In 2023, financial institutions welcomed the clarity provided by the Supreme Court in Philipp v Barclays Bank UK plc [2023] UKSC 25 (covered here) with regard to the scope of the “Quincecare duty” concerning authorised push payment (APP) fraud matters. In Philipp, the Quincecare duty was held to have no application to a situation where the customer itself had given clear and unequivocal payment instructions to the bank. However, the Supreme Court left open the question of whether a bank had a reasonable duty of care to recover funds that the customer had been fraudulently induced to pay out after being notified by the customer of the APP fraud (i.e. its “retrieval duty”). In its recent decision in CCP Graduate School Ltd v National Westminster Bank plc & Anor [2024] EWHC 581, the High Court has considered the retrieval duty in the context of applications for reverse summary judgment / strike out.

Background

The claimant was induced by fraudsters to authorise payments totalling £415,909.67 from its bank account with the First Defendant to a bank account of PGW Limited held with the Second Defendant, believing that these amounts were being applied towards investments. The payments were made between 13 September and 12 October 2016.

When making these payments, the claimant identified “PGW limited” as the recipient account holder. In fact, the recipient account was held by “PGW Consultants Limited”. However, the prevailing practice was to process payments without looking at the recipient’s account name, and on that basis, the claimant’s payments were completed. After the fraudsters stopped responding to the claimant’s emails and calls, on or around 22 October 2016, it raised a ‘fraud alert’ with the First Defendant, and was informed that a sum of only £5.39 was left in its account. Eventually, £14,000 of the total payments were retrieved via second and third generation banks.

More than six years after the last payment was made, on 18 October 2022, the claimant instituted proceedings against the First Defendant (based on the Quincecare principle) and the Second Defendant (on the basis that the bank breached its duty of care by allowing sums fraudulently transferred to it by the First Defendant to be removed from its account). The First and Second Defendants applied for summary dismissal of the claims.

Before the hearing commenced, the decision in Philipp was handed down by the Supreme Court. This prompted the claimant to file a cross-application to amend its claims, alleging that despite being notified of the APP fraud, both banks breached their retrieval duty by failing to take reasonable steps to recover the sums paid out pursuant to the fraud.

The court’s decision

Claims against the First Defendant

The court found that the claim against the First Defendant was commenced outside the six-year limitation period applicable here. The last payment was made on 12 October 2016, while the claim was only instituted on 18 October 2022. Therefore, the claim was struck out.

Nevertheless, the court also considered whether the claim could be struck out on the basis that after Philipp, the Quincecare duty was not applicable in the case of an APP fraud. The First Defendant argued that the claimant provided clear and valid payment instructions and that its Quincecare duty was not engaged. The claimant countered that the instructions referred to authorising payment to PGW Limited and not PGW Consultants Limited, and that the First Defendant was in breach of its duty by effecting the payment. The court, referring to Phillip, reaffirmed that the bank’s Quincecare duty is not engaged unless there are doubts as to the validity of the customer’s payment instruction. It also referred to the First Defendant’s terms and conditions and was satisfied that the bank was duty-bound to execute payment instructions on the basis of the sort code and account number of the recipient (rather than the account holder’s name).

The claimant’s application to amend the claim on the basis that the First Defendant was in breach of its retrieval duty was not allowed as it was also found to be time barred. However, the Court noted in obiter comments that had the application not been time barred, the Court would have been inclined to allow the amendment. It observed that a bank which is on notice of a fraudulent scheme could take the “most obvious step” of offering an indemnity to the bank receiving payment against liability which the receiving bank might incur to its customers when preventing further payments out. However, if the bank were to do more by, for example, providing an indemnity to other banks further down the payment chain, it could give rise to irregularities and GDPR obstacles.

Claims against the Second Defendant

The court refused to strike out the claim against the Second Defendant as there was money left in the account held by the Second Defendant on 18 October 2016 (the relevant date for the purpose of limitation given that the claim was commenced on 18 October 2022). Steps could still have been taken by the bank on that date to prevent the remaining sums from being paid out.

The claimant alleged that by allowing removal of the money from its account, the Second Defendant had failed in its duty of care. It also alleged that the Second Defendant should have taken steps to retrieve the sums paid out, and once it had notice of the APP fraud, contacted the banks into which the claimant’s money had been transferred to either seek a recall of those payments or warn those banks not to allow further movements of the money.

To the extent that the claim against the Second Defendant was based on the Quincecare duty, it was struck out. The court accepted that the claimant was a third party to the Second Defendant whereas the Quincecare duty was concerned with the bank’s contractual duty to effect any mandate by its own customer (rather than a third party).

However, the court refused to strike out the claim based on the Second Defendant’s retrieval duty. It noted the claimant’s argument that a duty of retrieval was not expressed as a contractual obligation, but rather as a duty in tort. Unsure whether it could describe this as a developing area of law, the court acknowledged an uncertainty as to whether any such duty lies on the bank of the perpetrators of the fraud. A mere lack of assumption of responsibility by the Second Defendant to the claimant was not necessarily fatal to the retrieval duty claim as the bank had a “special level of control over the source of danger” (a phrase borrowed from Lord Burrows’ decision in HXA v Surrey CC [2024] 1 WLR 335). The court noted that the system of retrieval operated by a chain of indemnities (starting from the customer’s bank), each indemnity’s intention being to permit a bank to take steps which might countermand its own client’s instructions (compare with the Quincecare duty where the client must clearly countermand its instructions on its own). Therefore, merely that the Second Defendant’s client (the perpetrators of the APP fraud) gave instructions to the Second Defendant to make the payment was not a complete answer by the Second Defendant to the argument that it owed a retrieval duty to the claimant.

The court acknowledged that arguments such as the potential exposure of a bank to liability if a duty of retrieval were to be recognised went into the issue as to whether it was fair and reasonable for such a duty to exist. However, it was convinced that there were at least some hints to show that a system for retrieval was already in place and could be presumed to be capable of operating without difficulty. Therefore, on a summary basis, the court refused to strike out the claim based on the Second Defendant’s duty of retrieval.

Implications of the decision

The decision reinforces the boundaries drawn around the Quincecare duty’s application on APP fraud cases in Phillip. More importantly, in the context of applications for reverse summary judgment / strike out, the decision discusses novel aspects about the duty of retrieval, and the question as to whether it extends to the bank which receives the fraudulent payments remains ambiguous.

It is important to note that in Philipp, the Supreme Court emphasised that the matter of reimbursement for victims of APP fraud does not fall within the purview of the courts, and is instead a question of social policy for regulators and the government. Accordingly, this decision may cause some dissatisfaction within the payment services market.

We understand that after a consequentials hearing, the Second Defendant has been given permission to appeal.