The Supreme Court last year closed the door on claims against banks that receive clear instructions from their customers to transfer funds, even though those customers are the victims of an APP frauds (Philipp v Barclays Bank [203] UKSC 25). Where a bank’s customer is the victim of an APP fraud, the bank’s duty to exercise reasonable skill and care is not engaged unless there are doubts as to the validity of the customer’s instruction. That marked the end of the so-called Quincecare duty claims against the paying bank.
Nonetheless, a recent case saw the emergence of a new type of claim being advanced by APP fraud victims (CCP Graduate School Limited v National Westminster Bank plc [2024] EWHC 581) based on a retrieval duty.
By way of reminder:
- the APP fraud victim will hold an account with the paying bank. As a result of the fraud, the victim typically gives a clear instruction to the paying bank to pay funds to the fraudster’s account at the receiving bank. Usually, the fraudster will transfer the funds from the receiving bank to a different bank as soon as possible.
- the APP fraud victim is therefore only in a contractual relationship with the paying bank (customer/bank).
- however, the APP fraud victim is not in any contractual relationship with the receiving bank. Rather, the receiving bank is in a contractual relationship with the fraudster, its customer.
- therefore, the APP fraud victim has no contractual claim against the receiving bank.
- once the APP fraud victim realises that what has happened, they notify the paying bank and receiving bank and the APP fraud victim makes frantic efforts to get either or both to freeze any money that they still hold in the relevant accounts.
The retrieval duty is a duty in law at a certain point to take reasonable steps to retrieve or recover the sums paid out as a result of the APP fraud. That duty may have a contractual basis if made against the paying bank and can only be a claim in tort against the receiving bank (because there is no contractual relationship between the APP fraud victim and the bank). There is some support for the duty in Philipp where the paying bank was apparently slow to take steps to recall payments that it had made.
One practical matter emphasised in the CCP case is that the relevant bank could offer an indemnity to any bank receiving payment against the liability it might incur to its customer (and possibly others) when preventing any further payment out. Against that indemnity, banks are prepared to allow an account to be frozen.
Plainly, banks would be able to avoid any claim based on the retrieval duty if they immediately request the next bank in the chain to freeze the relevant account and provide the relevant indemnity. The risk to the bank only arises if it is slow to make the relevant request and offer.
A claim based on the retrieval duty against the paying bank in CCP only just passed the strikeout test, so although it is legally cogent, it still faces many difficulties before it could survive a trial. A claim based on a duty of retrieval does put an uncomfortable spotlight on the relevant bank where that bank has allowed a fraudster to open an account and been slow to respond to a fraud report.
Toby Gibson
Gibson & Co. Solicitors Limited
8 April 2024