3 | Payment fraud – bankers’ duties under APP-eal

Generative AI has turbocharged the already-rising level of Authorised Push Payment (APP) frauds, in which victims are tricked into sending money to a fraudster impersonating a legitimate payee. It is now mandatory for payment services providers (PSPs) to reimburse certain customers up to £85,000 where they have lost money as a result of an APP fraud. This still leaves many victims, particularly larger businesses or those making international transfers, out of scope. Before and since the introduction of mandatory reimbursement, victims who cannot benefit from a formal scheme have sought to bring common law claims against the fraudsters themselves or the PSPs on either side of the transaction.

There are various familiar legal causes of action that can be pursued against the fraudster. The key difficulty is usually evidential, as fraudsters tend to hide behind fictitious companies, use unwitting ‘mule’ accounts or be based in jurisdictions where investigation and enforcement is challenging.

These difficulties have encouraged claimant lawyers to seek to hold PSPs liable instead, often using creative causes of action. In June this year, the Court of Appeal heard the appeal against the High Court’ 2025 decision in Hamblin v Moorwand1. This held a PSP liable for breaching the Quincecare2 duty not to make a payment on the instructions of its customer’s agent, where the PSP has reasonable grounds for suspecting that the agent's instructions were fraudulent.

Following the Supreme Court’s 2023 decision in Philipp v Barclays3, an individual customer cannot rely on the Quincecare duty in relation to its own PSP when they authorise the payment, because there is no agent/principal relationship. The novel aspect in Hamblin is that the victims brought a derivative claim in the name of the holder of the recipient account into which they originally (and mistakenly, induced by an APP fraud) paid their money. The recipient account holder was a now insolvent company (RND). The fraudster had impersonated a director of RND to set up the bank account and, once the victims had paid the money to RND, instructed RND’s PSP to transfer the money beyond recovery.

On appeal to the High Court, Smith J allowed the victims to bring a derivative claim in the name of RND on the basis that the fraudster had no actual authority to instruct RND’s PSP to pay out the funds and the PSP failed to investigate despite being put on inquiry, therefore breaching its Quincecare duty to RND. The PSP was therefore obliged to reinstate the money into RND’s account, where the Claimants could then assert a claim against it. The Court of Appeal gave permission for and heard the PSP’s appeal and judgment is now awaited.

The question of whether a PSP has been put on inquiry is fact and context specific. However the Court of Appeal’s decision on the availability of the derivative claim and possibility of Quincecare duties being owed to companies in the position of RND will have much wider consequences, either confirming or closing off a potentially attractive route to redress for victims where, as is frequently the case, the first payment is made into the account of a front company.

Whatever the outcome of Hamblin, other common law remedies may remain available. Following the discontinuance and settlement of claims brought against Starling Bank and Revolut, questions remain open as to:

• whether a PSP can breach its contractual and tortious duties to execute its mandate with due care and skill by failing to seek the customer’s instructions to recover the money paid from their accounts, once the bank was notified that the payment had been induced by fraud (often referred to as the “retrieval duty”), and
• the circumstances in which victims of APP fraud can alternatively obtain redress through claims in restitution.

Both fraud victims and PSPs would welcome claims on both points progressing to trial to provide much-needed clarity on the scope of PSPs’ duties and the circumstances in which compensation should be provided.