Our investigation

We reviewed records held by the cryptocurrency provider and the bank. The provider confirmed the account was set up in William’s name using his driver licence and email address. It also confirmed that it had undertaken identity checks, including either assessment of a selfie taken by William, or a check that William was there in real time.    

We examined the timing of the payment and related account activity. The bank’s CCTV footage showed William had his phone and driver licence with him at a branch an hour before the cryptocurrency provider sent an email about a completed bitcoin buy order. The order number appeared in William’s own message to the provider, but not in the earlier provider emails William had given to the bank and to us. The bank’s records showed only one failed login attempt, several days earlier. William continued to access his mobile banking after the payment and did not report the transaction until four days later. 

We concluded it was more likely than not that William had authorised the payment – and the bank did not therefore have to reimburse him. Even if we were wrong, and the payment was unauthorised, William had failed to take reasonable care to protect his banking credentials because he told us he had disclosed to Jacob his phone PIN, which was the same as his banking PIN.

In reviewing the bank’s communications with William, we found the bank met its obligation to communicate clearly and effectively. The staff member was entitled to ask questions at the start of the investigation, the bank considered whether there was any evidence of phishing, and it followed up when earlier emails had not been received.  

Outcome

William withdrew his complaint.