Authorised Push Payment (or APP) fraud is the most common type of financial fraud in the UK. The trade body for financial services, UK Finance, estimated that in 2023 £459.7 million was lost to APP fraud, against £708.9 million of 'unauthorised' fraud losses. APP fraud involves criminals manipulating their victims into making payments, and/or sharing details. The fraudsters will often pose as a bank, a reputable organisation, or the intended beneficiary of a transaction. Once the funds are paid, they are quickly moved on by the fraudsters, making them difficult, if not impossible, to trace and recover. As a result, many victims have sought to look to the banks involved in the transaction in an attempt to recuperate the lost funds.
There have been a handful of cases which have sought to clarify the obligation owned by banks to parties who have fallen victim to this type of fraud. However, some uncertainty was created in the case of Philipp v Barclays [2023] UKSC 25 (which we discussed in our previous article here) about whether banks receiving payments had a duty to take reasonable steps to recover funds. In that case the bank had sought summary judgment against the claimant. On appeal, the Supreme Court held that it could not strike out Ms Philipp's claim that the bank had owed her a duty to take reasonable steps to recover the funds (the so-called "Retrieval Duty"), as it was a question that required full consideration at trial. As a result, this line of argument remained open.
Following this, the case of Santander UK PLC v CCP Graduate School Ltd [2025] EWHC 667 (KB) has sought to develop the law in relation to APP fraud by imposing a duty of care to the victim and a "retrieval" duty on third party bank(s) that have received the victim's funds.
Background
CCP Graduate School Ltd (CCP) was the victim of the fraud. Between 13 September and 12 October 2016, CCP authorised payments totalling £415,900.67 from its account with NatWest into a Santander account held by an entity operated by the fraudsters, PGW Consultants Limited.
In 2022, CCP brought the following claims against both banks:
- a claim against NatWest alleging that it had breached its Quincecare duty to CCP; and
- a claim against Santander on the grounds that:
- it owed CCP a duty to act with reasonable care, and had breached that duty by permitting its' bank accounts to be used for fraudulent transactions, when it allowed the funds received into its account to be transferred to external bank accounts; and/or
- it owed CCP a Retrieval Duty in respect of the funds that it had allowed to be paid away from its account
Both banks applied for the claims against them to be struck out.
The first instance decision
In the first instance, relying on the decision in Philipp, Master Brown had dismissed CCP's claim against NatWest on the basis that a bank does not owe a duty to its customers to refuse to act on their direct instructions where it suspects they are being defrauded.
He also dismissed the claim that Santander owed CCP (or that any bank owes a third party) a general duty of care. However, Master Brown had allowed the retrieval duty against Santander to proceed on the basis that he was not convinced that it could or should be struck out on a summary basis.
The Appeal
Santander successfully appealed the decision.
Mrs Justice Jennifer Eady DBE ruled that CCP's case be entirely struck out. She clarified that a receiving bank does not assume responsibility to a third-party victim of fraud: a bank's main obligation is to comply with its own customers' instructions, and if instructions were given properly then there would be no reason for them not to comply.
Therefore, the court held, if banks were seen to have a standalone duty to take positive steps to unwind the harm caused to a third party, by way of reversing payment orders which had been made by proper instructions from their customer it would contradict what Lord Leggatt said in Philipp v Barclays: a bank has “no authority, let alone obligation, to attempt to reverse earlier transactions when to do so would have been directly contrary to its customer’s payment orders”.
Conclusion
If the courts had permitted CCP's claim against Santander to succeed this could have created a disproportionate expansion of the duty of care owed by banks. If CCP's position had been accepted, banks would not only owe their direct customer a duty of care but also third parties.
On the other hand, the court's refusal to expand this duty to third party victims of fraud limits avenues available to victims of APP fraud, despite it remaining a serious problem. However, while the Judge "recognise[d] the very real harm suffered by victims of APP fraud", this did not mean that additional obligations could be imputed to the banks. This is particularly so where a mandatory reimbursement scheme has been established by the Financial Services and Markets Act 2023 under which a victim of an APP fraud can be reimbursed up to a maximum of £85,000. This scheme took effect on 7 October 2024 for all payments made on or after this date. Victims may also seek to complain to the Financial Ombudsman Service, which has a compensation limit of £430,000.
A copy of the judgment can be found here.