This article was first published with ThoughtLeaders4 FIRE Magazine.
Authorised push payment (APP) fraud is nothing new. Every year, thousands of individuals and businesses fall victim to APP fraud and tricked into making a payment to a fraudster believing that it is going somewhere entirely legitimate. The monies are then transferred out to multiple accounts - often overseas, specifically to jurisdictions where recovery can be prohibitively expensive and time consuming.
APP fraud is on the rise – research from UK Finance shows that APP fraud had increased by over 30% in the first half of 2022 compared to the same period in 2020. It has been highlighted as one of the key fraud trends to watch out for in 2023 and reports suggest that APP fraud will double by 2026. There are several types of APP fraud, common examples include:
- Purchase scams - where victims are tricked into paying for goods that often do not exist. This is the most common type of scam accounting for 56% of all cases.
- Impersonation scams - where an individual poses as a member of bank staff or law enforcement who informs an individual that they have been the victim of a fraud. The individual is persuaded to transfer money to a "safe account" - which is in fact an account that the fraudster controls.
- Investment scams – where an individual transfers money to a fictitious investment, which is in fact merely an account controlled by the fraudster. This scam is often communicated via social media or email and can purport to be from a well-known bank or investment firm.
What routes of recovery do victims have?
Claim against the bank
Victims may be able to pursue a claim against the bank with whom they hold the account which was used to make payment to the fraudster. The recent Court of Appeal decision in Philipp v Barclays Bank UK PLC [2022] EWCA Civ 318 confirmed that it was "arguable" that the Quincecare duty arises in the context of APP fraud. In this case, Dr and Mrs Philipp were tricked into transferring over £700,000 of their life savings to two accounts in the UAE. The fraud took place over several weeks. Dr and Mrs Philipp had received a fraudulent notification of a 'suspicious payment' on an account they held with Barclays. The fraudster convinced the couple through a series of phone calls that they were cooperating with the Financial Conduct Authority and the National Crime Agency to bring the fraudster to justice and the couple ultimately instructed Barclays to transfer £400,000 and £300,000 to separate bank accounts in the UAE where they believed their money would be safe. They lost all of it.
Mrs Philipp issued proceedings against Barclays relying on the Quincecare duty owed by it. Barclays argued that the Quincecare duty did not extend to a duty to protect Mrs Philipp against the consequences of her own decisions, where her payment instructions were valid and not in and of themselves fraudulently given. The Court of Appeal granted Mrs Philipp's permission to continue proceedings against Barclays, extending the Quincecare duty to the customers of a bank, and not just their agent.
Permission has been granted to appeal the Court of Appeal's decision in Philipp v Barclays Bank, in particular the court will consider whether the Quincecare duty applies when instructions given to the bank come directly from the customer and not through an agent. The appeal is due to be heard in the Supreme Court on 1 and 2 February 2023.
Financial Ombusdman Service
Victims may be able to seek limited recourse against the bank through a complaint to the Financial Ombudsman Service, although any award under that scheme is limited to a maximum amount of £375,000.
Claim against the fraudster
The main difficulty when pursuing claims against APP fraudsters is that, upon receipt of the victim's money, the funds are often swiftly transferred into multiple accounts across a number of jurisdictions. However, where the victim is able to act swiftly enough, injunctive relief such as worldwide freezing orders remain an extremely powerful tool.
Regulatory changes
As Philipp v Barclays Bank demonstrates, there is a lack of clarity on the duties owed by payment service providers (PSPs). The Payment Systems Regulator (PSR) has published proposals for a mandatory reimbursement and cost allocation for APP fraud.
In July 2022, the Financial Services and Markets Bill was published, setting out a new proposed power for the PSR to require mandatory reimbursement of APP fraud victims by PSPs. In September 2022, the PSR issued a further consultation paper setting out proposed changes including:
- The requirement for banks to publish data on their performance in relation to APP fraud (proposed to come into effect from 2023); and
- The requirement for banks to reimburse customers who are victims of APP fraud within 48 hours (proposed to come into effect from 2024), with "only limited exceptions" such as first party fraud or gross negligence, a de minimis threshold of no more than £100 for claims and a limitation period of 13 months.
The PSR intends to publish a policy statement on mandatory reimbursement early in 2023.
APP fraud in 2023
Individuals and businesses should be alert and also take extra care if investing in cryptocurrencies. The majority of cryptocurrencies are not regulated by the FCA, meaning they are not protected by the Financial Services Compensation Scheme ruling out one possible avenue of redress.
This is a rapidly developing area. Many will be watching for the outcome of Philipp v Barclays Bank, which will potentially widen the scope for claims by victims against their bank. In addition, it is clear from the regulatory changes set out above that both the Government and the PSR believe that banks should be at the forefront of the battle against fraud.