See also, APP Fraud: Robbing the banks? a seminar by Emily Saunderson & Simon Oakes 

The Supreme Court decision of Philipp v Barclays [1] dealt a blow to victims of Authorised Push Payment fraud who seek recompense from their banks. The Quincecare [2] duty is not engaged in such cases. Three recent cases consider other ways in which victims might obtain redress, including via a freestanding ‘retrieval duty’ and restitutionary claims. 

But is that duty all it seems? And should banks start to worry about unjust enrichment claims?

Philipp v Barclays

Where a customer gives its bank an unequivocal instruction to make a payment, the bank must usually action it unless it is unlawful. The fact that the payment instruction was induced by fraud does not by itself invalidate the payment instruction or give rise to a claim against the bank.

The Supreme Court decided that the so-called Quincecare duty is simply a facet of agency law. A dishonest agent will lack actual authority from their principal to give the payment instruction, though may still in dealings with a 3rd party bind their principal provided there is apparent authority which the third party has reasonably relied upon. But if there are reasonable grounds for believing that a payment instruction given by an agent is an attempt to defraud the principal (i.e. the customer), and if the bank executes the instruction without making inquiries to verify that the instruction has actually been authorised by the customer, then apparent authority is lost. The bank will therefore have exceeded its authority in debiting the customer’s account, which transaction will not bind the customer. The bank will also be in breach of its duty to interpret, ascertain and act in accordance with its customer's instructions. 

None of that helps the customer who has been the victim of APP fraud, since the validity of their payment instruction is not in doubt. They must seek alternative routes.

A retrieval duty?

In CCP Graduate v Natwest & Santander [3], there was a mismatch in CHAPS payment instructions between the unique identifiers (which, because of the fraud, mistakenly gave the account number and sort code of the fraudster’s account at Santander), and the payee name (which correctly identified the intended recipient, a subsidiary of JPMorgan). 

Master Brown considered it at least arguable that a bank has a tortious duty to attempt the retrieval and/or freezing of a payment tainted by APP fraud. Because it is tortious, it is potentially owed by banks receiving the payment, as well as those making it. The source of the duty is said to be paragraph 118 of Philipp v Barclays: Lord Leggatt said that when Mrs Philipp reported the fraud to her bank, the bank should arguably have sought her instructions, which would surely have been to take all available steps to recover the payment. He did not, however, explain why the bank should have done so.

If a duty exists it is surely founded in contract, not tort. A bank’s primary duty is to act on its customer’s instruction promptly, without concerning itself with the wisdom or risks of the customer's decision. At paragraphs 35 and 36 of Philipp, Lord Leggatt explained that the bank’s duty to exercise reasonable care and skill only applied where there is some ‘latitude’ in how the services are carried out, such as where a customer’s instruction leaves it unclear what the bank is being instructed to do. 

This must be the underpinning of any ‘retrieval duty’: when Mrs Philipp informed Barclays that she had been a victim of fraud, that must have been an implicit but unclear instruction to reverse her previous payment instruction. Accordingly, Barclays had to interpret, ascertain and implement that instruction with reasonable care and skill, which, at least arguably, required it to seek the recall of the payments. 

If that is correct, it is a contractual obligation. Therefore, although there may be a duty for a paying bank to attempt the recall of its customer’s payment, it surely cannot be owed by any recipient bank, which has no contractual relationship with the victim. 

Notwithstanding Master Brown’s obiter comments [4], claimants may therefore look for other ‘latitude’ situations, such as payment instructions containing conflicting or mismatched information [5].

Unjust enrichment

Terna v Revolut [6] saw the transfer of €700,000, because of a fake invoice scam, to an account held at Revolut. The funds were quickly dissipated. 

International payments are made via a system of crediting and debiting accounts that paying and receiving banks hold with one another or via intermediary correspondent banks. After summarising that system, HHJ Matthews was convinced that Tecnimont Arabia v Natwest [7] was wrongly decided, and that the enrichment was arguably ‘at the expense of’ the original customer despite the intervening chain of bank credits and debits. These, he held, were indirect transfers of value: either by the correspondent banks acting as agents, or as a series of co-ordinated transactions. 

HHJ Matthews also waded into the debate as to whether a recipient bank is itself ‘enriched’ when it receives funds which it then owns beneficially, and credits its customer’s account but owes the customer a corresponding debt. Preferring the reasoning of Marcus Smith J [8] to that of Sales J [9] (now Lord Sales), the judge thought that the real question is whether the bank as agent has a legal excuse for disobeying the instructions of its customer/principal to make payment elsewhere. Referring to older authorities, the judge found that the bank's status as debtor of the customer is not an answer to the enrichment claim, unless and until it is proved that the bank has paid away the money in accordance with its customer's instructions, without notice of the payer's claim. That analysis was recently endorsed by Deputy Judge Richard Farnhill in D'Aloia v Persons Unknown [9], who considered that a cryptocurrency exchange was enriched at the point of receipt. 

Permission has been granted to appeal both of HHJ Matthews’ findings.

If HHJ Matthews is correct, it will put the burden on banks to establish, as part of their defence of ministerial receipt/good faith change of position, the extent to which they were on notice.

That burden could be challenging for banks to discharge. Good faith can require a person to have made inquiries where they had reason to believe a payment was made by mistake  or because of fraud. There must either be something that a defendant actually knows which calls for inquiry, or, importantly, that he would have known “if he had a reasonable appreciation of the meaning of the information in his hands” [12]. If there are features of the transaction which, if left unexplained, are indicative of wrongdoing, an explanation must be sought before it can be assumed that there is none. 

This could easily put banks in the crosshairs, given the sophistication of their systems and the resulting information in their hands: D'Aloia at paragraphs 311 and 327. Unjust enrichment claims therefore merit serious further consideration. Disclosure and expert evidence will be pivotal. 

Dishonest Assistance

In Larsson v Revolut [13], Mr Larsson was induced to SWIFT transfer funds from his UBS account to five Revolut accounts opened by fraudsters purportedly for his benefit. It was alleged that Revolut breached duties to Mr Larsson to implement and operate adequate fraud-prevention systems. Zacaroli J summarily dismissed the claim that such a duty might, simply because Mr Larsson happened to also hold an account at Revolut, arise contractually. The judge likewise rejected a novel, freestanding tortious duty based on Caparo v Dickman factors. 

The claim that Revolut dishonestly assisted in a breach of trust, however, survives for now. Although controversial [14], it is at least arguable following Westdeutsche Landesbank [15] that a transfer of funds procured by fraud will constitute trust property. The judge has given Mr Larsson a chance to better particularise his claim, beyond the allegation that Revolut was dishonest because of wilful blindness to red flags about the normative validity of the transactions. Nevertheless, finding a Revolut employee with the requisite level of dishonesty will doubtless be difficult, even if the constructive trust and assistance aspects can be made out. 

The future

Further arguments worth exploring include a potential assumption of responsibility by signatory banks to the 2019 Contingent Repayment Model, or claims by private persons under s.138D Financial Services and Markets Act 2000 for breach of FCA Handbook Rules. 

When refusing Quincecare protection to APP fraud victims, the Supreme Court was apparently influenced by the imminence of regulatory protection, in the form of the Payment Systems Regulator’s Mandatory Reimbursement Scheme. That scheme took effect on 7 October 2024, albeit with lesser protections than once heralded, including a claim cap of £85,000. The scheme will not avail most companies, or meet the 10% (by value) of losses which exceed the cap. Nor will it apply to non-domestic payments or cover older claims. 

There is therefore a significant lacuna where victims will remain unprotected unless the courts come to their aid. This will probably require striking facts in hard cases. But that it is far from impossible. 

[1] Philipp v Barclays [2023] UKSC 25
[2] Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363
[3] CCP Graduate v Natwest & Santander [2024] EWHC 581 (KB)
[4] Judgment at paragraphs 26 – 31
[5] Depending on the banking terms and conditions, and the applicability of Tidal Energy v Bank of Scotland [2014] EWCA Civ 1107
[6] Terna Energy Trading doo v Revolut Ltd [2024] EWHC 1419 (Comm)
[7] Tecnimont Arabia Ltd v National Westminster Bank plc [2023] Bus LR 106
[8] High Commissioner for Pakistan in the United Kingdom v Prince Muffakham Jah [2020] Ch 421
[9] Jeremy D Stone v NatWest [2013] EWHC 208 (Ch)
[10] Fabrizio D'Aloia v Persons Unknown Category A & Others [2024] EWHC 2342 (Ch) at paragraph 267
[11] Per Clarke LJ in Niru Battery Manufacturing Co v Milestone Trading Ltd [2003] EWCA Civ 1446
[12] Per Lord Sumption in Papadimitriou v Crèdit Agricole Corpn [2015] UKPC 13: “if there are features of the transaction such that if left unexplained they are indicative of wrongdoing, then an explanation must be sought before it can be assumed that there is none”
[13] Larsson v Revolut [2024] EWHC 1287 (Ch)
[14] Shalson v Russo [2003] EWHC 1637 (Ch) and Re D&D Wines International Ltd [2016] UKSC 47
[15] Westdeutsche Landesbank Girozentrale v London Borough of Islington [1996] AC 668