The recent High Court decision in CCP Graduate School v NatWest and Santander [2024] EWHC 581 (KB) is the first judgment discussing the Quincecare duty owed by banks since the Supreme Court’s decision in Philipp v Barclays Bank UK PLC [2023] UKSC 25. In CCP v NatWest and Santander the High Court considered the novel question of whether and to what extent the Defendant banks had a duty to retrieve funds which the Claimant alleged had been dissipated as a result of authorised push payment (“APP”) fraud. Whilst certain elements of the claim were struck out, the High Court refused summarily to dismiss the claim against Santander.

Background

Our previous Perspectives [1] on the evolution of the law around the Quincecare duty include a description of the background to the previous cases, and their appellate history.

In this case, the relevant payments were made between 13 September and 12 October 2016.  The Claimant, acting through its sole director Mr Pathirana, instructed NatWest (the first Defendant) to make fifteen payments to a bank account held with Santander (the second Defendant). The Claimant believed the payments, totalling £415,909.67, were being made to PGW Limited.

For each transaction, the Claimant provided NatWest with the sort code, account number and the payee reference: “PGW limited”. The Santander account holder was ultimately discovered to be PGW Consultants Limited. The Claimant alleged that it was unaware that the Santander account was under the control of a criminal gang at the time at which the payments were made. The Claimant’s case was that the criminal gang had deceived the Claimant into instructing NatWest to transfer the funds into the fraudulent Santander account on the false basis that the funds would be applied as investments by PGW Limited.

By 22 October 2016, the Claimant had notified NatWest of the potential fraud in relation to the payments. NatWest notified Santander on the same day. The funds had however been dissipated and were lost, with only £14,000 being retrieved.

The Claimant argued that NatWest breached its duty of care by carrying out the payment instructions without taking steps to prevent fraud in accordance with the Quincecare duty. It was also alleged that Santander had failed in its duty of care by allowing the transferred funds to be removed from the account. ​

Decision

Claims against NatWest

NatWest had argued that these claims had been issued out of time and therefore should be struck out. The last payment left NatWest on 12 October 2016 and the claim, having been issued on 18 October 2022, had been brought outside of the limitation period. The Claimant argued that the limitation period had been extended under s32(1)(c) of the Limitation Act 1980, which allows relief from the consequences of mistake. The Claimant’s position was that it only discovered on 22 October 2016 that it had been a victim of APP fraud, and the claim was an action for relief in respect of that mistake. The Court rejected that argument as an extension under this ground is only available where mistake is an essential element of the cause of action. This was not so in the present case. The Court therefore struck out the claim against NatWest in respect of allowing the payments to be made.

The Court then considered the alternative basis to strike out the claim, based on the Quincecare duty and the Supreme Court’s decision in Phillipp. NatWest argued that the payments were authorised by the Claimant and made in accordance with its instructions. The Court restated the established position in relation to APP fraud in circumstances such as this: “Where a bank’s customer is the victim of an APP fraud, the bank’s duty to exercise reasonable care and skill is not engaged unless there are doubts as to the validity of the customer’s instruction.” [2] The Claimant argued that NatWest had a duty to exercise reasonable care and skill when carrying out the payment instructions and that this required NatWest to refuse to carry out those instructions. However, the duty “only arises where the validity or content of the customer’s instruction is unclear or leaves the bank with a choice about how to carry out the instruction” [3]. The Claimant argued that its instructions were equivocal in that they referred to PGW Limited not PGW Consultants Limited and that in actioning these payments NatWest was in breach of mandate. The Court highlighted that the claim had not been pleaded as a breach of mandate and should therefore be summarily dismissed for being defective as a matter of law or otherwise.

On the question on whether NatWest owed the Claimant a duty to take reasonable steps to retrieve or recover the sums paid out as a result of the APP fraud (the “retrieval duty”), the Claimant argued that the bank had been put on notice of matters which called for investigation and immediate action. As a result of this notice, NatWest, acting as a reasonably prudent banker, should or would have immediately contacted Santander and either sought recall of those payments or warned Santander that there were strong grounds for suspecting criminality and to not allow the funds to leave the Santander account. It was argued that appropriate indemnities should have been given as required. The Claimant pointed out that Lloyds Bank had identified that large sums from the Santander account had been paid into an account held with Lloyds, and made attempts to retrieve the money when notified of the suspected fraud. It was argued that NatWest could have done more to prevent the dissipation of funds once the bank had been put on notice. Although the Court noted that a bank could have offered an indemnity to the bank receiving funds suspected of fraud to prevent any further dissipation of funds, the Court found that this proposed amended pleading did not arise out of the same or substantially the same facts as the originally pleaded claim, so that the proposed amendment had to be summarily dismissed.

Claim against Santander

Despite finding that no Quincecare duty existed between Santander and the Claimant, the Court refused to dismiss the claim based on the retrieval duty against Santander. It was found that there may be some basis for arguing that Santander could have taken steps to retrieve the funds once Santander had been notified by NatWest, drawing on the comparison with the actions of Lloyds bank once it had been notified. Further, at the time at which the claim was issued, some of the Claimant’s funds remained in the Santander account, which meant the relevant part of the claim was not time barred.

Comment

The legal landscape in this area is in a state of flux and this is a significant decision. The courts’ willingness to allow victims of APP fraud to use the retrieval duty as an alternative route to recover funds is yet to be fully tested. Until cases such as this proceed to a trial dealing with not only the appropriateness of such a duty, but also the scope of it, victims of APP fraud will need to rely on the existing Quincecare line of cases. Importantly, however, this decision does leave open the possibility for the courts to extend duties owed by banks to their customers and the final outcome of the case will be closely watched.

The Payment Systems Regulator has recently taken action to assist victims of APP fraud through the introduction of a new mandatory reimbursement requirement which comes into force on 7 October 2024. The new rules require payment service providers to reimburse victims of APP fraud meeting certain criteria, such as the payments having occurred in the UK and not exceeding £415,000. APP fraud often involves sums far larger than this upper limit and can involve international accounts, so it is clear that APP fraud claims will continue to make their way through the courts.

Authors: Ned Beale and Deminca Nettleford

Footnotes

[1] Quincecare duty of care not confined to companies and agents, Privy Council rejects extension of Quincecare duty of care and The Supreme Court determines the Quincecare duty’s capacity
[2] [24]
[3] [63]