4 | Creative thinking in payments claims

Claims continue to test the boundaries of when banks will be held liable in relation to fraudulent payments.

In the wake of the Supreme Court’s 2023 decision in Philipp v Barclays[1] – which effectively held that processing payment instructions from victims of ‘authorised push payment’ (APP) fraud will not constitute a breach of the bank’s duties to its customer – claimants have sought novel routes to recovery against the banks and payment service providers (PSPs) involved.

In Hamblin & Anor v Moorwand[2], the victims of an APP fraud brought a derivative action on behalf of the company to which their funds had been paid against that company’s PSP, alleging breach of the Quincecare duty. The fraudster had incorporated the company using the stolen identity of a real, innocent individual. The claimants were granted permission by the judge at first instance to bring the derivative action against the PSP. However, the judge found that the PSP had had not been “put on inquiry” under its Quincecare duty to investigate the validity of its customer’s instructions. The claim was dismissed and the claimants appealed. On appeal (which did not include any appeal of the judge’s decision to grant permission to bring the derivative claim), the High Court found that the PSP ignored several “red flags” during the account opening process and in the subsequent transaction activity and that it had failed to make necessary inquiries whether the payment instructions were actually authorised by its customer, thus breaching its Quincecare duty in paying away the sums in question. Consequently, the PSP was ordered to restore the funds to the company’s account. Permission to appeal has been sought, but Hamblin may signal a potential route for redress in cases where the proceeds of the fraud are transferred into a shell company, a common feature of APP frauds.

In Dawn Barclay-Ross v Starling Bank Limited[3] the court declined to strike out a claim on the basis that there was at least an arguable claim that the bank had breached its contractual and tortious duties to execute its mandate with due care and skill by failing to seek the customer’s instructions to recover the money paid from their accounts once it was notified that the payment had been induced by fraud – a possibility expressly left open by the Supreme Court in Philipp v Barclays.

However, in Santander v CCP Graduate School Ltd[4] the High Court held that a receiving bank did not owe a “duty of retrieval” to a non-customer fraud victim – emphasising that Santander’s primary obligation was to comply with its own customer’s instructions. The fact that the fraudster held an account with Santander did not mean the bank had any control over the fraudster or create a special relationship with the victim of the fraud. The Court drew a clear distinction between a bank’s duties to its own customers and any suggested duty to third parties. While, as noted above, the Supreme Court in Philipp recognised an arguable duty of retrieval when alerted by its customer, that duty was rooted in the contractual relationship between the bank and its customer. In contrast, the victim had no contractual relationship with Santander, and imposing a comparable duty toward a third party would represent an unprecedented expansion of the law.

In the absence of a contractual relationship with the receiving bank, some victims have instead focussed on restitutionary claims. The High Court in Terna v Revolut[5] refused to strike out a claim in unjust enrichment arising from an APP fraud. The High Court rejected Revolut’s arguments that it had not been enriched because the incoming funds would have been offset by a liability to its customer, the fraudster, and that it had not been enriched at Terna’s expense. On the second of these, the Court departed from the earlier High Court decision in Tecnimont Arabia Ltd v National Westminster Bank plc[6] on grounds that it had wrongly applied the Supreme Court’s test to establish whether a defendant has been unjustly enriched at the expense of a claimant in Investment Trust Companies v HMRC[7]. The Court concluded that Terna’s claim in unjust enrichment had reasonable prospects of success and could proceed to trial. Revolut was granted permission to appeal the decision but subsequently withdrew its appeal. The High Court trial is expected in Q1 of 2026.

Meanwhile, the UK’s mandatory reimbursement scheme for APP fraud, introduced in October 2024, now provides automatic redress in qualifying cases. The scheme applies to consumers, micro-enterprises and small charities, with reimbursement capped at £85,000 per claim and excluding international transfers. Many victims, including most corporate customers, remain outside its scope and must therefore continue to rely on developing case law. The decisions in Hamblin and Terna offer grounds for cautious optimism in that respect.

The courts continue to leave open the possibility for banks to be held liable to corporate customers for fraudulent payments where they are on notice that the agent requesting the payment (normally a director or employee) may be attempting to defraud the company and process the payment without confirming the instruction with the customer – commonly referred to as the ‘Quincecare’ duty. In Arena Television Ltd[8], the court refused the banks’ applications to strike out such claims on the basis that the claimants’ articles of association conferred actual authority on a director to conduct dishonest business on behalf of the company – seeking to distinguish frauds by the company (for which they contended that the claimants’ agents had actual authority) from frauds on the company (which they accepted the agents did not). However, the question remains live as to whether such a distinction can be drawn, with the court declining to make a binding decision at the summary judgment stage.