted the case to the FOS for the decision to be retaken.

The Claimant’s complaint was reconsidered by a different ombudsman uninvolved in the First Decision. He produced two provisional decisions, of 6 November 2023 and 28 March 2024, on which the Claimant and Barclays were invited to comment, and a final decision on 28 October 2024. It is that decision of the Ombudsman which the Claimant seeks to challenge in these proceedings.

The Ombudsman began his decision by summarising his conclusion. He found that most of the payments made to the fraudsters were unauthorised. He concluded, however, that (but for a cheque payment of £20,000 which the Claimant did not authorise and a sum of £3,901 which related to “distance contracts”) Barclays were not required to reimburse the Claimant for the unauthorised payments. That was because, the Ombudsman found, it was “more likely than not based on the evidence which is available [that the Claimant] gave access to his debit card and disclosed his PIN to one of the fraudsters” and had therefore failed, “with intent to keep his personal security information secure”. Alternatively, the Ombudsman found that the Claimant was “grossly negligent” in terms of securing his card and PIN. As to whether Barclays should have prevented the fraud, the Ombudsman, referring to the MMF, found that the form “included a contact phone number belonging to the fraudster, [it] was not a forgery, and was completed by [the Claimant].” He found “Barclays acted reasonably when it contacted the number it had been given to confirm some of the transactions were genuine.” In those circumstances the Ombudsman concluded that he was not “persuaded Barclays ought reasonably to have uncovered the fraud.”

The Ombudsman then set out “what happened”. That included when and where transactions were carried out using the Claimant’s card. As noted above, the Claimant travelled to Thailand with Mr Saeed on 30 December 2010. They then travelled together to Pakistan on 13 January 2011 and back to Thailand on 13 February 2011 where the Claimant remained until 2015. The card was used wherever the Claimant was located. That is save for two periods. As the Ombudsman noted, the Claimant’s bank card was locked on 20 January 2011 when the Claimant was in Pakistan. The evidence suggested that Mr Saeed, who was with the Claimant in Pakistan at the time, travelled to the UK at the end of January 2010 and unlocked the PIN at a cash machine on or around 26 January 2010. The card was then used in the UK in the following days. Mr Saeed then travelled back to Pakistan and the card was used there from 2 February 2011. On 13 February 2011, after the Claimant and Mr Saeed travelled from Pakistan back to Thailand, the Ombudsman noted that transactions in Thailand using the Claimant’s bank card began again on 15 February 2011. Between 21 February 2011 and 21 March 2011 the card was again used in the UK. During this time the Claimant was in Thailand, and the Ombudsman concluded that the card was again taken by Mr Saeed to the UK and used there between 21 February and 21 March 2011. From 22 March 2011 transactions began again in Thailand. The relevance the Ombudsman attached to the location of the card use is set out below.

Following a summary of events since the fraud and a summary of his provisional decisions, the Ombudsman set out the applicable legal framework. That included the relevant parts of the PSR 2009, and Barclays’ Terms and Conditions for the use of payment instruments. The Ombudsman set out the meaning of “intent” and “gross negligence” in terms not disputed by the Claimant. The Ombudsman also directed himself, again correctly the Claimant accepts, that for the purpose of the PSR 2009 “the payment service provider must provide sufficient evidence to prove that the customer is guilty of gross negligence or intentional breach and that theburden of proof lies on the payment service provider.”

The Claimant’s account was that he did not provide his card or PIN to the fraudsters, and, as set out below, he gave evidence to similar effect at the fraudsters’ trial. The Ombudsman noted, however, the relevant transactions happened over 4 years before the Claimant reported the matter to Barclays, and by the time of the Ombudsman’s decision 13 years had passed since the fraud. The Ombudsman noted that prior to his return to the UK in 2015, but after the fraud, the Claimant experienced a violent trauma involving a head injury that meant he now suffers from a mental health condition that, as the Claimant acknowledged, affected his ability to recall events. In addition, as the Ombudsman noted, and as the Trial Judge at the fraudsters’ trial confirmed, the Claimant was at the material time “a heavy drug user.” The Ombudsman continued:

In these circumstances, I am mindful that there will naturally be limitations to [the Claimant’s] recollection of events. That isn’t to say that I have disregarded his recollections, but rather, where they conflict with other contemporaneous evidence, I’ve found the latter more persuasive. Generally, I have considered what I think is more likely than not to have happened, on the balance of probabilities, taking into account all of the evidence that is available to me. To be clear, I am also not suggesting that [the Claimant] is being untruthful or dishonest in any way or seeking to mislead me. I appreciate that he may have answered the questions to the best of his knowledge and ability.

The Ombudsman went on to set out one example of the limits of the Claimant’s recollection. In correspondence with the Ombudsman the Claimant noted that he was “informed by a friend” that he had retuned to the UK in January or February 2011, but that the Claimant “had no recollection of this himself.” As the Ombudsman noted, other evidence, including copies of the Claimant’s passport, confirm that the Claimant did not return to the UK at that time or indeed at all between December 2010 and March 2015. As the Ombudsman noted “the fact that [the Claimant] himself cannot recall one way or the other whether he did return to the UK [in early 2011] is an example of the limitations of his own recollection of events”. That is of particular relevance as it was what occurred in January/February 2011 that were critical to the Ombudsman’s decision.

In the following section of his decision the Ombudsman asked how the fraudsters were able to transact on the Claimant’s account. He noted that the money in question was taken in the following ways: removed as a cash withdrawal in branch; taken as an internet banking payment; payments processed using the physical card or physical card and PIN; payments using the card details; transfers carried out in branch, and cheque payments. The Ombudsman went through the transactions that fell within those six headings.

The Ombudsman’s key finding related to internet banking payments, which constituted the significant majority of the fraudulent transactions. I will therefore begin with the Ombudsman’s findings on that issue.

The Ombudsman concluded that the internet banking payments were not authorised. It was clear that the Claimant had not authorised the fraudsters to misappropriate his inheritance to use for their benefit as they had done. That was not, however, the end of the matter given the provision of PSR 2009 regulation 62. The Ombudsman noted that the relevant transactions would have required access to the Claimant’s card and PIN, and the Ombudsman went on to consider how they might have been obtained, in particular, by Mr Saeed. He noted that one possibility was that “[the Claimant] disclosed his PIN to Mr Saeed and provided him with access to [his] card.” The other possibilities were that Mr Saeed obtained the card and PIN by stealth (by himself receiving or intercepting the card, surreptitiously observing the Claimant entering his PIN, or finding out where the PIN was recorded, and then taking the card whenever he needed it and replacing it without the Claimant noticing). As well as the possibility that the card was cloned by the fraudsters, discussed below, it is not disputed that the Ombudsman had identified the most likely ways Mr Saeed could have accessed the card and PIN.

The Ombudsman went through the various possibilities, and set out why he considered it most plausible that the Claimant disclosed his PIN to Mr Saeed and provided him with access to his card. The key basis for that finding was the evidence suggesting that the card was in the UK for a short period in late January/early February 2011 when the Claimant was in Pakistan, and then for around a month in February-March 2011 when the Claimant was in Thailand. As set out above, it was clear that the card was being used by Mr Saeed in the UK during that period, and not by the Claimant in Pakistan and Thailand.

The Ombudsman considered the possibility that the card had been cloned and that the Claimant retained the card in Pakistan / Thailand while a copy was being used in the UK. He rejected that possibility. As he noted, the transaction record suggested there were no occasions on which a card was used in the UK and abroad simultaneously. That would be very unlikely if there were two or more cards in circulation. If there was a cloned card in existence one would have expected that, over the period of more than a month when the cloned card was being used in the UK, the Claimant would have used the original card at some point for a payment or cash withdrawal in Pakistan or Thailand. There were, however, no such transactions and the card was only ever used in one country at a time, indicating, the Ombudsman concluded, that there was no cloned card.

If the card was not cloned, it must have been taken by Mr Saeed. The question was whether that was with the Claimant’s knowledge and consent or following gross negligence, or in some other way. The Ombudsman stated “[g]iven that, as far as I’m aware, [the Claimant’s] only means of support during this period appears to have been his Barclays debit card, it is, in my view, very unlikely that he would not notice the absence of the card for [the two periods in which the card was in the UK].” In particular, the Ombudsman referred to the period of one month when, on his finding, the Claimant’s card was in the UK being used by Mr Saeed and the Claimant was in Thailand without the card. As the Ombudsman noted, the card was not reported stolen, and he concluded “on balance, I consider it is more likely than not that [the Claimant] knew that the card was out of his possession and, given that he did not report it missing, it is likely it was out of his possession with his knowledge. And, given that the card would have been largely unusable without the PIN, which was required to unlock the offlinePIN, it also seems likely that [the Claimant] gave the PIN to [Mr Saeed].” The Ombudsman also noted that there were a very large number of transactions carried out, often on a daily basis, when the Claimant was with Mr Saeed. Those transactions required access to the card and the Ombudsman concluded: “[i]t would be highly implausible for Mr Saeed to have taken and returned the card on so many occasions without [the Claimant] knowing, such that the activity cannot be simply explained by ordinary carelessness on [the Claimant’s] part. Instead it suggests that [the Claimant’s] knew the card was in [Mr Saeed’s] possession during these periods”.

The Ombudsman continued “[e]ven if I’m wrong about [the Claimant] intentionally providing the card and PIN to [Mr Saeed], the frequency of [Mr Saeed’s] access to the card indicates more than just an ordinary level of carelessness on [the Claimant’s] part, and points to a reckless disregard of the risks of failingto keep his card and PIN details secure”. The Ombudsmen went on to explain why it was not inconsistent with the Claimant being the victim of fraud, and the conviction of Mr Saeed and Ms Jan, that he was grossly negligent or had intentionally provided his card and PIN. He noted that “given [the Claimant’s lifestyle] at the time … he may have simply allowed [Mr Saeed] access to the card on the basis that he trusted him and it was convenient to do so”. That did not mean the Claimant was authorising Mr Saeed and Ms Jan to appropriate his inheritance in the way they did, but it meant, the Ombudsman concluded, that “[the Claimant] failed with intent and/or gross negligence to comply with Reg 57 PSR 2009 and the terms and conditions of his account.”

In relation to the other categories of transaction:

Finally, the Ombudsman considered whether Barclays should have prevented the fraudulent transactions taking place.

As the Ombudsman noted “Barclays [stated] that it did intervene several times, seemingly to ensure that the payments were being authorised by their account holder. It did this in relation to online banking and (attempted) telephone banking payments.” Barclays attempted to intervene, the Ombudsman concluded, by phoning the number on the Claimant’s MMF. The number on the MMF, however, was that of Mr Saeed who, the Ombudsman assumed would have assured the bank’s staff that the transactions were authorised and legitimate.

The Claimant suggested that Mr Saeed had “fraudulently added [his] mobile number to his account by way of the [MMF]”. The Ombudsman continued “[i]f [the Claimant] is right, it would follow that Barclays had acted on a fraudulent instruction when it added the mobile number to [the Claimant’s] account and a fair and reasonable outcome would be that it shouldn’t be able to rely on its attempts to verify the payments to defend its position.” The Ombudsman stated “[t]he question for me to consider is whether Barclays acted reasonably in contacting the telephone number it had on file. Ultimately that depends on whether it was reasonable for Barclays to rely on any instruction it received to add the mobile number to [the Claimant’s] account.”

The MMF was also referred to as an “MMA” or “Money Management Application”. On analysing the MMF, the Ombudsman described it as an “application form for a new account.” Given information provided by Barclays, the Ombudsman concluded that it would have been “pre-populated with the information [the bank] had on file for the customer” and that “if additional information was provided by the customer, branch staff would then check the details with the customer before confirming they were correct and generating a printout”. The Ombudsman noted that the first page of the document had been printed out in April 2010 and he concluded that was most likely when it was signed apparently by the Claimant.

The Claimant submitted to the Ombudsman the MMF, and his signature on it, were forged. He suggested that what, most likely, occurred was that Mr Saeed, as part of the planned perpetration of the fraud, had his mobile number added to the Claimant’s account in April 2010 and forged his signature. The Claimant stated that the form contained errors (such as omitting his date of birth and misspelling his mother’s maiden name) which meant it could not have been completed by him.

The Ombudsman considered whether it was likely that the document was forged or fabricated by Mr Saeed. He concluded that, on balance, it was genuine. He noted that the document was very similar to other Barclays documents and that “the suggestion that a fraudster would try to change the phone number associated with [the Claimant’s] account by creating a form of their own (rather than using a pre-existing one) and manage to persuade Barclays to upload that document to its systems is very unlikely, in my view.” The Ombudsman therefore concluded that the MMF was genuine, and on examining it, that it was most likely completed on 30 April 2010 and scanned onto Barclays’ system a few days later.

The Ombudsman then went on to consider how Mr Saeed’s telephone number came to be introduced to the MMF. He noted that the evidence suggested that a new card and PIN were ordered around the time the form was completed, and, following a detailed analysis of activity on the Claimant’s account, concluded that was most likely done by someone in branch at the same time as the MMF was completed. The Ombudsman considered whether it could have been Mr Saeed visiting the branch who had persuaded Barclays staff to insert his number into the form. The Ombudsman concluded that was unlikely. It would have required Mr Saeed to show identification and impersonate the Claimant. The Ombudsman noted that all of the other in-branch transactions made by Mr Saeed were using the card and PIN rather than in-person transactions, and he considered it was unlikely that Mr Saeed would risk being caught impersonating the Claimant in such a way.

The Ombudsman then considered evidence which suggested it may have been the Claimant that had introduced the number. The Ombudsman noted that the signature on the form appeared to be a close match to the Claimant’s. The Ombudsman considered whether it was plausible that the Claimant would have signed the form when it contained errors. He stated “I can see that the Judge [at the criminal trial] commented on [the Claimant’s] chaotic lifestyle and poor management of his personal finances at the time. This suggests that [he] may not have been someone who was particularly focussed on this kind of detail or would be particularly inclined to ask the bank to correct what was essentially an irrelevant mistake, at the relevant time if he had noticed it.” As to why the Claimant would have recorded Mr Saeed’s number on the form, the Ombudsman noted that “by April 2010 [the Claimant] already intended to sell the property he resided in – an event that would leave him uncontactable on his landline number. While it’s unclear whether [the Claimant and Mr Saeed] had already planned to leave the country by April 2010, I think it might have reasonably occurred to him that it would be important to remain contactable by the bank in that event.” He noted that the Claimant had said that he had a different mobile number, but that the Claimant’s sister had indicated during the criminal trial that she had used Mr Saeed’s number to try to contact the Claimant when she thought he had gone missing in January 2011. She stated that was the “only contact she had” for the Claimant. If the Claimant had provided Mr Saeed’s number to his sister, as his only contact number, it would be consistent, the Ombudsman concluded, for him also to have provided the number to the bank.

In light of the evidence, the Ombudsman concluded that it was more likely than not that it was the Claimant who had added Mr Saeed’s mobile number to his account as a contact number. On that basis he concluded: “Barclays was entitled to call the [number on the MMF] and accept the information and assurance that was provided that the transactions were authorised by [the Claimant]. I’m not persuaded that any other reasonable course of action it should have taken would have brought the matter to light.”

The Ombudsman then set out his conclusions on the complaint as follows:

For the avoidance of doubt, I do not dispute that [the Claimant] has been the victim of a serious crime and has lost a huge sum of money as a result. I’m sympathetic to his position and it’s clear he’s been through some very traumatic experiences since the disputed transactions took place.

However, my role is to decide whether his bank should reimburse some, or all, of his losses. As I’ve explained, in order for [the Claimant] to be reimbursed, it isn’t sufficient to show that he was the victim of a crime or that he didn’t authorise the transactions in dispute himself. The relevant regulations in place at the time also places obligations on him as a payment service user and sets out specific circumstances where his bank should not reimburse losses.

In the Judge’s summing up of evidence during the [Mr Saeed and Mr Jan’s trial], he noted that the prosecution was unable to point to the ‘exact mechanisms’ by which [the Claimant’s] bank accounts were accessed and those exact mechanisms will never be known to me either. I’ve accepted that I do not, and will not, have a full picture of what happened during the relevant time. To be clear, I accept and have proceeded on the basis that the fraud took place, and [the Claimant] was defrauded. That is a matter that has already been concluded by the Trial and I am not revisiting it here. Instead, I have considered whether Barclays ought to be held responsible for some or all of [the Claimant’s] losses. In considering this complaint about Barclays, I have had to make findings about the likely methods by which Mr Saeed gained access to [the Claimant’s] account, whether [the Claimant’s] actions contravened the PSR 2009 and whether [the Claimant’s] actions breached the terms and conditions of his account. The majority of the findings I have made in this decision have had to be made on the balance of probabilities and in the context of missing evidence and unreliable testimony. But the weight of evidence that is available to me suggests that it is more likely than not that it was [the Claimant’s] intentional/grossly negligent actions that allowed, at least in relation to some of the payments, Mr Saeed to gain access to his account, and enabled the fraud to be perpetrated and continue for the length of time that it did. I do not dispute the Judge’s sentencing remarks that [the Claimant] was vulnerable to exploitation and that Mr Saeed certainly appears to have been devious and manipulative. Nevertheless, for the reasons I’ve explained above, that means that I’ve decided that it would only be fair and reasonable for Barclays to refund the [cheque payment of £20,000 and the £3901.52 distance contracts but not the rest of the money that was stolen].

In his pleaded case, the Claimant put forward two grounds of challenge: that the Ombudsman’s “core reasoning” was “irrational” and that there was “insufficient evidence” / no “proper basis” for inferring that the Claimant had acted with intent or gross negligence in relation to his card and PIN. As the case was set out in the Claimant’s skeleton argument, and before me orally by Mr MacDonald, however, the claim was put as one generally of irrationality, with the target being the two factual findings made by the Ombudsman. The first target was the Ombudsman’s finding that the Claimant intentionally gave access to his card and disclosed his PIN to Mr Saeed, or was grossly negligent in not keeping his card and PIN secure. The second impugned finding is that it was the Claimant who had added Mr Saeed’s mobile number to the MMF in April 2010. Both those findings are said to be irrational. I will consider the Claimant’s challenge to each of the factual findings in turn.

The starting point is that, although at various times in his written and oral submissions Mr MacDonald suggested that the Ombudsman had “asked [himself] the wrong question” and “lost sight” of the “balance of probabilities … test”, that was not the basis on which the challenge was brought. In any event, it is clear that the Ombudsman did direct himself correctly on the relevant issues he needed to resolve and the applicable legal test. The Ombudsman also correctly directed himself that the burden was on Barclays to establish intent or gross negligence and that it needed to be discharged on the balance of probabilities. There is also no suggestion that the Ombudsman erred in his understanding of the meaning of “intent” and “gross negligence” (save for the issue of the APP guidance which I dealt with above at paragraphs 16-17). The question, therefore, is whether the Ombudsman’s conclusion that Barclays had discharged the applicable burden of proof on the relevant factual questions was irrational.

Mr MacDonald presented the Claimant’s case as one of “process irrationality”. He submitted that there was “no evidence” supporting the Ombudsman’s findings. Alternatively, he submitted, that the evidence before the Ombudsman was “entirely equivocal”, and therefore it was irrational to conclude that Barclays had discharged the burden of proof. It is correct to say, as set out above at paragraph 23, that if the Ombudsman had found “no evidence” that the Claimant had intentionally provided his card and PIN to Mr Saeed, but nonetheless concluded that had occurred, it would be “process irrationality”. There would be an error of logic, or “leap in reasoning” or “unexplained evidential gap” for a decision-maker to identify no evidence that X happened, but nonetheless conclude that it had. Similarly, if the Ombudsman had found that the evidence as to whether or not the Claimant had given access to his card and PIN to Mr Saeed was “entirely equivocal” (i.e. it pointed equally to the Claimant having done so and as not having done so), but the Ombudsman nonetheless concluded, on the balance of probability, that the Claimant had given access to his card and PIN, that too would be “process irrationality.” It is a logical error or unexplained “leap in reasoning” to find that the evidence points towards it being equally likely that X or Y occurred, and then to conclude that X occurred.

There was, however, no logical error or error of reasoning in how the Ombudsman reached his decision. He did not conclude that the Claimant gave access to his card and PIN to Mr Saeed, despite identifying no evidence that supported the conclusion. As set out further below, and in detail in the Ombudsman’s decision, the Ombudsman’s conclusion was based on a careful analysis of the Claimant’s bank statements and the activity it showed on his account. The Claimant may consider that is insufficient evidence to justify the conclusion that the Ombudsman reached, but there is no logical error or error in reasoning in drawing inferences from bank records as the Ombudsman did.

Similarly, the Ombudsman considered the ways in which Mr Saeed might have obtained the Claimant’s card and PIN without the Claimant providing access to them or being grossly negligent (e.g. that the card was cloned, the PIN was intercepted by Mr Saeed and then he surreptitiously removed the card when he needed it etc.). He concluded that they were all less likely than that the Claimant himself providing access or was grossly negligent, and that, on the balance of probability, it was the Claimant’s intentional/grossly negligent actions that explain how the fraudsters accessed the card and PIN. Again, there was no logical error or error of reasoning. It is perfectly logical for a decision-maker to say that event X (Mr Saeed accessing the Claimant’s card and PIN) must have occurred in ways A, B or C, and that given evidence X, Y and Z (when and where the card was used, the frequency of its use etc), on the balance of probabilities, it occurred in way A. Again, the Claimant may consider that the Ombudsman should have concluded the evidence before him was “entirely equivocal” (or indeed positively pointed towards another explanation for Mr Saeed gaining access to the Claimant’s card and PIN as being more likely), and that the conclusion that the Ombudsman reached was therefore not open to him. That is not, however, a logical error or error in reasoning. It is a challenge to the Ombudsman’s assessment of the evidence before him and is one of “outcome rationality”.

In his submissions, orally and in writing, Mr MacDonald went in detail through the evidence that was before the Ombudsman. He sought to explain why the Ombudsman should have concluded there was insufficient evidence that the Claimant had granted access to his account and provided his PIN to Mr Saeed intentionally, or was grossly negligent, or that, at most, the evidence was “equivocal” so that it was irrational for the Ombudsman to conclude Barclays had discharged the burden of proof. To succeed the Claimant would need to show that the only reasonable decision open to the Ombudsman, given the evidence before him, was that it did not establish intent or gross negligence. I have considered whether such irrationality has been established, and despite Mr MacDonald’s careful and thorough submissions, I do not consider that it has.

The Ombudsman’s decision was clearly structured and admirably clear. He reasoned in summary as follows:

On the basis of the above, the Ombudsman concluded that it was more likely than not that the card and PIN were provided by the Claimant to Mr Saeed or he was grossly negligent. He considered that to be more likely than that Mr Saeed had been able to obtain the PIN, and use the card with such frequency, without the Claimant being aware or his being grossly negligent. It may be that another ombudsman would have assessed the evidence differently and reached a different conclusion. That does not mean, however, it was not open to this Ombudsman to reach the conclusion he did. Another ombudsman might have concluded that the other explanations for how Mr Saeed obtained access to the Claimant’s card and PIN were, as Mr MacDonald submitted, equally plausible, and that the evidence was “entirely equivocal”. The Ombudsman did not. Again, that does not mean his decision was irrational, and in my view his conclusions fell within the range of reasonable decisions open to him.

Mr MacDonald also deployed a number of further arguments which, he contended, suggested the Ombudsman’s finding was irrational. I do not consider, separately or cumulatively, that they do so.

First, Mr MacDonald submitted that the Ombudsman’s conclusion was inconsistent with Mr Saeed and Ms Jan’s criminal conviction.

The Ombudsman addressed the criminal trial in his decision. He noted that the fact that Mr Saeed and Ms Jan were convicted was not inconsistent with the Claimant allowing access to his card and PIN to make cash withdrawals or purchases when that was “convenient to do so”. The Claimant had not thereby consented to or authorised the fraudsters effectively cleaning out his account and stealing his inheritance. The conviction, in and of itself, was not therefore inconsistent with the Ombudsman’s conclusion.

Mr MacDonald accepted, in principle, that it would be possible for someone to be given access to a person’s card and PIN, but nonetheless be found guilty of stealing from their account. He submitted, however, that given the Trial Judge’s summing up, the jury must have concluded that the Claimant had not given Mr Saeed his card and PIN. Mr MacDonald noted that one of the issues that arose in the criminal trial was the taking of the Claimant’s bank card to the UK in January 2011 to unlock the PIN. The Trial Judge directed the jury that Mr Saeed’s case was that the “card was taken to London by [him]”. The Claimant’s evidence was that “he retained possession of the card”, and it was noted that “the prosecution suggested in cross-examination that there may have been [a] duplicated cloned cards which was thereafter used”. The Judge directed the jury that “this is a factual issue for you to resolve”. Later in his summing up the Judge noted that one issue the jury should consider was “the financial security implications that have been raised in this trial” and reminded the jury that when cross-examined the Claimant stated that “he did not give out his PIN number or his security details to anyone and was very careful with the details of his account.” It was put to the Claimant during the trial that his card had become blocked when he was in Pakistan and that Mr Saeed had returned with it to the UK to unlock it. The Claimant said: “I had no idea he was going back to the UK or with my card”. Given that Mr Saeed was convicted, Mr MacDonald submitted, the jury must have accepted the Claimant’s evidence. It must have concluded the Claimant did not allow Mr Saeed access to his card and PIN, that he retained his card and was very careful with the details of his account. It was, Mr MacDonald argued, therefore irrational for the Ombudsman to conclude otherwise.

Mr Strachan submitted that Mr Saeed and Ms Jan’s conviction was not inconsistent with the Ombudsman’s conclusion. He noted that the jury were not directed that if they concluded that the Claimant had allowed access to his card and PIN that they must acquit Mr Saeed or Ms Jan. Mr Strachan noted that the jury were told that they were the “judges of facts” and that “you do not need to decide every point that has been raised, only those points that will enable you to say whether the charge laid against reach defendant … has been proven.” The issue before the jury was whether Mr Saeed and Ms Jan were guilty of theft, which meant showing that they had dishonestly appropriated the Claimant’s money with the intention of permanently depriving him of it. As the Trial Judge directed the jury, Mr Saeed’s defence was that “everything he did with [the Claimant’s] money was done with [his] knowledge and consent and in connection with an investment [the Claimant] wanted to make.” Ms Jan’s defence was similar. She claimed all the money she received was provided with the Claimant’s knowledge and was to pay debts he owed her. Mr Strachan submitted that Mr Saeed and Ms Jan’s conviction shows that the jury disbelieved those defences. Beyond that, he submitted, it is not possible to know what the jury did and did not conclude.

As Mr Strachan also noted, the Judge told the jury that “the prosecution … cannot point to the exact mechanisms by which [the Claimant’s] bank accounts were accessed but they say that as a matter of inference that his personal details were known to at least one of the defendants who had lived with him.” Mr Strachan submitted that it cannot be inferred from the jury’s verdict that it determined the Claimant had not given access to his card and PIN to Mr Saeed, let alone that it determined the Claimant was not grossly negligent in relation to the security on his account. Mr Strachan submitted that the Ombudsman considered the Trial Judge’s summing up and sentencing remarks, and that it was not irrational for him to conclude that Mr Saeed and Ms Jan’s conviction and sentence did not establish that the Claimant had not intentionally allowed access to his card and PIN or was grossly negligent, and that the outcome of the criminal trial was therefore not inconsistent with his decision.

I consider that Mr Strachan’s submissions are correct. The jury’s guilty verdict establishes that they rejected Mr Saeed and Ms Jan’s case that the Claimant knew of and consented to the transactions on his account. That was reflected in the Ombudsman’s decisions that the payments made on the Claimant’s account were “not authorised”. Unlike the Ombudsman, however, the jury did not need to decide precisely how the Claimant’s account was accessed and whether or not he had allowed access to his card and PIN or been grossly negligent. I do not consider it was irrational for the Ombudsman to conclude that, notwithstanding the jury verdict and the Claimant’s recollection at the trial seven years after the fraud was perpetrated, given the other evidence the Ombudsman considered, the Claimant, in fact, had given Mr Saeed his card and told him his PIN so he could use the card where that was convenient. That included potentially taking the card to the UK to unlock the PIN. It was not irrational, in my view, for the Ombudsman not to accept that the Claimant’s evidence at trial that he retained access to his card and was “very careful with the details of his account” was an accurate recollection given the other evidence the Ombudsman considered.

None of this meant the Claimant had authorised his inheritance to be appropriated by Mr Saeed and Ms Jan, and it is not possible to know how the jury resolved, if they resolved at all, how Mr Saeed was able to access the Claimant’s card and PIN and whether the Claimant had granted access to them or had been grossly negligent. Once the jury had decided that significant sums were taken from the Claimant by Mr Saeed and Mr Jan without his consent, and not for agreed investments or return of loans as they claimed, the jury were able to convict irrespective of how Mr Saeed gained access to the card and PIN.

Ultimately, the weight to be attached to Mr Saeed and Ms Jan’s conviction, and the Trial Judge’s summing up and sentencing remarks, was a matter for the Ombudsman. That is so, in particular, where there were matters that the jury did not consider, and did not need to consider. For example, while the jury considered the short period in late January 2011 where the Claimant’s card was taken back from Pakistan to the UK to unlock its PIN, it did not consider the period in February-March 2011 when the Claimant was in Thailand and the Ombudsman found the card was in the UK for a month. That was regarded as particularly significant by the Ombudsman as he concluded that it was implausible that the Claimant would have been without his card for a month without noticing or reporting it, and was, most likely, aware it had been taken by Mr Saeed. That was not apparently regarded as relevant in the criminal trial as there was no reference to it in the Judge’s summing up. Again, another ombudsman might have given a different weight to the conviction of Mr Saeed and Ms Jan in light of the Judge’s summing up. I do not, however, consider it irrational for the Ombudsman, having considered the conviction, the Judge’s summing up and sentencing remarks at the criminal trial, and weighed them with the other evidence before him, to come to the factual conclusions he reached.

Second, Mr MacDonald submitted that Barclays had not put forward “direct evidence” showing that the Claimant had handed over his card and PIN to the fraudsters, and he noted gaps in Barclays’ records. I do not consider that establishes that the Ombudsman’s decision was irrational.

The Ombudsman noted that Barclays’ records were “limited and incomplete”, but that that was in large part because of the passage of time that had elapsed from 2010/2011 and the delay in the matter being reported by the Claimant to the Bank. That meant there was “little prospect” of staff recalling what had happened and that “inevitably some paperwork may not have been retained in line with normal data retention policies”. I did not understand Mr MacDonald to be submitting that Barclays was deliberately withholding information, and that adverse inferences should therefore have been drawn against it. Instead, Mr MacDonald submitted that the gaps in the evidence that Barclays was able to put forward meant that it “follows … that there was no evidence supporting the [Ombudsman’s] finding, and the evidence there was, both from [the Claimant] and from the criminal trial went against it.”

I do not accept that submission. There clearly was evidence supporting the Ombudsman’s findings, in particular the bank records from which he drew the inferences he did. The Ombudsman was aware that it was Barclays that bore the burden of proof, and noted, specifically in relation to the “inevitable and unavoidable” gaps in the evidence, that Barclays, nevertheless, had to provide “sufficient evidence to prove [the Claimant] was guilty of gross negligence or intentional breach and that the burden of proof lies on the payment service provider.” As set out above, the Ombudsman was also aware of the Claimant’s denial that he had given Mr Saeed access to his card and PIN and his claim that he had been very careful with his security, as well as the details of the criminal trial. The Ombudsman concluded, however, from a detailed analysis of the transactions on the Claimant’s account, that, on the balance of probabilities, Barclays had established that the Claimant had intentionally provided Mr Saeed with his bank card and PIN or had been grossly negligent. That is a decision based upon the evidence before him, and findings of fact I consider it open to the Ombudsman to have reached. That is so notwithstanding the gaps in the evidence Barclays was able to produce.

Finally, Mr MacDonald sought to challenge the inferences the Ombudsman drew from the transactions on the Claimant’s account at the material time. He argued that it was, in fact, “entirely plausible” that Mr Saeed had found out the Claimant’s PIN other than by the Claimant providing it to him (or the Claimant being grossly negligent) and then managed to remove the card without the Claimant realising (again without the Claimant being grossly negligent). Another ombudsman may have concluded that that was the most likely explanation and drawn different inferences from the evidence. Again, however, I do not consider the factual findings the Ombudsman made and the inferences he drew to be outside the reasonable range of decisions open to him. The challenge to this aspect of the Ombudsman’s decision therefore does not succeed.

The Claimant challenges the Ombudsman’s finding that, on the balance of probabilities, the MMF was a genuine document and that it was the Claimant who had added Mr Saeeed’s mobile to it as his contact number.

The Claimant’s argument was presented in a similar way to his argument about the finding that he had allowed access to his card and PIN to Mr Saeed, namely that the Claimant was bringing a challenge on the basis of “process irrationality”. Mr MacDonald submitted that there was “no evidence” to suggest the Claimant had added Mr Saeeed’s mobile to the MMF, or that the evidence in that regard was “entirely equivocal”. Again, I do not consider that the case is one that can properly be famed as one of process irrationality, or at least no such claim can be made out. There clearly was evidence before the Ombudsman from which he could logically draw the inference that it was more likely than not that the Claimant had added Mr Saeed’s mobile to the MMF. The Claimant may disagree with that conclusion but there is no error of reasoning or a logical mistake. There is nothing illogical and no gap in reasoning in outlining the various possibilities regarding the MMF (that it was not a genuine document, that Mr Saeed had managed to introduce his number to the form or that the Claimant had added the number himself), and then considering the available evidence, as the Ombudsman did, and concluding that the last possibility was the most likely and had probably occurred. It is simply that the Claimant does not consider that, based on the evidence before him, that was a conclusion reasonably open to the Ombudsman.

The Claimant’s challenge is, therefore, in reality, again one of outcome rationality. It is that, faced with the evidence that was before the Ombudsman, no reasonable decision-maker would have drawn the inference the Ombudsman did and concluded that the Claimant had introduced Mr Saeed’s number to the MMF, and that such a factual finding was outside the range of reasonable findings open to a decision-maker. Mr MacDonald made a number of arguments to that effect.

Mr MacDonald noted that the Claimant’s position was that he did not sign the form with Mr Saeed’s number on it. He also contended that the “provenance of the MMF is obscure and highly dubious”. He noted that the MMF was not produced at the time of the criminal trial and only emerged in 2019 when Barclays Bank investigated the matter, that no original of the MMF had been produced by Barclays, and that the MMF is an account opening document, but none was opened. The Ombudsman considered the MMF in some detail and concluded, notwithstanding those matters, that the document was genuine. I consider that to be a factual finding open to him. Furthermore, the alternative, as the Ombudsman noted, was “the suggestion that a fraudster would try to change the phone number associated with [the Claimant’s] account by creating a form of their own (rather than using a pre-existing one) and manage to persuade Barclays to upload that document to its systems.” The Ombudsman concluded that was “very unlikely”. That too was a conclusion open to him in my view.

The Ombudsman went on to consider how Mr Saeed’s telephone number came to be introduced to the form. As he noted, there were two possible explanations: that Mr Saeed had used the MMF to add his number to the Claimant’s account or was able to persuade someone at Barclays to add the number as part of the perpetration of the fraud, or that the Claimant had added the number and signed the form. The Ombudsman then went through the evidence to determine which was the more likely.

The Ombudsman noted that, while not being a handwriting expert, the signature on the MMF appeared to match the Claimant’s. He noted that evidence pointed towards the form being signed at the same time as a card and new PIN were ordered, and that that would have most likely occurred at a branch. He concluded that it was unlikely that Mr Saeed would have risked attempting to impersonate the Claimant in a branch in order to introduce his number to the MMF in April 2010. That was, in particular, given that this was a significant amount of time before the inheritance was paid to the Claimant and the fraud perpetrated. The Ombudsman also noted that by April 2010 the Claimant was intending to sell the property in which he lived and that that would leave him uncontactable on the landline number he had been using, so he needed to provide another contact. The Ombudsman further noted that when the Claimant’s sister had attempted to contact the Claimant in January 2011 the only number she had for him was Mr Saeed’s. If the Claimant’s sister was provided with Mr Saeed’s number as the Claimant’s only contact number, it was also plausible that the number was provided to Barclays by the Claimant.

The Ombudsman concluded:

While I accept that none of the above is direct evidence that [the Claimant] added the Mobile Number to his account, I think that the circumstances I’ve described, as well as the findings I’ve made about the [MMF] in general, lead to a finding that it is more likely than not that [the Claimant] added the Mobile Number to his account. To clarify, I do not suggest in any way that by adding the Mobile Number to his account, [the Claimant] consented to the significant fraud that took place.

Overall, for the detailed reasons I have provided, my conclusion is that it is more likely than not that the [MMF] was not a forged document, and that [the Claimant] signed the form which stated the Mobile Number was his own.

Mr MacDonald criticised the Ombudsman’s conclusion and argued that other inferences should have been drawn from the evidence. He submitted that the Ombudsman should have concluded that Barclays had failed to establish that the MMF was genuine, or, if it was, that it had failed to establish that the Claimant had signed it so as to provide Mr Saeed’s mobile as his contact number to Barclays. Again, it may be that another decision-maker would have reached a different conclusion. The Ombudsman, however, carefully set out the evidence before him and explained why, on balance, it led him to reach the findings of fact that he did. There was no logical error or error in his reasoning, and I consider the Ombudsman’s findings to be within the range of reasonable decisions open to him and were not ones that no reasonable decision-maker could have made. The challenge to this aspect of the Ombudsman’s decision therefore also fails.

It is impossible not to feel sympathy for the Claimant, and the Ombudsman recognised at the end of his decision that he “has been the victim of a serious crime and has lost a huge sum of money as a result. I’m sympathetic to his position and it’s clear he’s been through some very traumatic experiences since the disputed transactions took place.” I echo those words.

The issue before me, however, is whether it was irrational for the Ombudsman to make the findings of fact he did. I consider it was not. It may be scant comfort to the Claimant, but all the points open to him were effectively and cogently put by Mr MacDonald. The Ombudsman’s decision letter was, however, commendably thorough, logical and clearly structured. He set out the evidence before him and explained why it led him to the conclusions he reached. There was no flaw in his logic or reasoning, and I consider the factual findings he made were open to him. The Claimant’s judicial review is therefore dismissed.