High Court considers novel APP fraud "retrieval duty" claim against both sending and receiving PSPs

In a significant decision in the context of claims brought by the victims of authorised push payment (APP) frauds, the High Court has considered whether a sending and/or receiving payment service provider (PSP) owes a duty, directly to the victim of the fraud, to take reasonable steps to retrieve or recover the sums paid out as result of the APP fraud (i.e. a "retrieval duty"): CCP Graduate School Ltd v National Westminster Bank plc & Anor [2024] EWHC 581.

By way of background, the Supreme Court's decision in Philipp v Barclays Bank UK plc [2023] UKSC 25 (see our blog post) closed the door to so-called Quincecare duty claims by the victims of APP frauds, in which it was argued that a PSP owed a duty to its customer not to carry out payment instructions, if the PSP had reasonable grounds for believing the customer was being defrauded. However, the Supreme Court granted permission for Mrs Philipp to maintain an alternative claim, based on the PSP's alleged failure to take adequate steps after it was alerted to the fraud (even though it considered that the likelihood of successfully reclaiming the money transferred pursuant to the APP fraud was slim). In doing so, the Supreme Court left the door ajar for claims based on a potential duty of care on PSPs to take reasonable steps to retrieve or recover the sums paid out as a result of an APP fraud.

In the present case, the court considered this novel duty in the context of applications for reverse summary judgment/strike out, pursued by both the sending and receiving PSPs. While the court summarily dismissed the claim against the sending PSP (on the basis that it was statute-barred under the Limitation Act 1980), it refused to strike out the retrieval duty claim against the receiving PSP (which was not statute-barred).

The decision in this case is likely to cause frustration within the payment services market, given the emphasis by the Supreme Court in Philipp that the reimbursement model for victims of APP fraud is a question of social policy for regulators and the government, and not the role of the courts. This is particularly so in the context of the UK Payment Systems Regulator's reimbursement requirement for APP fraud, which was published at the end of 2023 in the Policy Statement 23/4 Fighting APP scams: Final decision (PS23/4) (see our blog post).

We understand that a consequentials hearing has taken place and the receiving PSP has been given permission to appeal. We will be following the progress of this appeal closely and will continue to report on developments.

We consider the decision in further detail below.

Background

Pursuant to an alleged APP fraud perpetrated by a criminal gang, between 13 September and 12 October 2016, the claimant's sole director instructed the First Defendant (the sending bank) to make fifteen payments to an account held with the Second Defendant (the receiving bank), totalling almost £416,000. The claimant raised a fraud alert with the First Defendant around 22 October 2016 and the Second Defendant was notified the same day, but only £14,000 of the claimant's money was ultimately retrieved.

The claimant issued proceedings against both the First and Second Defendants on 18 October 2022, alleging that the First Defendant had breached its so-called Quincecare duty and that the Second Defendant owed and breached some other duty of care owed to the claimant by allowing sums transferred to it by the First Defendant to be removed.

The defendants made an application for reverse summary judgment/strike out. Following the Supreme Court's judgment in Philipp, the claimant made a cross-application to amend its case against both defendants to include breach of a duty to take reasonable steps to retrieve or recover the sums paid out as a result of an APP fraud.

Decision

The court summarily dismissed the claim against the First Defendant (the sending bank) and refused the permission to amend the claim. However, in respect of the Second Defendant (the receiving bank), the court refused to strike out the claim and permitted the claimant's application to amend its case. The key aspects of the decision are considered in further detail below.

Claim against the First Defendant

Strike out/summary judgment

The court held that any claim based on failure to prevent any payment out of the account with the First Defendant (whether pursuant to the so-called Quincecare duty or otherwise) would be statute barred under the Limitation Act, given that the last payment was made on 12 October 2016 and the claim was not issued until 18 October 2022.

Even if it was wrong about limitation, the court held (obiter) that it would have struck out the claim in any event, following the Supreme Court's decision in Philipp. The claimant's pleaded claim depended on demonstrating that the First Defendant's duty to exercise reasonable skill and care was engaged when carrying out the claimant's payment instructions. However, this duty to interpret, ascertain and act in accordance with a customer's instructions cannot be engaged unless there are doubts as to the validity or content of the customer's instruction. The duty therefore has no application where the customer provides clear and valid payment instructions, as happened in the present case.

Application to amend the claim

Even if there is no Quincecare duty to prevent payments out in an APP fraud scenario, the claimant argued that there is a duty in law at a certain point to take reasonable steps to retrieve or recover the sums paid out as result of the APP fraud (i.e. a "retrieval duty").

The claimant relied on the Supreme Court's refusal in Philipp to summarily dismiss the claimant's claim for the loss of a chance of recovering money transferred to a bank in the UAE pursuant to an APP fraud. On the facts of Philipp, Lord Leggatt held that the likelihood of successfully reclaiming money transferred to the UAE pursuant to an APP fraud was slim, even if prompt action had been taken by the bank after it was notified by its customer that she believed she was the victim of a fraud. However, Lord Leggatt considered that the claim could not be resolved at that stage of the proceedings on a summary judgment application. In the present case, the claimant sought to allege that, if the First Defendant had taken prompt and effective action, some or all of the claimant's money would have been recovered.

Finding that it had no power to allow an amendment under CPR 17.4 to introduce the retrieval duty claim, the court referred to Mulalley & Co Ltd v Martlet Homes Ltd [2022] EWCA Civ 32. Responding to the factors identified in Mulalley, the court noted that the relevant limitation period for a claim under the retrieval duty had expired and the amendments proposed sought to add a new cause of action, which did not arise out of the same/substantially the same facts as the existing claim. However, the court said that it would have exercised its discretion to allow an amendment, if such discretion had been available. It commented that there was a reasonable inference that more could have been done by other banks in the chain through which the funds were transferred, including the First Defendant. The court appears to have been influenced by action taken by the bank to which the funds were transferred by the Second Defendant (when notified of the fraud), which apparently led to recovering some of the claimant's money.

Claim against the Second Defendant

Strike out/summary judgment

The particulars of claim alleged that by allowing the sums received from the First Defendant to be removed from the Second Defendant's account, the Second Defendant failed in its duty of care to the claimant. Although the claimant wished to amend the statements of case to clarify the existing claim, the court held that they included a "retrieval duty" claim.

The court held that this claim could not be struck out on the ground of limitation, since there were still sums left in the Second Defendant's account on 18 October 2016 (being the relevant date for limitation purposes for a claim commenced on 18 October 2022). Nor was the court prepared to strike out the claim on the basis of causation.

The court also refused to strike out the claim on the basis that the retrieval duty was not owed by the Second Defendant to the claimant, based on the following key conclusions:

• No Quincecare-type duty. The court accepted that there could be no Quincecare-type duty falling on the Second Defendant (such a duty would be inconsistent with the contractual duty to effect any mandate by the Second Defendant's own customer, albeit they were the perpetrator of the fraud). Accordingly, to the extent that the claim was based on the so-called Quincecare duty, it was struck out.
• Duty of retrieval. However, the claimant relied on the Supreme Court's recognition in Philipp that there could be a duty of retrieval, which it said was arguably: (i) a duty in tort; and (ii) which could be owed to the claimant by the Second Defendant operating the account of the criminal gang which perpetrated the fraud. On balance, the court concluded that there was some uncertainty as to whether the retrieval duty could be owed by the bank of those who have perpetrated the APP fraud. On that basis, the court could not strike out the claim.
• Assumption of responsibility. In the court's view, it was not necessarily fatal to the claim that there may have been no assumption of responsibility by the Second Defendant to the claimant, on the basis of the decision in HXA v Surrey CC[2024] 1 WLR 335, in which Lord Burrows set out the following principles:

"In the tort of negligence, a person A is not under a duty to take care to prevent harm occurring to person B through a source of danger not created by A unless (i) A has assumed a responsibility to protect B from that danger, (ii) A has done something which prevents another from protecting B from that danger, (iii) A has a special level of control over that source of danger, or (iv) A's status creates an obligation to protect B from that danger."

The court noted that (iii) and (iv) were of particular relevance here, assuming that the Second Defendant had at least some measure of control over the payments and was in a special position to take steps to recover the sums due.

• Special level of control. On the question of whether the Second Defendant had a "special level of control" per HXA v Surrey, the court was not persuaded (for the purpose of the application) that the bank's obligation to follow its customer's instructions was a complete argument against imposing the retrieval duty. In particular, although not explored in detail, the court referred to evidence before the court on the operation of a chain of indemnities between banks processing payments, which "at least to some extent is intended to permit a bank to take steps which might countermand its own client's instructions".

Application to amend the claim

The court did not think an amendment to clarify the alleged duty of retrieval had the effect of introducing a new claim against the Second Defendant, and therefore granted permission to amend.

Note: In November 2024, the High Court refused the claimant's appeal against its earlier decision to summarily dismiss the claim against the First Defendant (Natwest). The High Court is yet to consider the Second Defendant's (Santander) appeal against its earlier decision declining to strike out out the claim against it.