APP Fraud - where are we now?

Authorised push payment (APP) fraud continues to cause significant headaches for consumers and financial institutions alike. In 2023, data published by the Payments System Regulator (PSR) revealed that APP fraud amounted to a loss of £341 million in the UK. It is therefore unlikely that we will see an end to the steady stream of APP fraud cases in the courts any time soon. In light of this, and the introduction of the long-awaited mandatory reimbursement requirements, will treatment of APP fraud cases stabilise? This article will consider two new high court cases, Larsson v Revolut and Terna DOO v Revolut, which have recently developed the jurisprudence in this area, and the upcoming mandatory reimbursement rules.

Larsson v Revolut Ltd [2024] EWHC 1287 (Ch)

In Larsson v Revolut the claimant, a victim of APP fraud, issued a claim against Revolut, an Electronic Money Institution (EMI). The claimant alleged that they were tricked by fraudsters into sending money to five Revolut accounts, which they were told by the fraudsters had been set up in the claimant’s name. The claimant, in the mistaken belief they were purchasing shares in a company, sent money to these accounts. The accounts were not in the claimant’s name, however, and the money was quickly transferred out by the fraudsters.

The claimant argued that Revolut should be held liable for their financial loss. It was claimed that Revolut:

1. had breached its contract with the claimant. In this respect the claimant alleged that Revolut had not exercised reasonable skill and care by failing to detect and/or take adequate steps to mitigate and/or prevent the fraud. (Whilst the claimant alleged that this contract had arisen as they were a customer of Revolut, it is worth noting that their genuine account formed no part of the fraud carried out against them, and was wholly separate to the facts of the case);
2. had breached their tortious duties to the claimant by failing to detect and/or take adequate steps to mitigate and/or prevent the fraud;
3. was unjustly enriched in respect of the sums paid to Revolut resulting from the fraud; and/or
4. was liable as an accessory in dishonestly assisting a breach of trust as, the claimant alleged that Revolut had rendered assistance to the fraudsters where it had sufficient knowledge of facts which constituted a breach of trust or had sufficient doubts as to the same.

The court acknowledged in its judgment that, whilst Revolut was an EMI and not a bank, it owed materially the same duties as a bank. Mr Justice Zacaroli did issue a reminder, however,  that the case law regarding banks’ duties to their customers relates principally to the duties of a paying (as opposed to receiving) bank. He identified several principles arising from Philipp v Barclays Bank, namely that:

1. the Quincecare duty does not apply where a customer unequivocally authorises and instructs the bank to make payment;
2. the instruction of the customer which gives rise to a fraudulent transaction cannot be invalidated because of the deceit of a third party and such deceit does not give rise to a claim against the bank; and
3. where the bank receives an instruction from its customer, it is obliged to act on it, without concerning itself as to the wisdom or risks of its customer’s payment decision.

There is an important distinction in this case, therefore, since Revolut was receiving the defrauded sum and was not acting on orders or instructions from the claimant (as these were made to the sending bank).

When considering the duties owed by a receiving bank, the court highlighted that a receiving bank does not generally owe a duty to a payer (Abou-Rahmah v Abacha [2005] EWHHC 2662 (QB)) and the Quincecare duty does not extend to third-parties. Therefore, as there was no contract between the claimant and Revolut in respect of the disputed accounts, there was no basis for imposing a duty to exercise reasonable skill and care to a third-party payer.

The fact that the claimant happened to be a customer of Revolut and had an account entirely separate to the facts of this case, was not found to be relevant and the contractual duties owed in connection to the claimant’s genuine account were not owed for a transaction in which it was a third-party payer.

The claimant’s case was struck out, save for their claim of dishonest assistance in breach of trust, in relation to which the claimant was allowed to remedy various defects in their pleadings as they had not sufficiently identified how the alleged trust, which would need to exist for a breach of trust to occur, had arisen. The pleadings had equally failed to quantify how a breach of trust occurred. Justice Zacaroli did not comment on the merits of the claimant’s dishonest assistance case, though he did note that the threshold to meet in order to establish dishonest assistance is very high. It was determined that Zacaroli J would refrain from ruling on unjust enrichment as another case with substantially similar facts was considering this point so it was agreed to await the outcome of that case.

Terna DOO v Revolut Ltd [2024] EWHC 1419 (Comm)

This case was Terna DOO v Revolut Ltd, which was handed down 12 days after Larsson v Revolut. Here, the claimant instructed their bank to pay €700,000 to an account held with Revolut by Zdena Fashions Ltd, a third-party. The claimant was under the misapprehension that they were settling a genuine invoice from a supplier. As in the above case, the account was later emptied by suspected fraudsters. The claimant made a claim against Revolut for unjust enrichment. They did not, notably, make any claim against Zdena or their own bank.

Revolut responded with an application for reverse summary judgment and/or strike out on the basis that it had not been enriched and/or this enrichment was not at the expense of the claimant.

HHJ Matthews ran through the elements which the claimant would need to prove, should the matter progress to trial, to establish unjust enrichment. These are: (a) enrichment, (b) at the expense of the payer, (c) which is unjust, (d) without any applicable defences. The court dealt with points (a) and (b), noting that (c) and (d) would make up the bulk of submissions at trial.  

The court held that Revolut had been enriched by the transfer. This is despite the transferred sum being held in a segregated account with Barclays as required by regulation 20 of the Electronic Money Regulations 2011. Rather, HHJ Matthews considered that Revolut was the beneficial owner of the funds and therefore still enriched. He concluded that “the position of the applicant is in this respect the same as for an ordinary bank”.

On Revolut’s second argument (that any enrichment was not at the expense of the claimant), HHJ Matthews considered Investment Trust Companies v HMRC [2017] UKSC 29, a Supreme Court judgment.

The test arising from Investment Trust Companies v HMRC divides cases into two broad categories, being (1) those where the parties have dealt directly with each other and (2) those where they have not, but the defendant has still received a benefit from the claimant, causing the claimant loss. The current case fell under the second category of an indirect transfer.

HHJ Matthews considered, however, that indirect transfers such as those in this case could be treated as direct transfers under Investment Trust Companies v HMRC due to agency or if they were a “set of co-ordinated transactions”. As the claimant instructed its own bank to make the transfer to Revolut and that bank duly organised the payment, HHJ Matthews concluded this was “a classic case of agency”. This was regardless of the different entities through which the funds may have passed on the way to Revolut. The transactions in this case were also found to be co-ordinated and to form a series. As HHJ Matthews noted, if any transaction in the chain of transactions had failed, the end result (i.e. payment into the fraudster’s account) would not have happened.

HHJ Matthews expressed the view that this case involved the enrichment of Revolut at the expense of the claimant by indirect transfer, but that there should be a resolution of the claim only after a full trial allowing the complete facts to be investigated.

HHJ Matthews acknowledged that he was reaching a different decision to the court in Tecnimont Arabia Ltd v National Westminster Bank plc [2022] EWHC 1172 (Comm), which also applied the test in Investment Trust Companies and which concluded that the bank would not be liable for unjust enrichment as it was not enriched at the claimant’s expense. In Tecnimont the court found that interbank transactions did not form a series of co-ordinated transactions and that no agency relationship arose in these transactions, despite the background (which involved a receiving bank in an APP fraud scenario) being similar.

HHJ Matthews did not consider himself strictly bound by Tecnimont and cited his disagreement with the above-mentioned findings in Tecnimont. As set out above, HHJ Matthews considered that agency and a series of co-ordinated transactions must arise in interbank transfers and refused to follow Tecnimont in this regard.

Revolut has obtained permission to appeal in respect of both of its arguments.

Commentary

In Larsson v Revolut Ltd the court emphasised the distinction between the roles of courts and legislators in setting fraud prevention policy and regulation.

On this point, groups such as the Payment Association are already calling on the new government to make changes to the mandatory reimbursement requirement for APP fraud which comes into force on 7 October 2024. The new rules, which were announced by the PSR on 7 June 2023, will require UK PSPs to reimburse in-scope customers who fall victim for APP fraud. Reimbursement will be split 50:50 between the paying and receiving banks up to a maximum of £415,000 for each single APP fraud case. Reimbursement will only be refused if the customer has failed to meet the consumer standard of caution through gross negligence (as long as the customer is not vulnerable).  As recently as 11 July 2024, the Payments Association wrote to the newly appointed Economic Secretary to the Treasury to reduce the mandatory APP fraud reimbursement to £30,000 to more accurately represent average losses. The Payment Association’s letter also noted the current lack of provisions for fraud originating on social media, which is not currently mandated to reimburse its customers.

With the mandatory reimbursement requirements shortly coming into effect and in light of these recent Judgments, one might expect to see more APP fraud cases litigated as payment service providers (PSPs) seek to establish and test the scope of the requirements (to the extent not already clarified by the PSR’s guidance) upon both paying and receiving banks. The latest two judgments (albeit given on a summary basis and ahead of full trial) highlight the issues that persist in this area, with the ruling in Terna DOO v Revolut, in particular, leaving money institutions, their customers and advisors with conflicting authority which is in need of higher court attention.

Indeed, taken together, two factually similar cases have been brought with differing causes of action and reached converging conclusions (ironically for the very same EMI: Revolut). Whilst these judgments deal with different legal principles, together they encapsulate the range of live issues within the arena of APP fraud, of which EMIs and other financial instructions should take note. Clearly notwithstanding the Supreme Court’s ruling in Philipps v Barclays, therefore, the law on APP fraud remains an evolving piece. Could this be an area for the newly formed Labour Government to tackle given their manifesto promises a “new expanded fraud strategy to tackle the full range of threats”?

Let’s see what October 7th brings…

This article was first published in Law 360, here.