APP fraud: what options for recovering lost funds?

Authorised Push Payment fraud (“APP”) is now the largest type of payment fraud in the UK, affecting both individuals and businesses. In such cases, a fraudster will deceive their victim into instructing their own bank to transfer money from their account into an account controlled by the fraudster. Due to a lack of information, as often victims possess nothing other than the account details to which money has been transferred, recovery can be difficult.

For those other than consumers (who may be protected by the Contingent Reimbursment Model Code), there are various legal claims which may be pursued to recover lost funds.

Although a recovery from the fraudster themselves is unlikely to succeed on the basis of limited information on the individual (whose identity will likely be concealed as a result of the receiving bank’s confidentiality obligations) and also the probable reality that funds will have been dissipated through multiple accounts and jurisdictions, it may be possible to pursue a claim against either the victim’s own bank who sent the money, or the bank who received the stollen funds.

Sending Bank

It may be possible to claim that the victim’s bank has breached its duty of care to its customer by carrying out the fraudulent payment instruction.

A bank will owe an implied duty of care to its customer if the bank has reasonable grounds to believe that payment instructions have been issued in an attempt to misappropriate funds (e.g., in the event that the instructions were not authorised by their customer). This duty is known as the Quincecare Duty (Barclays Bank plc v Quincecare Ltd [1992] 4 All E.R. 363).

By virtue of the Quincecare Duty, the sending bank owes to its customer:

1. A negative duty not to carry out fraudulent instructions; and
2. Potentially a positive duty to take steps to verify the legitimacy of the payment instructions (as discussed in JP Morgan Chase bank NA v Federal Republic of Nigeria [2019] EWCA Civ 1641).

It was confirmed last year that the Quincecare Duty applies to a customer who is an innocent victim of APP fraud, so long as the sending bank is on inquiry that carrying out the payment instruction would result in the misappropriation of funds (Philipp v Barclays Bank UK Plc [2022] QB 578).

The trial in Philipp is yet to take place. When it does, the ensuing judgement will provide useful guidance on the success of an APP fraud claim in relation to the Quincecare Duty.

Receiving Bank

It is possible that sophisticated APP fraud may expose no evidence of an attempt to misappropriate funds, meaning that the sending bank would not be in breach of the Quincecare Duty as they were not on inquiry. It may, however, still be possible for the victim to instead consider a claim against the receiving bank, who may arguably hold the stolen funds on constructive trust.

It would not be possible to bring a claim against the receiving bank on the basis of the Quincecare Duty, as the victim is not their customer (JP SPC 4 v Royal Bank of Scotland International Ltd [2022] 3 WLR 261), however as the payment made by an APP fraud victim to the receiving bank was on the understanding that the true facts were different to what they actually were, there is potential to bring a claim for unjust enrichment based on mistake.

A claim for unjust enrichment resulting from APP fraud is yet to succeed, however Tecnimont Arabia Limited v National Westminster Bank Plc [2022] EWHC 1172 (Comm) considered four key areas that a successful claim would depend on, being whether:

1. The defendant has benefitted/been enriched;
2. The enrichment was at the claimant’s expense;
3. The enrichment was unjust; and
4. There are any defences (such as change of position and ministerial receipt – both of which require onwards payment to be made in good faith).

The claimant in Tecnimont failed to overcome points 2 and 4 above, which therefore suggests that that the success of similar cases may hinge on whether the form of banking transfer used enriched the bank at the claimant’s expense, and whether the conduct of the bank would render it unjust to permit it to rely on its defences.

It should be mentioned that it may be possible to bring a claim against the receiving bank for dishonest assistance or knowing receipt, however, these claims are very unlikely to succeed, unless it is possible to prove the bank’s dishonesty and/or a sufficient level of knowledge.