Expats with offshore bank accounts face fraud protection gaps

Criminals generally aren’t fussy about where their targets live, but one HSBC Expat customer – who lost €50,000 to a sophisticated investment scam – was horrified to discover that her offshore account doesn't have the same protections against fraud losses as a UK account. 

An offshore bank account helps people more easily manage their money while they live or work overseas, yet customers may have no idea that they'll lose important consumer protections upon moving their funds abroad.

Domestic accounts benefit from strong safeguards against unauthorised fraud and a reimbursement scheme for victims of authorised push payment (APP) fraud, but British expats who move their money to offshore accounts are only protected by the rules of that account’s jurisdiction, which can be much weaker. 

How the scam started

Ruth, who is retired and lives in Portugal, uses an offshore HSBC Expat bank account based in Jersey to manage her finances. She had never considered whether this put her at a disadvantage to customers based in the UK, until she needed to turn to her bank for help. 

Her problems began when she spotted a seemingly innocuous online advert about investing in European bonds. She was invited to enter her name and phone number to find out more, unaware that she was sharing her details with scammers who would later steal €50,000 and disappear without trace. 

In August 2024, weeks after spotting the advert, she received a call from someone claiming to work for NatWest, citing her interest in European bonds. Although Ruth is not an experienced investor, she made some sensible checks, asking him how she could be certain he was legitimate. 

However, she was up against a seasoned fraudster, likeable and knowledgeable, who reassured her every step of the way. 

First, he sent an email from what appeared to be a genuine NatWest Bank Europe address (@nwbeurope.com), before sharing credible – but fake – NatWest-branded brochures, as you can see below. Which? reported these to NatWest for investigation. 

There was no sense of urgency, nor ridiculous returns promised. Ruth chose a French bond offering a 6% return maturing in 2025, and eventually agreed to invest €100,000.

‘This man claimed to work for NatWest in London and said that my inquiry had just landed on his desk. He talked to me about European bonds and said he would send me details. He had an answer for everything and was very charming, telling me about his previous visits to Portugal. I feel very stupid now,’ says Ruth. 

Fake invoices

Ruth was told to await contact from the NatWest ‘compliance department’ before sending any money, removing any remaining niggling doubts. 

A caller told her that NatWest used a firm of solicitors called NC Law (the name of a genuine, regulated firm which had nothing to do with them), directing her to use a website called custodianchecker.com (which has since been suspended) to confirm that NC Law is approved for bonds and equities. 

Next, she was sent a fake invoice from ‘NC Law’, supplying the account details of a HSBC UK account. Which? has reported this fake invoice to the real NC Law. 

The money couldn’t be transferred in one go so the ‘compliance officer' told Ruth to send the first half on the Friday and the balance on the Monday. The fraudster perhaps knew this timing would be less likely to raise red flags.

Later, when Ruth realised her first €50,000 payment had gone to a personal account, not a business account, she called the scammer. They made one last attempt to deceive her, claiming they would 'resell the rest of the bond', but by now, she had the sinking feeling that something wasn't right and reported it to HSBC. 

A lack of protection 

HSBC’s fraud team said the bank had a ‘legal obligation to process the transaction’ as Ruth had instructed and therefore wouldn’t reimburse any of the stolen money.

If she had a UK account – rather than an offshore account held in the Channel Islands – the response would have likely been very different.

This is because payment firms using Faster Payments for UK bank transfers are required to reimburse victims of APP fraud under a mandatory reimbursement scheme, which came into effect on 7 October 2024. 

The cost of reimbursement is shared equally between the sending and receiving payment firms, up to a cap of £85,000 per claim. 

Victims can only be asked to pay £100 (the claims ‘excess’) and banks can only decline claims if they have evidence that customers failed to meet requirements known as the 'consumer standard of caution' (you can find out more about this in our APP fraud guide). 

Make your money go further

Find the best deals, avoid scams, and grow your savings with our expert guidance. From only £4.99 a month.

Join Which? Money

Cancel anytime.

Confirmation of Payee

Another blow for offshore bank customers, like Ruth, is that they can’t rely on vital Confirmation of Payee (CoP) checks. 

This is a name-checking system which prevents payments being made to the wrong bank accounts by issuing a warning if the name of the payee and the account details provided don't match. In the UK, over 300 financial firms have adopted it, meaning the vast majority of transactions made through the Faster Payments System are covered.

In Ruth’s case, CoP checks would have alerted her to a mismatch, warning her that the account details did not match the name ‘NC Law’. Yet the bank can easily wash its hands of any responsibility, because HSBC Expat is not a direct participant of the UK Faster Payments Scheme, meaning it is not obliged to offer CoP (though some other banks based in the Channel Islands may do so voluntarily). 

Ruth is convinced that a warning would have stopped her in her tracks, telling us:

Are offshore banking customers at greater risk?

We put it to HSBC that the lack of these protections puts Ruth and other customers with offshore bank accounts in the Channel Islands, which includes international accounts offered by Barclays, Lloyds, NatWest and Santander, at greater risk of APP fraud. 

A spokesperson for the Jersey branch of HSBC Bank said: ‘We do not accept that our customers are at significantly greater risk of APP fraud than other customers who bank with organisations outside of the UK. 

‘In addition to the steps that we take to protect customers against fraud, customers can also help protect themselves by taking note of fraud warnings when making payments and keeping up to date with the latest scam information, which is highlighted on our website and social media channels.

‘If a customer is in doubt about any request by a third party to make a payment, they should make additional independent enquiries as well as calling their bank on the number shown on the back of their debit card.’

How to fight your corner

Though it has no obligations under the mandatory APP fraud reimbursement scheme, we think HSBC Expat could have done more to identify the risk of financial harm in Ruth’s case, because the €50,000 transfer was to a new payee and clearly out of character when compared with her typical transactions. 

HSBC told Which? that Ruth was presented with a pop-up warning that highlighted clear instructions to ‘stop and think’ before going ahead with the payment, but generic warnings are fairly weak. Attempting to ‘break the spell’ of a fraudster requires meaningful, probing questions about the nature and purpose of the payment, with clear and specific fraud warnings.

It’s also striking that Ruth sent the money to HSBC UK, meaning it failed to prevent the account being opened or used for criminal purposes. Ruth was even told that HSBC Expat had contacted HSBC UK ‘as a courtesy…to advise them of the allegation against their customer’. 

This isn’t a courtesy: financial firms are legally required to prevent money laundering and report criminal activity. 

The bank told Which? ‘we apologise for any confusion caused by using the word "courtesy". HSBC Expat will always contact a beneficiary bank in the case of fraud, as we did in this case.’ 

HSBC UK would only say that it takes appropriate and timely action when it identifies suspicious activity or receives information that a customer account is being used to facilitate financial crime.

Which? has advised Ruth to take her complaint to the Channel Islands Financial Ombudsman (CIFO).

Sign up for scam alerts

Our emails will alert you to scams doing the rounds, and provide practical advice to keep you one step ahead of fraudsters.

Sign up for scam alerts

Which other protections are watered down?

A lack of APP fraud protection isn’t the only difference between UK accounts and expat accounts held in the Channel Islands.

First, you’ll potentially have to wait longer for a response from your bank if you have any payment or fraud issues to resolve. 

UK-based banks must make fraud reimbursement decisions within five working days for APP fraud reimbursement decisions – more on this in our guide – or 15 working days for other payment complaints (though banks can push the deadline to a maximum of 35 working days for complex cases). 

But, there is no equivalent in the Channel Islands, only an expectation, set by the CIFO, that complaints of any nature are usually resolved within eight weeks.

Offshore accounts can’t rely on the Payment Services Regulations (PSRs) either, under which customers with UK accounts must be refunded in cases of unauthorised fraud (broadly, someone taking money from your  account without your knowledge or permission). 

The Jersey Financial Services Commission told us there is no direct equivalent requirement to the PSRs for banks in the Channel Islands, though it pointed us to a rather less reassuring ‘principle’ requiring banks to ‘have due regard for the interests of its customers’.

Be mindful of significantly lower compensation limits, too. The CIFO can only award compensation of up to £150,000 if it finds in your favour when settling complaints (much less than the £430,000 the UK’s Financial Ombudsman Service (FOS) can award). 

And if a financial firm fails, schemes in Jersey, Guernsey and Isle of Man only protect deposits of £50,000, whereas the UK's Financial Services Compensation Scheme (FSCS) covers deposits of up to £85,000 per bank or banking group.