APP fraud: testing the limits of recovery

The recent High Court judgments in Santander v CCP Graduate School Ltd and Hamblin & Ors v Moorwand & Ors add new dimensions to the evolving legal landscape surrounding banks/PSPs' responsibilities in preventing fraud and recovering stolen funds. They reinforce the principle that receiving institutions have limited obligations to non-customers, even when those parties fall victim to sophisticated payment fraud schemes, and stretch the limits of Philipp v Barclays.    

The Quincecare duty

Banks and payment service providers (PSPs) have a significant legal obligation known as the Quincecare duty, which was established in the landmark case of Quincecare Limited v Barclays Bank [1992] 4 All ER 363. This duty requires banks/PSPs to remain vigilant and to pause payment instructions given by an agent of their customer when there are reasonable grounds to believe that the agent is attempting to defraud the customer. For instance, when a company director issues payment instructions that appear to defraud their own organisation, banks/PSPs must intervene instead of automatically processing the transaction.   

This principle has become increasingly important in recent years, with several high-profile legal cases clarifying its scope and application.   

Recent developments

In July 2023, the Supreme Court delivered a significant judgment in Philipp v Barclays [2023] UKSC 25, where it determined that the Quincecare duty does not extend to cases of Authorised Push Payment (APP) fraud, where customers themselves are deceived into authorising payments. However, the Supreme Court left open the possibility of a separate "retrieval duty" – an obligation for banks/PSPs to take reasonable steps to recover fraudulently transferred funds once notified of such fraud (see our article).

In December 2024, the Court of Appeal reinforced the limits on bank liability by refusing permission to appeal in Larsson v Revolut Ltd [2024] EWHC 1287 (Ch) (see our summary).

The Larsson case involved the partial strikeout of claims against Revolut Ltd, an electronic money institution acting as the receiving PSP in an APP fraud scenario. The High Court's judgment established several key points:

• A receiving bank does not owe a duty to the payer or victim of fraud to ensure that funds are sent solely to the beneficiary specified in the payer’s instructions (as determined in Abou-Rahmah v Abacha [2005] EWHC 2662 (QB)).
• The Quincecare duty does not extend to third parties. There is no equivalent duty of care owed to a third party who is not a customer of the bank and with whom the bank lacks a contractual relationship (as seen in Royal Bank of Scotland International Ltd v JP SPC 4 & Anor [2022] UKPC 18).
• The fact that the fraud victim was also a customer of the same PSP did not create a duty of care. The court explicitly rejected this notion, asserting that there is no principled basis for developing the law in that direction.

The Santander ruling: no duty to strangers 

In the latest ruling that further clarifies banking responsibilities, the High Court judgment in Santander UK PLC v CCP Graduate School Ltd [2025] EWHC 667 (KB) has confirmed the narrow scope of the "retrieval duty" banks/PSPs owe to fraud victims who are not their customers.

The case began when CCP Graduate School (CCP) fell victim to sophisticated fraud in 2016, transferring £415,000 from their NatWest account to a Santander account controlled by a fraudster. By the time CCP raised the alarm, the money had already vanished from the Santander account.

CCP pursued both banks, arguing that NatWest had breached its Quincecare duty, while Santander had failed in an alleged duty to prevent its accounts being used for fraud. Following the Philipp decision, CCP amended its pleadings to include a claim that both banks had breached a "retrieval duty" to recover the stolen funds. In response, Santander filed for summary dismissal or to strike out the claims. The High Court ruled on this matter in April 2024.    

Initial ruling

Regarding NatWest (the sending bank):

• Quincecare duty: the Master concluded that the claim was statute-barred, but that, in any case, the Quincecare duty does not apply to APP fraud cases.
• Retrieval duty: while dismissing the claims against NatWest as statute-barred, the Master remarked that he would have allowed the claim to proceed if he had discretion. This was due to uncertainty about whether NatWest took appropriate and timely retrieval steps. He noted:

"[...] the most obvious step, if not the principal step, that could be taken by a bank which is on notice of a fraudulent scheme such as the one alleged here, is to offer an indemnity to the bank receiving payment. Such an indemnity, I am told by counsel, is against liability which the receiving bank might incur to its customer (and, possibly, others) when preventing any further payment out and as I understand it, allows the account to be effectively frozen."

Regarding Santander (the receiving bank):

• Quincecare duty: the Master concluded there could be no Quincecare-type duty for Santander as it "would be inconsistent with the contractual duty to effect any mandate made by their customer" (ie, the fraudster).
• Retrieval duty: despite no contractual duty existing (since CCP wasn’t Santander’s customer), the Master held that a tortious duty might arise because Santander had some control over payments from the criminal's account. This potentially placed it in a special position to recover funds. Thus, the Master declined to summarily dismiss the retrieval duty claim against the receiving bank.

Santander's successful appeal

Santander appealed this decision, arguing it was an error of law to find it arguable that it owed a retrieval duty to CCP, with whom it had no relationship.

On 25 March 2025, the High Court rejected the concept of a retrieval duty for receiving banks and struck out CCP's claim against Santander entirely.

Mrs Justice Eady determined that no tortious duty could arise in this case for several compelling reasons:

• Santander did not have a 'special level of control' over the account sufficient to establish a tortious duty. Having a fraudster as a customer did not create obligations to protect potential victims. In fact, the bank's primary obligation was to comply with its customer's instructions.
• Lord Leggatt's comments in Philipp about a potential "retrieval duty" referred only to a bank's obligations to its own customers, not to third parties.
• When considering whether a duty of care should be recognised in a novel situation, the court must take an incremental approach and apply the "Caparo factors": foreseeability, proximity and fairness, justice and reasonableness. Mrs Justice Eady concluded that the Caparo factors were not satisfied and found no basis for developing the law in this direction. She determined that, although Santander might have foreseen harm to third parties, it lacked the necessary proximity to CCP to justify imposing such a duty.
• Finally, the Court noted the practical impossibility of complying with a retrieval duty, which "would put a bank in the impossible position of having to make a speedy adjudication upon an allegation of fraud made against one of its customers by a third party". She held that this would be an "unacceptable burden" beyond the bank's contractual obligations.

The Court expressly acknowledged the challenging balance between payment speed and fraud protection, referencing a new mandatory reimbursement scheme established under the Financial Services and Markets Act 2023. This scheme, effective from 7 October 2024, enables victims of APP fraud to seek reimbursement of up to £85,000 where the relevant payment is made through CHAPS or the Faster Payments System offering an alternative (though limited) solution to the growing problem. Crucially, reimbursement under the scheme only applies where the payment is both executed in the UK and received into a relevant account in the UK and is only available to individuals, and microenterprises and charities that fall within the thresholds set in the APP fraud reimbursement rules.

Hamblin: a creative claim and certainly uncertain

Background

In Hamblin and another v Moorwand Ltd and another [2025] EWHC 817 (Ch), Mr and Mrs Hamblin brought a claim based on the Quincecare duty after they made a payment of £160,000 to an account in the name of a director of RND Global Ltd at Moorwand Ltd, an Electronic Money Institution (EMI) authorised and regulated by the Financial Conduct Authority. Little did the Hamblins know that the account was being operated by fraudsters. Upon the eventual instruction of the fraudsters, the funds were transferred out of RND's electronic wallet by Moorwand.

In proceedings against RND and Moorwand, the Hamblins argued that "Moorwand owed a duty of care, in contract and/or tort and/or agency, to take reasonable skill and care not to execute a payment instruction in circumstances when Moorwand was put on inquiry that the payments were not duly authorised by RND". As such, the Hamblins argued, Moorwand breached its mandate.

First instance

Although at first instance it was found that Moorwand had not been put on inquiry, the Hamblins were permitted to pursue a derivative action on behalf of RND against Moorwand. The Hamblins appealed.

Appeal

On appeal, the High Court found that Moorwand was on inquiry and should have verified the payment instructions that were made on RND's behalf. As part of its reasoning, the High Court found that the judge at first instance wrongly discounted a number of factors, which went to the question of whether Moorwand had been put on inquiry, including: "(i) whether RND's trading was consistent with that described on the opening of the account and (ii) whether an authorised agent was acting for RND at all were central to the essential Quincecare question of whether Moorwand had been put on inquiry." Moorwand was consequently ordered to restore the £160,000 to RND's electronic wallet.

For the purposes of regulation and common law, the High Court noted that the Quincecare duty would apply to an EMI as it does to a bank.

Practical implications for banks/PSPs: safeguarding your institution against liability

The Santander judgment will be welcomed by banks/PSPs because it confirms the narrow scope of the "retrieval duty". It also provides useful clarity on banks/PSPs' obligations to payers where those payers fall outside of the scope of the APP fraud reimbursement rules. Future claims are likely to be limited to sending banks/PSPs, rather than receiving banks/PSPs.

However, following Hamblin, derivative actions on similar facts to Hamblin cannot be ruled out.

Banks/PSPs should continue to ensure they understand who their customers are and comply with their obligations to monitor transactions on an ongoing basis. This will assist them in identifying transactions that require further investigation and ensuring customers' accounts are not being used for fraudulent or other improper purposes. Where claimants fall outside of the scope of the APP fraud reimbursement rules, they are likely to continue to raise claims in novel and innovative ways to recover their funds.

Furthermore, Banks/PSPs should also ensure that when they are put on enquiry as to a potential fraud, such potential fraud is properly investigated before payments are executed.

Conclusion

Financial institutions must process high transaction volumes at unprecedented speeds while navigating complex fraud detection responsibilities. The Santander judgment reflects a judicial willingness to acknowledge these operational realities, establishing a pragmatic framework for banking/PSP liability that recognises the practical challenges of modern financial systems.The definitive rejection of a "retrieval duty" for receiving banks/PSPs in Santander means that fraud victims will likely redirect their legal strategies toward sending banks/PSPs, where established customer relationships provide firmer ground for potential claims.

However, the successful use of a derivative action (ie a claim brought by a relevant person in the company's name and on its behalf) in Hamblin may encourage future claimants to launch similar actions where fact patterns are similar.  It is worth noting that, at first instance, the Hamblins were granted permission to utilise this route, which was not appealed by Moorwand. Consequently, the appropriateness of the derivative action was not considered by the Hight Court and the development of this method remains to be seen.

It also remains to be seen how the courts will define sending banks/PSPs' obligations to their customers.

Despite these developments, the Quincecare duty still exists, albeit in a more limited form than what fraud victims had sought. As part of a bank/PSP's general obligation to properly interpret and follow customer instructions, banks/PSPs must still pause transactions and investigate when they put on inquiry or have reasonable grounds to suspect that someone acting as an agent for a customer is attempting to commit fraud.

For expert guidance on how these legal developments impact your organisation or to review your terms and conditions for enhanced protection, contact our specialist team today.