Has a new route to recovery opened up for victims of banking payment frauds?

Introduction

Authorised push payment (APP) fraud continues to be a fast growing social problem. APP fraud is a scam which involves fraudsters tricking their victims into willingly making large bank transfers to them, for example by posing as someone from the victim’s back or another trusted organisation.

As claims against Payment Service Providers (PSPs) (such as PayPal, Square and Shopify) have continued to be brought, the courts have been asked to examine the scope of the so-called “Quincecare duty”. The Quincecare duty is a duty on a bank to refuse to comply with a payment instruction in circumstances where the bank is on notice that the instruction may be part of a fraud. The most recent significant case examining the Quincecare duty is the Supreme Court decision in Philipp v Barclays Bank UK plc [2023] UKSC 25 (Philipp). 

In Philipp, the Supreme Court determined that where a customer has authorised and instructed its bank to make a payment, the bank must carry out the instruction promptly and not concern itself with the wisdom or risks of its customer’s payment decisions. Instead, the Quincecare duty to exercise reasonable skill and care is only engaged where the validity or content of the customer’s instruction is in question. If the payment order is valid and not suspicious in and of itself, the duty to exercise reasonable skill and care will not apply and there is no conflict between that duty and the basic contractual duty to act in accordance with its customer’s instructions.  Going further, the Supreme Court specifically held that the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions does not apply where a customer is a victim of APP fraud, because the validity of the instruction is not in doubt, provided the instruction given by the customer or its agent acting with apparent authority is clear. If so, then no further inquiries or verification need to be made by the bank. Generally speaking, the Quincecare duty will therefore not apply where the instruction has come from the customer itself.  

Most recently, the High Court has been asked to consider this duty in the case of CCP Graduate School Ltd v National Westminster Bank plc & Anor [2024] EWHC 581 (CPP). In following Philipp and determining the Quincecare duty was not engaged, the High Court has in fact gone a step further by examining whether a “retrieval duty” applied against a PSP, that is, a duty to take steps to retrieve or recover monies that have been paid out as a result of an APP fraud.

Case background

In CPP, an alleged APP fraud took place perpetrated by a criminal gang in September and October 2016.  The Claimant’s sole director instructed the First Defendant (the sending bank) to make fifteen payments to an account held with the Second Defendant (the receiving bank), totalling almost £416,000. The Claimant raised a fraud alert with the First Defendant around 10 days after the last payment and the Second Defendant was notified the same day, but only £14,000 of the Claimant’s money was ultimately retrieved.

The Claimant issued proceedings against both banks in October 2022, alleging that the First Defendant had breached its Quincecare duty and that the Second Defendant owed and breached some other duty of care owed to the Claimant by allowing sums transferred to it by the First Defendant to be removed. The Defendants each made an application for reverse summary judgment/strike out.

Following the judgment in Philipp, in which the prospect of a duty to retrieve funds was raised (but not decided), the Claimant made a cross-application to amend its case against both Defendants to include a claim for breach of a duty to take reasonable steps to retrieve or recover the sums paid out as a result of an APP fraud.

Formal introduction of a retrieval duty for PSPs?

Following the application by the Claimant to amend in CPP, the High Court summarily dismissed the claim against the First Defendant (the sending PSP) on the basis it was statute-barred pursuant to the Limitation Act 1980.

However, it refused to strike out the Claimant’s amended ‘retrieval duty’ claim against the Second Defendant (the receiving PSP). The Claimant argued in its amended claim that there could be a duty of retrieval, which would be: (i) a duty in tort; and (ii) owed to the Claimant by the Second Defendant operating the account of the criminal gang that perpetrated the fraud.

The High Court concluded that there was some uncertainty as to whether the retrieval duty could be owed on this basis, and so could not strike out the claim. The Second Defendant has been given permission to appeal, so watch this space. 

Comment

This decision may well cause some consternation amongst PSPs - the prior acknowledgement by the Supreme Court in Philipp that the way in which victims of APP fraud are reimbursed is a question of social policy for regulators and the government and not a matter to be determined by the courts at least provided some certainty to banks and PSPs. The approach of the court in CPP seems to militate against that finding, albeit the Court was only saying that it could not strike that claim out at this early stage (rather than making a determination on the issue).  How any further development in this area will interrelate with the new rules announced in 2023 by the Payment Services Regulator, imposing a mandatory requirement for UK PSPs to reimburse all in-scope victims of APP fraud, will be interesting. In particular the new rules do not cover international payments and reimbursement is to be limited to £415,000 (which, coincidentally, would mean the Claimant’s claim would have needed to be litigated), so any further consideration of a “retrieval duty” will be watched closely by PSPs.