The duty of banks to seek to trace and retrieve funds following an authorised push payment fraud has come under scrutiny in the first decision to consider the remnants of the so-called Quincecare duty after Philipp v Barclays Bank UK plc [2023] UKSC 25.
In CCP Graduate School Ltd v National Westminster Bank Plc [2024] EWHC 581 (KB), the victim of an authorised push payment fraud sought to claim against its own bank, National Westminster Bank plc, and the bank holding the account to which it had been induced to make transfers, Santander UK plc. The claim in issue was for alleged breaches of a duty (said to by owed by both banks to the victim) to take reasonable care to recover the funds dissipated by the fraudsters after being notified of the fraud. Master Brown held that the victim had a real prospect of success in establishing the existence of such a duty against each bank, while striking out the claim against NatWest on the basis that it was time-barred. The decision suggests that, following the Supreme Court’s decision in Philipp, focus will turn in these types of cases to the adequacy of a bank’s efforts to recover funds from second and third generation recipients.
Between 13 September and 12 October 2016, CCP was induced by fraudsters to make 15 payments from its bank account with NatWest to an account held with Santander. CCP believed the payments were to make investments but as later became apparent it was the victim of an authorised push payment fraud. In total it paid away some £415,000, which was then dissipated by the fraudsters.
When instructing the payments, CCP’s director provided NatWest with the sort code and account number for the Santander account (which the fraudsters had provided to him). His instructions identified the account holder as “PGW Limited” (which again was consistent with the fraudsters’ directions) but the actual name in which the Santander account was held was “PGW Consultants Limited”. However, the payments were processed, in accordance with then-standard practice, without reference to the account name of the recipient.
CCP’s director became concerned about the payments after the fraudsters stopped responding to his emails and phone calls. By the time he notified NatWest of his concerns, some 10 days after the last payment, there was less than £6 left in the Santander account. Only partial recoveries were subsequently made via second and third generation banks.
The matter broadly rested there until mid-2022, when CCP intimated claims against NatWest and Santander based on the duty owed by a bank, as recognised in Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363, to refuse to comply with a payment instruction where the bank is on notice that the instruction may form part of a fraud. Shortly before CCP’s intimation, the Court of Appeal had delivered its decision in Philipp v Barclays Bank UK plc [2022] QB 578, holding that a Quincecare-type claim could in certain circumstances lie against a bank at the suit of a customer who had been induced by the fraud of a third party to authorise payments out of the customer’s account.
For unexplained reasons, CCP waited until 18 October 2022 (more than six years after the last payment was made to the Santander account) to issue its claim against the two banks. The claims pleaded against the banks were audacious:
a.CCP’s claim against NatWest alleged that the bank had breached its Quincecare duty by allowing the payments to be made where (it was said) NatWest ought to have been on notice of the fraud practised on CCP. That claim was plainly time-barred, as the Master ultimately held.
b. The claim against Santander alleged that the bank owed CCP a duty to take reasonable care to prevent Santander accounts from being used as instruments of fraud and had breached that duty by allowing the funds received into the Santander account from the NatWest account to be transferred out. The existence of that duty (expressed as one owed to a non-customer) was inconsistent with the Privy Council’s decision in Royal Bank of Scotland International Ltd v JP SPC 4 [2023] AC 461. In any event, a claim for breach of such duty was for the most part time-barred (at least up to and including payments made on 17 October 2016).
NatWest and Santander applied for summary dismissal of the claims made against them. After the applications were issued but before they came on for hearing, the Supreme Court handed down its decision in Philipp v Barclays Bank UK plc. The decision rejected the Court of Appeal’s extension of the so-called Quincecare duty to authorised push payment frauds but left open the possibility that a bank could be sued by its customer for failing to take reasonable care in seeking to recover funds that the customer had been induced by fraud to pay out once the customer had notified the bank and countermanded the original instructions.
In response to the banks’ applications, CCP cross-applied for permission to amend its claim to allege breaches by each bank of their alleged retrieval duty.
The Master held that, as against NatWest, this represented a new claim brought outside the relevant limitation period which did not arise on the same or substantially same facts as the existing claim against NatWest. He concluded that, under CPR 17.4, the Court had no power to allow the amendment and so the application failed.
As against Santander, the Master held that the retrieval duty claim was already pleaded (albeit with some defects) and that it was at least arguable that Santander owed such a duty to CCP notwithstanding that CCP was a non-customer. He therefore declined to summarily dismiss the retrieval duty claim.
Andrew McLeod acted for National Westminster Bank plc instructed by Pinsent Masons LLP.
View Judgment