High Court strikes out APP fraud claims against receiving payment service provider

The High Court has allowed the partial strike out of claims brought against the electronic money institution Revolut Limited, as the receiving payment service provider (PSP) in the context of an authorised push payment (APP) fraud: Larsson v Revolut Ltd [2024] EWHC 1287 (Ch).

This is the latest in a line of decisions concerning the role of receiving banks where the customer of a sending/paying bank has been the victim of an APP fraud.

The court emphasised that while the Supreme Court's decision in Philipp v Barclays Bank UK plc [2023] UKSC 25 (see our blog post) clarified the principles concerning a bank's duties to its customers when processing payments (including the so-called Quincecare duty), these were in the context of a sending bank, rather than a receiving bank. As to the responsibilities of a receiving bank, the court highlighted the following conclusions from the authorities:

• A receiving bank does not owe a duty to the payer/victim of the fraud to ensure that sums are sent only to the beneficiary identified in the payer's instructions: Abou-Rahmah v Abacha [2005] EWHC 2662 (QB). 
• The so-called Quincecare duty (and presumably, therefore, the general duty to act with reasonable skill and care when processing customer payments) does not extend to third parties: there is no equivalent duty of care owed to a third party who is not the customer of the bank and with whom the bank has no contractual relationship: Royal Bank of Scotland International Ltd v JP SPC 4 & Anor  [2022] UKPC 18.

In the present case, the claimant contended that the PSP owed him certain duties (either in contract or in tort) as the receiving provider and/or due to the fact that the claimant was also a customer of the PSP in his own right (even though the claimant's genuine personal account with the PSP did not receive or send any of the transfers which were the subject of the claim).

On the facts, the court found no basis for imposing the contractual duties advocated by the claimant. In respect of the alleged tortious duties, it was accepted that no duty of care is owed generally to a third-party payer/victim when processing payments. Moreover, on the facts, the court rejected the attempts by the claimant to impose a duty of care on the PSP simply by virtue of the fact the claimant happened also to be a customer of the PSP, noting that there was no principled reason for such a development in the law. 

Looking at the wider landscape of claims against receiving banks, there is an emerging patchwork of different decisions on similar facts, where alterative legal arguments have been deployed (at least at the strike out stage). The present case can be contrasted with CCP Graduate School Ltd v National Westminster Bank plc & Anor [2024] EWHC 581 (see our blog post), where the High Court refused to strike out an APP fraud claim against the receiving bank. CCP considered the novel "retrieval duty", ie the alleged duty on banks to take reasonable steps to retrieve or recover the sums paid out as a result of an APP fraud. The court in CCP reached its conclusion based on the Supreme Court's decision to grant permission to bring such a claim in Philipp. In contrast, here the court considered the classic duties surrounding the processing of the payment itself (rather than retrieval). On this point, the law is clear that there is no duty of reasonable skill and care owed to a third party who is not the customer of the bank and with whom the bank has no contractual relationship, as per JP SPC 4.

We consider the decision in more detail below.

Background

The claimant was the alleged victim of an APP fraud. The facts summarised below reflect those pleaded by the claimant, which were assumed to be true for the purpose of the strike out application.

As part of the fraud, the claimant believed that he was going to purchase shares in a company called "Starlink". He was told by the perpetrators of the fraud that five separate accounts at the defendant PSP had been set up in his own name and that he should transfer funds to these "Destination Accounts". He understood these accounts were in his own name, to ensure that the money remained under his control until he became a shareholder of Starlink. The claimant made five transfers from his account with a Swiss bank to the Destination Accounts. In fact, the Destination Accounts were not held in the claimant's name, and once the funds were received, the perpetrators quickly transferred the funds out again. On the claimant's case, there were various red flags which should have alerted the PSP to the fraud, including communications from the perpetrators to the PSP saying that the payments out were urgent.

Important to the way in which the claimant argued his case, the claimant was also a customer of the PSP, but the claimant's genuine account with the PSP did not receive or send any of the transfers which were the subject of the claim: the payments were made from the claimant's account at a different bank and received into the Destination Accounts, which were not held in the claimant's name.

The claimant brought a claim alleging the following causes of action (among others): 

1. Breach of contract: The PSP allegedly failed to detect and/or to take adequate steps to mitigate and/or prevent the fraud in breach of contract (relying on the fact that the claimant had a separate genuine account with the PSP).
2. Breach of duty: The PSP breached analogous duties allegedly owed to the claimant in tort by virtue of the same facts as noted at (1) above.
3. Dishonest assistance: The PSP was said to be liable as an accessory to a breach of trust, because it rendered assistance to the perpetrators of the fraud in circumstances where it had sufficient knowledge of the facts which constituted a breach of trust, or sufficient doubts that a breach of trust was being committed but turned a blind eye to it.

Decision

Breach of contractual/tortious duties – relevant legal principles

It was common ground for the purpose of the application that, although the PSP is an electronic money institution and not a bank, materially the same duties are owed as would be owed by a bank to its customer. Namely, the PSP owed a duty to carry out the services contemplated by the contract with its customer with reasonable skill and care.

The court recognised the following important facts before setting out the relevant legal principles: (1) the PSP was the receiving (not sending) provider; (2) the PSP was not acting upon any orders or instructions from the claimant (the claimant's instructions were made to his sending bank); and (3) as the receiving provider, the PSP's customers were the holders of the Destination Accounts, which in each case were not the claimant.

The court noted that while the Supreme Court's decision in Philipp clarified the principles concerning a bank's duties to its customers when processing payments, these arose in the context of a sending bank, rather than a receiving bank. As to the responsibilities of a receiving bank, the court referred to JP SPC 4, which confirmed that the so-called Quincecare duty does not extend to third parties. It also cited Abou-Rahmah v Abacha, confirming that the receiving bank in that case did not owe a duty to the payer/victim to ensure that sums were sent only to the beneficiary identified in the payer's instructions.  

Breach of contractual/tortious duties – analysis

Notwithstanding the above, the claimant contended that the PSP owed him certain duties (either in contract or in tort) as the receiving provider and/or due to the fact that he was also a customer of the PSP in his own right. In particular, he claimed the PSP was providing a service to:

1. Block attempts to open, use or purport to use a second account in his name (in breach of its standard terms and conditions, under which the customer was entitled to open only a single personal account); and
2. Manage, and so far as possible, facilitate such transfers which were prima facie attempts to credit the claimant and/or his genuine personal account held with the PSP. 

The court held that that the PSP was not obliged to provide either of the above services: 

• The only term of the contract (governing the claimant's genuine account with the PSP) relied upon by the claimant, simply restricted customers from opening more than one personal account. The court held that this term could not be construed as defining any service to be provided by the PSP or imposing any obligations on it at all, including an obligation on the PSP to enforce its terms by preventing the opening of any other account in the customer's name. That obligation was held to be irrelevant on the assumed facts in any event: the Destination Accounts had not been opened in the claimant's name, although he was told by the perpetrators that they had been.
• The claimant accepted (per the Privy Council decision in JP SPC 4) that no duty of care is owed generally by the receiving bank to a third-party payer (ie the victim of the fraud).  Accordingly, the court held that there was no principled reason for imposing a duty of care simply because the claimant happened also to be a customer of the PSP.  In doing so, the court recognised that it was open to it to find new duties of care on the basis of the "incremental approach". However, to impose a duty on a bank to take reasonable care to protect third parties who make payments to the receiving bank's own customer's account (where that customer is the perpetrator of a fraud) would be to cross the line between the proper role of the courts, and the role of the legislator and regulator.

Dishonest assistance

For a claim in dishonest assistance in a breach of trust, it is first necessary to establish that there is a trust. The claimant contended (in reliance on Westdeutsche Landesbank Girozentrale v London Borough of Islington [1996] AC 668) that where a transfer of property is procured by fraud, the transferred funds will constitute trust property. Alternatively, the claimant alleged that there could be a constructive trust over property paid as a result of mistake, where the recipient is aware of the mistake.

The court acknowledged that this is an area on which there has been considerable academic debate.  Accordingly, it held that it was not prepared on a summary basis to conclude that there was "no sufficiently arguable case that a constructive trust arose on the funds transferred to the Destination Accounts". In the court's view, fuller argument would be required to resolve the question, particularly where the answer could have much wider implications.

The court agreed that the claim in dishonest assistance was insufficiently pleaded, but granted the claimant permission to amend the particulars of claim, to remedy the pleading defects identified.

Note: In October 2024, the claimant applied to the Court of Appeal for permission to appeal. 

In December 2024, the Court of Appeal refused the claimant's application for permission to appeal.