The landscape in APP fraud litigation continues to shift. For many years, victims of APP fraud rarely succeeded in claims against banks. But the tide appeared to shift in 2024, as strike out applications from banks were unsuccessful in three separate cases (see: Terna Energy DOO v Revolut Ltd [2024] EWHC 1419 (Comm); Larsson v Revolut [2024] EWHC 1287 (Ch); CCP Graduate School Ltd v National Westminster Bank Plc [2024] EWHC 581 (KB).
In one of these cases, CCP Graduate School Ltd v National Westminster Bank Plc, Master Brown refused to strike out the claim, on the basis there was an arguable case that the bank owed a duty to the victim (who was not a customer) to try and recover the stolen funds.
This decision has now been overturned. On appeal, Mrs Justice Eady held there is no free-standing duty upon a bank to retrieve funds lost by a third party with whom it had no contractual relationships. Importantly, however, this decision does not change the position in respect of a (potential) duty upon banks to recover funds lost by its customers, which remains untested.
Background
CCP Graduate School Ltd (“CCP”) was the victim of an APP fraud. As part of the fraud, its director was induced to make 15 payments from a NatWest account into an account held by Santander (“the recipient account”). These payments occurred between 13 September and 12 October 2016 and totalled £415,909.67. By close of business on 20 October 2016, just £5.39 remained in CCP’s NatWest account.
There was some uncertainty about when exactly CCP alerted the fraud to NatWest. CCP said it called NatWest on 21 October 2016; NatWest said it received no alert until 22 October 2016. In any event, Santander had received a fraud alert from Lloyds Banking Group on 21 October and placed a stop on the recipientaccount at 10:17am that day.
CCP sought damages against both NatWest and Santander. Against NatWest, CCP argued that the bank owed a contractual and/or tortious duty not to execute payments without taking steps to ensure that it was not an attempt to defraud (see: Barclays Bank -v- Quincecare Ltd [1992] 4 All ER 363). Against Santander, CCP contended that, by allowing the payments to made out of the recipient account, Santander had breached its tortious duties, including a “duty of retrieval”.
Both banks applied for ‘reverse’ summary judgment, which was heard by Master Brown on 16 July 2023.
Master Brown’s Ruling
Master Brown dismissed the claim against NatWest in its entirety. As for the claim against Santander, Master Brown refused to strike out the part of the claim based on a potential retrieval duty, stating (at [80]):
‘Whether or not it could be described as a developing area of law, there is to my mind some uncertainty as to whether any such duty lies on the bank of those who can be assumed to have perpetrated the fraud.’
Santander appealed Master Brown’s ruling. It argued that it was an error of law to find it arguable that Santander owed a duty of care to CCP (with whom it had no relationship) to take reasonable steps to retrieve sums paid out to the fraudsters.
Mrs Justice Eady’s Decision
Santander provided no fewer than eight grounds of appeal:
- As a matter of law, it was wrong to hold that “it is not necessarily fatal to the claim that there may have been no assumption of responsibility” by Santander to CCP; an assumption of duty was a necessary element of a tortious claim for pure economic loss.
- The Master erred in drawing an analogy with HXA v Surrey: first, because that decision was concerned with the existence of a duty to prevent, not rectify, harm, which was not this case; second, because he had failed to identify any status on the part of Santander that created an obligation to protect CCP from the relevant danger.
- Failing to recognise that an alleged duty to retrieve fell outside the existing established categories of tortious liabilities, the Master had applied an incorrect test for the incremental development of duties in tort; applying the right test could only have led to the conclusion that there was no realistic prospect of CCP establishing a duty of care.
- It was, further, an error of law to find that Santander owed a duty to the customer of the paying bank (NatWest) to take reasonable steps to retrieve the payments, when that was inconsistent with the Master’s earlier (correct) finding that Santander had no prior (Quincecare) duty to stop payments leaving the account.
- The Master erred in his understanding of the decision in Philipp, confusing the legal relationship between a bank and its customer on the one hand, and a bank and a third party customer of a different bank on the other.
- It was also a mistake in law to fail to give due weight to the finding in Philipp (at [117]) that a bank cannot countermand its customer’s instructions, to whom it owes a strict and overriding duty. As a consequence, the Master wrongly found the alleged duty to be arguable even though it would put a bank in a position of inherent conflict with its customer.
- The Master had, further, erred in misdirecting himself as to the proper role of the courts (see Philipp at [6]).
- A further error arose in relation to the nature and extent of CCP’s claim, which could (at most) be a claim for loss of a chance.
In response to these grounds of appeal, CCP argued that:
- It was possible for a duty of care to arise in tort even where there was no assumption of responsibility; in Donoghue v Stevenson [1932] AC 562 at 564, a duty of care was held to exist, notwithstanding the absence of a contractual relationship, where “(1) the article is dangerous per se, and (2) where the article is dangerous to the knowledge of the manufacturer”. In the present case the danger was Santander’s customer and the report made to Santander put it on notice of this. In relation to the recovery of pure economic loss, the law had developed so as to apply to other situations where there was no contractual relationship (see e.g. Spartan Steel v Martin & Co [1973] QB 27 at 28), provided three factors existed (per Caparo Industries v Dickman [1990] 2 AC 605 at 609): (i) a sufficient degree of proximity, (ii) relevant knowledge, and (iii) it would be fair, just and reasonable to impose liability.
- There was no error in drawing an analogy with HXA v Surrey: as the holder of the funds, Santander had special control; once informed of the fraud, Santander should have retrieved the funds from the fraudsters to prevent harm to CCP. The Privy Council decision in RBSI was not binding on the Master and did not address the responsibility of a bank when fraud was reported.
- The retrieval duty owed to customers (per Philipp) was not restricted to issuing banks; it fell squarely into the category of being (i) a coherent and incremental development from existing categories of case where a duty has been recognised, (ii) analogous with such proximate categories, (iii) one which avoided inappropriate distinctions, (iv) consistent with existing legal obligations in overlapping or proximate areas, and (v) just, fair and reasonable.
- Such a duty did not contradict the finding that Santander had no prior duty to stop the payments leaving the account; rather, it recognised that the retrieval duty was engaged once evidence of the fraud has been revealed or provided to the bank. The retrieval duty was triggered by a different set of facts and at a different stage in the transaction process; it was not grounded in the prevention of harm but in the rectification of a wrong that had already occurred.
- The decision in Philipp did not restrict the retrieval duty to the contractual relationship between the customer and its bank; there was no reason why this duty should not extend to a bank and a third party where the bank was in control of their funds. The Master’s analysis provided a judicial attempt to apply the principles set out in Philipp, key to which were the notification and the availability of funds if reasonable steps were taken upon notification.
- As noted by Birss LJ at [27] of the Court of Appeal decision in Philipp v Barclays UK plc [2022] EWCA Civ 318, it is possible for duties to co-exist; where a receiving bank is told its customer is acting fraudulently, no conflict exists: it must act to prevent the promulgation of that fraud by taking steps to retrieve the money paid out of the customer’s account to other receiving banks.
- More generally, the court’s common law function in the development of tortious duties was available in this case: the Supreme Court had already identified a retrieval duty, which was not restricted to issuing banks alone.
- As for the nature of CCP’s claim, it was accepted that this was put as a loss of a chance.
No Duty to Retrieve
Eady J began her analysis with a comprehensive review of the Supreme Court’s decision in Philipp v Barclays Bank, which similarly involved an APP fraud, albeit the claim was brought against the victim’s own bank. In that case, the victim alleged, inter alia, that the bank had failed to take sufficient steps to recover the stolen funds.
In Philipp, the judge at first instance held that it was untenable to suggest that Barclays should have taken steps to recall the payments before the victim had raised the alarm. Beyond that, however, the judge considered that there were “too many imponderables in this counterfactual scenario for the matter to be decided … on paper” (at [119]).
In the Supreme Court, Lord Leggatt commented that that judge’s conclusion regarding the period before the victim had raised the alarm was “undoubtedly correct”, reversing the Court of Appeal’s decision on that point. However, as to whether the duty arose after the victim raised the alarm, Lord Leggatt said it was arguable that, when the victim reported that she had been induced to make the payments by fraud, the bank’s staff should have sought her instructions. If it had, the victim would have undoubtedly instructed the bank to take any available steps to recover the money. So the Supreme Court did permit the claim to be advanced on that narrower, alternative basis.
Eady J observed that the potential duty of care relied upon by CCP would be an extension of the duty owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions (Philipp at [97]). This is a duty arising from the contractual obligation owed by a bank to exercise reasonable skill and care – when notified of a potential fraud by its customer, the bank arguably has a duty to obtain that customer’s instructions as to whether it should take steps to recover previously authorised payments out of the customer’s account.
Her Ladyship went on to say at [39]:
… Akin to the Quincecare duty, this potential extension of the obligation owed by a bank in such circumstances is similarly no more than a facet of its contractual duty to properly ascertain and comply with its customer’s instruction. Relying on this part of the judgment in Philipp, however, the Master considered it arguable that a duty of retrieval might nevertheless arise in relation to a receiving bank, which had no contractual relationship with the victim of the fraud (at [39]).
In Philipp, the victim was the bank’s customer and the victim had notified the bank of the alleged fraud. In the present case, neither facts were present. With this in mind, Eady J concluded that Philipp provided no basis for a “freestanding duty upon a bank to take positive steps to unwind harm already caused to a third party (with whom it had no contractual relationship) by attempting to reverse payment orders previously entirely properly made on the instructions of its own customer” (at [40]).
Eady J noted that, if accepted, CCP’s position would lead to undesirable consequences. Upon a fraud alert being raised in relation to an account held by one of its customers, a bank would be required to contact all other banks into which monies from the account have been transferred, and (contrary to the instructions of its customer) either seek an immediate recall of those sums or otherwise not allow further movements of those monies (at [47]). According to Eady J, this would put a bank in the “impossible position” of having to make a speedy adjudication upon an allegation of fraud made against one its own customers by a third party (at [47]).
Conclusion
Ultimately, Eady J commented that, given that the money had been removed from the recipient account before Santander was alerted to a possible fraud, it is hard to see that CCP’s claim could ever have been “anything more than fanciful” (at [50]).
As a matter of law, Eady J failed to see “any proper basis for considering that the claim could have any realistic prospect of success” (at [51]). For this reason, the appeal was allowed and Santander’s application for strike out/summary judgment was granted.
This decision confirmed that, in cases of APP fraud, recipient banks do not have a duty to retrieve funds lost by a third-party victim, with whom it has no contractual relationship.
The next development in APP fraud appears to be Terna Energy Trading v Revolut Ltd [2024] EWHC 1419 (Comm), which involves a claim of unjust enrichment. HHJ Matthews dismissed Revolut’s strike out application and Revolut has been granted permission to appeal.
If you’ve been a victim of fraud, or you’d like more information, please contact enquiries@emmlegal.com.
