Don’t bank on it: High Court rejects new liability for receiving banks in APP fraud

In an era where digital transactions continue to be integral in both personal and commercial spheres, the prevalence of Authorised Push Payment (APP) fraud has escalated, posing significant challenges to financial institutions and their clients.

The recent case of Santander UK plc v CCP Graduate School Ltd [2025] EWHC 667 (KB) (Santander), offers important clarification on the scope of banks’ duties in the context of APP fraud against businesses. The judgment also has far-reaching implications for the banking and payments sector, business and individuals alike.

Background

In Santander, CCP Graduate School Ltd (CCP) was deceived into transferring approximately £415,000 in 2016 from its NatWest account to an account at Santander, held by fraudsters operating under the name PGW Consultants Limited. On discovering the fraud, CCP tried to recover the lost funds by suing both its own bank, NatWest, and the receiving bank, Santander.

The claim against NatWest was based on an alleged breach of the Quincecare duty (which places a duty on financial institutions not to follow their customer's instructions if they suspect fraud on a customer’s account). Against Santander, CCP argued for a novel “duty of retrieval,” on the receiving bank who had an obligation to take reasonable steps to recover or freeze funds that had been transferred into a fraudster’s account.

Notably, CCP was not a customer of Santander. However, the concept of a retrieval duty had been discussed in the Supreme Court’s 2023 decision in Philipp v Barclays Bank UK plc, which left open the possibility that a bank might be obliged to attempt to recover fraudulently induced payments on being notified by its own customer of the fraud. CCP’s case tested whether such a duty could be extended to a different bank receiving the funds, on behalf of a third-party victim.

Santander applied to strike out the claim. At first instance, the Master held that it was at least arguable that Santander may have owed CCP a retrieval duty. Santander appealed.

The Court’s decision on appeal

On 25 March 2025, Mrs Justice Jennifer Eady DBE ruled in favour of Santander, striking out CCP’s claim in its entirety. The Court held that no “duty of retrieval” is owed by a receiving bank to a non-customer fraud victim, emphasising that Santander’s primary obligation was to comply with its customer’s instructions. The fact that the fraudster held an account with Santander did not mean the bank had any control over that customer or create a special relationship with the victim of the fraud. In essence, a bank cannot be deemed to have assumed a duty to reverse a transaction that was validly executed at the direction of its own accountholder, even if that transaction was induced by fraud elsewhere.

The Court drew a clear distinction between a bank’s duties to its own customers and any suggested duty to third parties. While the Supreme Court in Philipp acknowledged an arguable duty for a bank to swiftly attempt fund recovery when alerted by its customer, that duty was rooted in the contractual relationship between the bank and its customer. In contrast, CCP had no contractual relationship with Santander, and imposing a comparable duty toward a third party would represent an unprecedented expansion of tort law.

Mrs Justice Eady added forcibly that recognising such a duty to non-customers would overstep the proper role of the courts and encroach on the domain of legislators and regulators. She also highlighted practical problems and conflicts that such a duty would create: a receiving bank would be compelled to make immediate judgments about freezing or recalling funds based solely on allegations of fraud, potentially conflicting with its obligations to its innocent customers. This would place an unacceptable burden on banks beyond their established obligations.

Mrs Justice Eady acknowledged the existence of a voluntary scheme of indemnities operated by banks to mitigate the harm caused by APP fraud. Her reference is to the voluntary reimbursement scheme launched in 2019 under which signatory banks reimburse customers who have been victim to APP fraud. However, Mrs Justice Eady noted that the existence of a voluntary scheme does not provide a proper basis for the implication of duty of care in these circumstances. She noted that the fact that banks are willing to take steps to try to assist victim of fraud does not mean the courts should find they have a legal obligation to do so.

Implications

Banks

In October 2024, a mandatory reimbursement scheme for APP fraud came into force which applies to consumer transactions made from 7 October 2024 via CHAPS or Faster Payments. This requires a sending payment service provider to reimburse eligible customers who fall victim to APP fraud within five business days (subject to certain exceptions, such as fraud on the part of the consumer). As the mandatory reimbursement scheme does not apply to businesses or to payments made before the scheme came into effect, the Santander decision will be welcomed by payment service providers to provide useful clarity where the mandatory reimbursement scheme for APP fraud does not apply.

Fraud victims

Businesses and individuals deceived into sending money to fraudsters who are not covered by the mandatory APP fraud reimbursement scheme, are reminded by this judgment that suing the fraudster’s bank is not a viable path to recover losses. Victims must instead rely on other avenues: if they are not within scope of the APP fraud reimbursement scheme or are above the limit they could make a claim against their own bank (if that bank breached a duty to them), prompt law enforcement intervention to freeze funds, or claim against their insurance.

Looking ahead

The Santander judgment provides authoritative guidance for now, but it may not be the final word if CCP decide to appeal to the Court of Appeal. Given the clear reasoning in Justice Eady’s judgment and the Supreme Court’s stance in Philipp, any further appeal would face significant challenges.

Read our article on authorised push payment fraud and mandatory reimbursement here.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.

© Farrer & Co LLP, May 2025