Suing a bank for professional negligence?

goldmine2011

Back in Oct 2024, thousands of £'s was sent out of my account to a random business/individual (that I clearly didn't know) using the Faster Payment System (FPS), pretty much the system we all use in the UK to send direct payments to other people by putting in the SC and ACC numbers.

This was reported to the bank, the day after I noticed it but the money had already left the account. We had no idea who this person was that it was sent to, the amounts were thousands at a time in multiple separate transactions and the account was drained empty. The bank was no help in finding out how it happened, they just said that the 'missing' money is reported to the fraud team and they will get back in touch.

We (me and husband) dug around my banking app as much as possible to look for anything suspicious and when we went into the "chat" feature in the app, there were loads of messages of this 'person/hacker' chatting to bank agents requesting to :

Remove the phone number off the account

Eventually having the phone number changed

Requesting a "speedy banking code" (OTP?)

Setting up a new Payee

Sending a payment

All the above, they managed to convince the bank's agents to do via this in-app chat feature, even though the setting up a new payee and sending a payment was told by previous agents that they are not allowed to do this via chat and that it needs to be done by them within the app.

But this 'person/hacker' kept saying that the app was crashing all the time and it wouldn't work etc so that they need to do it for them via chat, and after multiple attempts they managed to convince an agent do it for them.

That is how they manage to drain my bank account, and The bank after this incident did not offer ANY insight whatsoever, no advice other than to report to ActionFraud, no indication of HOW it was even possible that they did this, where the requests came from (IP addresses, device name), nothing at all to help us prevent it from happening in the future.

The money was back in my account within 10 days of reporting the fraud but they didn't say if it was retrieved from the hacker or if they just paid it out of their own pockets. They did not even respond to requests to open a complaint regarding this.

You can imagine now being hacked in this manner, someone clearly has some sort of access to my data? my devices/phone (digitally? physically?), is there someone physically watching? are ANY of my electronics safe or is something/everything compromised? Because the bank provided no answers at all that left us literally in the dark.

So we lived in a state of paranoia and anxiety, got rid of our physical phones and bought new ones, changed email addresses, had to change all login passwords, anti-malware + virus installed on every device etc we essentially got an entirely a new digital identity after this occurrence.

Fast forward to 6th Feb 2025 (last week) I log into my online banking and I see a standing order set up for £9.65 to a random company I have not heard of, immediately flag it up as fraudulent to the bank and they said its a 'pending' S/O and they will cancel it, go into the in-app chat feature and low and behold the exact same thing is happening, someone pretending to be me has been speaking to the banks agents via this chat functionality and requesting them to set up this standing order.

Their first few attempts, were told that they are not allowed to set up S/O's via chat, you have to do it yourself within the app itself, the scammer just said ok and moved on, closed the chat and opened up another fresh chat to speak to a different agent, ask the same question again and again until they finally managed to convince one agent to do it for them. which they eventually did.

There were multiple chats (20+) that they opened this time and through convincing the agents they managed to change the £9.65 amount to £9,650 by saying it was an initial mistake etc. This all happened from the 7th - 10 Feb.

So my main point of contention now is that I reported the initial fraud on the 6th, the bank specifically told me that they cancelled the S/O, that online banking was frozen, that they are cancelling any cards related and sending out a new one, I have to re-register to access the app, and that ANY & ALL registered devices are now wiped and that I need to uninstall their banking app off my phone until I get the new card (to re-register). This was all done on the 6th.

I got my card yesterday (12th) and as soon as I logged in all I could see was that £9,650 amount leaving my account and this 'person/hacker' had been speaking to the agents as per normal via the chat feature from the 7th-10th, having multiple chats freely and this is AFTER I was essentially told by the banks that no online access is possible from my account whatsoever.

I was on the phone to the bank literally all night last night, over 6 phone calls were made, half of the phone calls they hung up on me after me and my husband grilled them on how this was even possible, one phone call we were put on hold for 25 minutes and then hung up on. after the 3rd call that we got hung up on we got that annoyed we literally told them from the start that we are now recording these calls from our end, and that they need to state their name and the current date & time as we are now using this evidence to open a complaint. surprise, surprise no phone calls were hung up on after we made that statement.

from a 1-hour long call that we had (and fully recorded) that fraud-department agent specified that our device (he confirmed the model of our phone) was the only device registered on their system. That device was deactivated on the 6th and since then no other devices were registered on the system until the 12th, which is when we registered it last night. I asked him to confirm this verbally.

Then I tell him that I have physical evidence of someone using my in-app chat feature (posing as me), clearly speaking to agents and doing all this fraudulent activity on the 7th, 8th, 9th, 10th. And you guys have no record of another device being registered until the 12th? how is this even remotely possible? he was speechless. He could see the chats and had no explanation whatsoever.

There was alot of damning evidence within that 1 hour call which proves that this bank has a serious security flaw somewhere which is unrelated to our actual personal devices.

In the conversation where the hacker changed the amount from £9.65 to £9,650. The agent literally tells the hacker "This S/O was cancelled, would you like to re-instate it?" and obviously the hacker is going to say "yes" and the agent just did it. That was the exact S/O that we called up about on the 6th reporting it as fraudulent activity. I cannot believe the incompetence of some of these agents. I do not work in banking whatsoever but after fraudulent activity is reported is there no red flag that is shown on the system? we were told the account was literally closed off digitally, clearly not?

You obviously cant screenshot/record on banking apps so we used my husbands phone to video record all these chat windows and conversations that were had between the banks agents and the hacker via chat, and we have around 2 hours of recorded voice calls with the banks fraud team admitting they don't know how this has happened. But it clearly has happened.

My reasoning for suing them is literally all this undue stress and anxiety that me and my family have gone through for months, and resurfacing again as of last week because of this banks total incompetence in their systems and their staff. I've generally not even been able to sleep properly for months since it first happened in October.

I have no idea if I am allowed to put the banks name hence why I just put 'bank' but its not even a small one, its within the top 4 of our UK high street banks and its global.

On the basis of the above, is it legible that I have a case of some/any sort of negligence on their behalf? I have never sued anybody never mind a company before so any advice whatsoever would be much appreciated.

Thank you for reading up to this point, was a lotttttt longer than I intended it to be

DE_612183

Normally suing someone you need to prove financial loss - which if the bank put the money back you have no loss.

You can sue for emotional stress / anxiety - but again proving this is hard - have you been to a GP, been prescribed medicine or been officially categorised as having a mental disorder such as PTSD?

You may be better off changing banks and seeing if the the bank will provide some sort of ex-gratia payment for distress casued.

eskbanker

Starting point is to log a formal complaint with the bank, explaining what outcome you're seeking.

If they fail to resolve the matter to your satisfaction then you can escalate to the financial ombudsman service.

No point in even contemplating legal action until or unless you've gone through these steps....

la531983

DE_612183 

You can sue for emotional stress / anxiety

Small claims courts don't entertain this. Or "hurt feelings" . An actual tangible financial loss has to be demonstrated.

Voyager2002

I think you should INSIST on lodging a formal complaint. Perhaps ask some ridiculous amount of money as compensation for the stress, so that the bank will refuse and then the case goes to the Ombudsman service. At least then, an outside authority will look at the whole situation.

goldmine2011

eskbanker said:

Starting point is to log a formal complaint with the bank, explaining what outcome you're seeking.

If they fail to resolve the matter to your satisfaction then you can escalate to the financial ombudsman service.

No point in even contemplating legal action until or unless you've gone through these steps....

I have indeed, done this verbally over the phone, via email and live chat.

Phone - "I will look in to doing this for you and get back to you" on the 3 times requested

Email - no response whatsoever

Chat - "same response as phone and then chat ends"

its been over 4 months and no complaint has been filed by them, I do not have any reference number, and there has been zero communication from them in any shape or form.

I have already filed a case with the FOS, but the weird roadblock they didn't understand was me not having a complaint registered with the bank. They asked me do I have a complaint already opened with the bank? what is the reference number? They need the bank to respond to the complaint and provide an outcome before they will step-in.

And I'm like, how on earth am I supposed to forcibly make them register a complaint for me which I have asked for multiple times through every channel, and they clearly have either ignored or refused to do so? The FOS hasn't been much help either purely cause they seeming are asking me the same question over and over which I cannot answer.

Nasqueron

If you haven't done it already, reset ALL your passwords, email + banking, and get your computer or whatever you access it swept for malware or similar. If someone is getting into your account and doing it all this, it's because they have your login details and enough info to pass security checks. That it's happened twice indicates an ongoing security breach of your systems. If you live in a place with shared mail, consider going paperless to avoid stuff being intercepted in the post.

eskbanker

FOS are correct that they'll only act after you've been through the bank's complaints process - are you definitely following the process published on their website?  You are allowed to name the bank on here by the way....

goldmine2011

DE_612183 said:

Normally suing someone you need to prove financial loss - which if the bank put the money back you have no loss.

You can sue for emotional stress / anxiety - but again proving this is hard - have you been to a GP, been prescribed medicine or been officially categorised as having a mental disorder such as PTSD?

You may be better off changing banks and seeing if the the bank will provide some sort of ex-gratia payment for distress casued.

No I totally see what you mean, this type of cause is essentially as much as someone saying I guess "whiplash", something literally nobody can prove. But given this situation happening to anybody, it is an extremely stressful situation. You have thousands of £ gone, you have no idea how it happened, its scary that they don't even know how it happened, will it be returned/recompensated? etc. not many will say that it would be a positive situation in any sense.

Changing banks is 100% the next step, but the problem is I only had this as a current account, so in the process of opening up a new current account now and then any remaining funds will be transferred. The reason why we haven't closed that account immediately is because any further communication they always require your sort code and account number etc. If we closed it today we will most likely have to jump through more hoops of "we dont have any active account for you" etc and we have also yet to get a response on the missing funds

goldmine2011

eskbanker said:

FOS are correct that they'll only act after you've been through the bank's complaints process - are you definitely following the process published on their website?  You are allowed to name the bank on here by the way....

its Barclays, and it a premier account which we pay £20 a month for.

Exactly, so its essentially a catch 22.

FOS - you need to go through Barclays complaint process before we step in

Barclays - just ignore all your complaint requests so that FOS never step in



What we have sent in terms of contact so far -

- A physical letter to - Specialist Complaints P.O. Box 27127 GLASGOW G2 9LF

- Emails to - Privatebankclientservices@barclays.com

- called 0800 279 3665 (https://www.barclays.co.uk/content/dam/documents/plan-and-invest/plan-and-invest-how-to-complain.pdf)

- live chat as mentioned previously

in addition to this we have also CC'd in a huge 4 page document detailing the above in even more detail to :

• C.S. Venkatakrishnan (Group CEO) CS.Venkatakrishnan@barclays.com

• Matt Hammerstein (Chief Exec of UK CSR and corporate banking) Matt.Hammerstein@barclays.com

• Rob Morris (Director of Operations – Core complaints) Rob.Morris@barclays.com

• Vim Maru (Chief Exec of Barclays UK) Vim.Maru@barclays.com

Neither of those emails were sent a bounceback which means that they are valid, whether someone has read them I would have no idea.

eskbanker

goldmine2011 said:

What we have sent in terms of contact so far -

- A physical letter to - Specialist Complaints P.O. Box 27127 GLASGOW G2 9LF

- Emails to - Privatebankclientservices@barclays.com

- called 0800 279 3665 (https://www.barclays.co.uk/content/dam/documents/plan-and-invest/plan-and-invest-how-to-complain.pdf)

- live chat as mentioned previously

That document appears to relate to complaints about their investment services arm?

https://www.barclays.co.uk/complaints/ offers options relating to the retail banking business....

goldmine2011 said:

in addition to this we have also CC'd in a huge 4 page document detailing the above in even more detail to :

• C.S. Venkatakrishnan (Group CEO) CS.Venkatakrishnan@barclays.com

• Matt Hammerstein (Chief Exec of UK CSR and corporate banking) Matt.Hammerstein@barclays.com

• Rob Morris (Director of Operations – Core complaints) Rob.Morris@barclays.com

• Vim Maru (Chief Exec of Barclays UK) Vim.Maru@barclays.com
  

Sending massive wordy documents to lots of recipients isn't necessarily the most effective way of instigating action - complaints need to be focused and concise.

goldmine2011 said:

Neither of those emails were sent a bounceback which means that they are valid

No, it doesn't mean that at all!