High Court confirms no novel "retrieval" duty owed by receiving banks to non-customers

On an appeal from the decision of a Master, the High Court has allowed a receiving bank's application for strike out/summary judgment in respect of a claim brought by the victim of an authorised push payment (APP) fraud, who was not a customer of the bank, based on a novel "retrieval" duty: Santander UK plc v CCP Graduate School Ltd [2025] EWHC 667 (KB).

The claim relied on the Supreme Court's decision in Philipp v Barclays Bank UK plc [2023] UKSC 25 (see our blog post), which closed the door to so-called Quincecare claims by the victims of APP frauds, but identified an arguable duty of retrieval, requiring banks to take adequate steps after being alerted to a fraud to recover payments made.

In the present case, the High Court accepted that the retrieval duty is a further potential application of the general duty of care owed by a bank to interpret, ascertain and act in accordance with its customer's instructions (first articulated in Selangor United Rubber Estates Ltd v Cradock (No. 3) [1968] 1 WLR 1555 and approved in Philipp). The imposition of such a duty would mean that, when notified of a potential fraud by its customer, the bank would arguably have a duty to obtain that customer's instructions as to whether it should take steps to recover previously authorised payments out of the customer's account.

However, this (arguable) retrieval duty arises from the contractual obligation owed by a bank to exercise reasonable skill and care. In the court's view, Philipp does not provide any basis for holding that there might be a similar freestanding duty owed by a bank to the victim of an APP fraud with whom it has no contractual relationship. The court considered whether the retrieval duty should be recognised in the novel situation where there was no contractual relationship between the bank and the third-party victim, concluding that there was no basis for the incremental development of an equivalent duty. 

On this basis, any future retrieval duty claims are likely to be limited to claims against sending banks (given the direct contractual relationship with the victim of an APP fraud). However, it is important to recognise that - even in respect of sending banks - this duty remains arguable only, as there has not yet been a case in which the retrieval duty has been found to have been owed and breached.

The decision is significant in the context of APP fraud claims, and wider payment processing risks for banks and other payment service providers (see our previous blog posts covering developments in this area here).

We consider the decision in further detail below.

Background

As more fully set out in our previous blog post, pursuant to an alleged APP fraud perpetrated by a criminal gang, the claimant's sole director instructed the First Defendant (the sending bank) to make fifteen payments to an account held with the Second Defendant (the receiving bank), totalling almost £416,000 between 13 September and 12 October 2016. The claimant raised a fraud alert with the First Defendant and the Second Defendant was notified the same day, but only £14,000 of the claimant's money was ultimately retrieved.

The claimant issued proceedings against both banks alleging that the First Defendant had breached its so-called Quincecare duty and that the Second Defendant owed and breached some other duty of care owed to the claimant by allowing sums transferred to it by the First Defendant to be removed.

The defendants made an application for reverse summary judgment/strike out. Following the Supreme Court's judgment in Philipp, the claimant made a cross-application to amend its case against both defendants to include breach of a duty to take reasonable steps to retrieve or recover the sums paid out as a result of an APP fraud.

A High Court Master summarily dismissed the claim against the First Defendant and refused permission to amend the claim. However, in respect of the Second Defendant, the Master refused to strike out the claim and permitted the claimant's application to amend its case.

The Second Defendant appealed.

Decision

The High Court allowed the appeal and set aside the Master's judgment, finding that the Second Defendant's application for strike out/summary judgment should be allowed in its entirety.

Applying Easyair Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch), the High Court confirmed that the present case turned on a discrete question of law and was suitable to consider on a summary basis. It summarised the question of law as follows: in circumstances in which a customer of the paying bank has been fraudulently induced to make payments into an account held at the receiving bank (with which the customer otherwise has no relationship), when notice of the fraud is given to the receiving bank, is it under a tortious duty to take reasonable steps to retrieve or recover those payments for the customer of the paying bank?

Retrieval duty: legal basis following Philipp

The High Court noted that the basis for the Master's decision in respect of the retrieval duty was Lord Leggatt's judgment in Philipp (in particular, paragraphs 115-119), in which he articulated the duty that might arguably have arisen after the bank received notification of the fraud from Mrs Philipp. The High Court identified two key points in respect of this (arguable) duty:

• It was a further potential application of the duty of care owed by a bank to interpret, ascertain and act in accordance with its customer's instructions, and therefore arose from the contractual obligation owed by a bank to its customer.
• The imposition of such a duty would mean that, when notified of a potential fraud by its customer, the bank would arguably have a duty to obtain that customer's instructions as to whether it should take steps to recover previously authorised payments out of the customer's account.

The High Court held that Philipp did not provide any basis for holding that there might be a freestanding duty upon a bank to take positive steps to unwind harm already caused to a third party (with whom it had no contractual relationship) by attempting to reverse payment orders previously entirely properly made on the instructions of its own customer. Indeed, such a duty would be in conflict with the observation made by Lord Leggatt at paragraph 117: absent instruction from its customer, the bank would have "no authority, let alone obligation, to attempt to reverse earlier transactions when to do so would have been directly contrary to its customer's payment orders".

Accordingly, the Court of Appeal's decision in Philipp did not provide a legal basis for the incremental development of an equivalent retrieval duty owed to a party with whom the bank had no contractual relationship.

Retrieval duty owed to a non-customer of the bank: novel duty of care

The court proceeded to consider whether the retrieval duty should be recognised in the novel situation where there was no contractual relationship between the bank and the third-party victim.

The court noted that the question of whether a receiving bank in these circumstances can be taken to have assumed any responsibility to the third-party victim of the fraud was considered in Royal Bank of Scotland International Ltd (Respondent) v JP SPC 4 [2022] UKPC 18 (referred to as RBSI, see our blog post). In RBSI, the Privy Council found that a receiving bank did not owe a Quincecare duty to a third party. While the court noted that a duty of retrieval was not discussed in RBSI, no other material distinction between the factual situation of the present case and RBSI was identified. Accordingly, there was no assumption of responsibility such as to give rise to a duty of care to a non-customer of the bank.

The court referred the case of Larsson v Revolut Ltd [2024] EWHC 1287 (Ch) (see our blog post), in which the court carried out the analysis of whether a novel duty of care should be recognised in similar circumstances. Larsson was another APP fraud case, in which the victim of the APP fraud also happened to be a customer of the receiving bank. Acknowledging that the recipient bank would generally not owe a duty to a third party (such a duty being precluded by RBSI), the claimant argued that the position was different given the separate contractual relationship, and that the receiving bank therefore owed a Quincecare duty.

With reference to the court's decision in Larsson and applying the test from Caparo Industries plc v Dickman [1990] 2 AC 605 (foreseeability, proximity, and fairness, justice and reasonableness), the court made the following findings in the present case:

• The court in Larsson found that no duty arose simply because the payee happened to be a customer of the receiving bank - the payment was unconnected with the banker-customer relationship, and so any proximity that would otherwise exist between the receiving bank and Mr Larsson as its customer was irrelevant. In the present case, the court found that the same analysis applied. Although Larsson concerned an argument founded on a Quincecare type duty, the same points would apply to any attempt to extend an arguable retrieval duty (as allowed in Philipp) to third parties such as CCP.
• Even if it was assumed that a bank in the Second Defendant's position might reasonably foresee harm to innocent third parties once alerted to the fact that one of its accounts had been used by fraudsters, it had no relationship with such a third party to give rise to the necessary quality of proximity. 
• On the question whether it would be fair, just and reasonable for a duty of care to be imposed on the Second Defendant in these circumstances, the court referred to Larsson and RBSI, which have already found that this would not  be the case in respect of a potential third-party Quincecare duty claim. The court did not think a different conclusion could sensibly be reached in relation to a potential duty of retrieval said to be owed to non-customer third parties. Further, in the court's view, to imply such a duty would cross the line between the proper role of the courts and that of the legislator and regulator.

Reiterating Lord Leggatt's point in Philipp about redress for fraud loss being a "social policy" question for regulators, government and parliamentarians (of course now addressed by way of the statutory APP fraud reimbursement scheme – see our blog post), the court also commented on the preceding voluntary scheme, helpfully finding that:

"the fact that banks are willing to take steps to try to assist victims of fraud does not mean that the courts should find they have a legal obligation to do so."

Taking all of the above into account, the High Court found that there was no proper basis for considering that the claim could have any realistic prospect of success.

Factual timeline

On the facts of the case, the court noted that the money was removed from the account before the Second Defendant was alerted to a possible fraud. The timeline contrasted with Philipp, where there was a delay between the bank being alerted to the fraud by Mrs Philipp, and attempts to recall the payments. The High Court commented that it was "hard to see that CCP's claim could ever have been anything more than fanciful".

Accordingly, the court was satisfied that the Master erred in dismissing the Second Defendant's application for strike out/summary judgment in respect of the claim based on a duty of retrieval, and allowed the bank's appeal.