Retrieval duty rejected: Court dismisses new duty for receiving banks in APP fraud

The High Court’s recent judgment in Santander UK PLC v CCP Graduate School Ltd  provides an important clarification of the duties owed by financial institutions to victims of APP fraud, rejecting the notion of a “retrieval duty” owed by a receiving bank to a third-party victim. Eady J held that on the facts the claim against Santander was fanciful, as the money had been removed from Santander’s account by the criminal gang before Santander had been alerted to a possible fraud.  However, even if the chronology had been different, Eady J did not consider that there was any legal basis for a claim of this type against Santander by a third-party victim who was not one of its customers. The judgment contains an interesting discussion of bank’s duties in an APP fraud context, including the much-litigated Quincecare duty.

Background

The Quincecare duty obliges banks to refrain from executing a customer’s instructions if, and for so long as, the bank is on inquiry that these instructions are an attempt to misappropriate the customer’s funds.

The scope of this duty has been the subject of much recent litigation, including the Supreme Court’s decision in July 2023 in Philipp v Barclays (see our blog) where the Court rejected a proposed expansion of the Quincecare duty to cases of authorised push payment (APP) fraud). This is where perpetrators deceive victims into transferring funds to fraudulent accounts by impersonating legitimate entities or using manipulative tactics, resulting in the customer themselves initiating the transfer. However, Lord Leggatt’s judgment in Philipp left the door open to the existence of a retrieval duty, or a duty for banks to take reasonable steps to recover funds transferred due to APP fraud, once they are notified of such fraud.  Following this judgment, CCP Graduate School (CCP) sought to argue that Santander and NatWest owed it such a duty.

Claims by CCP regarding a retrieval duty

In 2016, CCP was induced by third party fraudsters to make a number of payments totalling £415,000 from its account with NatWest to an account with Santander.  By the time CCP’s director raised a ‘fraud alert’ regarding the payments, the funds in the Santander account had been dissipated.  CCP brought claims against both NatWest and Santander, claiming that NatWest had breached its Quincecare duty, and Santander had breached its duty to take reasonable care to prevent its accounts being used as instruments of fraud. Following the judgment in Philipp, CCP applied for permission to amend its claim against NatWest to plead a breach of the retrieval duty, which it had already pleaded (with some defects) against Santander. The High Court ruled on this matter in April 2024, (see our blog here) with the Master dismissing the claims against NatWest. As against Santander, the Master accepted there could be no Quincecare type duty, but declined to summarily dismiss the retrieval duty claim. He acknowledged that there was no contractual duty for Santander to take steps to retrieve the funds, given that CCP was not Santander’s customer, but considered that the duty might be possible on the basis of tortious principles, given that (i) Santander had some measure of control over the payments and movement of money from the criminal gang’s account, and (ii) Santander was therefore in a special position to take steps to recover the sums due.   

Appeal by Santander

Santander appealed the Master’s decision to refuse summary dismissal / strike-out of the claim, on the basis that it was an error of law to find it arguable that it owed CCP (with whom it had no relationship) a form of retrieval duty.

On 25 March 2025, in the first appellate decision on this issue since Philipp, the High Court handed down judgment, rejecting the notion of a retrieval duty for receiving banks, and striking out CCP’s claim against Santander in full. 

The Court summarised the framework of duties owed by banks in the context of APP fraud, referring back to the judgment in Philipp. However, Eady J found that no tortious duty could arise in this case:

• Santander did not have a ‘special level of control’ over the account in the way that is required in order to give rise to a tortious duty. The fact a fraudster had an account with Santander did not give it any control over the customer – in fact, it was obliged to comply with that customer’s instructions. Equally, Santander had no relationship with CCP, and there could be no basis to assume that the fact a fraudster held an account with it gave rise to an obligation to protect those who might be harmed by its customer’s actions.
   
• In relation to Lord Leggatt’s comments in Philipp about the potential existence of a retrieval duty, those were made regarding steps Mrs Philipp’s own bank should have taken once it was notified of the fraud (and therefore in the context of a bank’s duties to its customers).  Eady J found this could not be the basis for imposing a freestanding duty on a bank to take positive steps to unwind harm already caused to a third party with whom it had no contractual relationship, by attempting to reverse payment orders properly made by its own customer. 
   
• There was no basis for a development of the law here either. Eady J cited Zacaroli J’s judgment in Larsson v Revolut [2024] EWHC 1287 (Ch), which also concerned APP fraud, and considered whether to recognise a novel duty of care or incremental development of the law based on the Caparo factors of foreseeability, proximity, and fairness, justice and reasonableness. Like Zacaroli J, Eady J concluded that the Caparo factors were not satisfied here. Even if Santander might have reasonably foreseen harm to third parties once alerted to the fact that its accounts had been used by fraudsters, it had no relationship with the third party to give rise to the necessary quality of proximity. It would therefore not be fair, just and reasonable to impose a retrieval duty.
   
• Finally, the Court also had regard to the reality of a retrieval duty, noting that it would be practically impossible for a receiving Bank to comply with – requiring it to make a hasty adjudication upon an allegation of fraud against its customer, against the backdrop of the speed at which transactions are required to be effected. It would place an ‘unacceptable burden on banks going outside their contractual obligations with their customers’.

Overall, the Court recognised the difficult balance that needs to be struck between the need for payments to take place at speed and the desirability of increasing protections against fraud.  It noted the mandatory reimbursement scheme which has been introduced by legislation, which requires banks to compensate victims of APP fraud in certain circumstances up to a maximum of £85,000. 

Where to next?

While the Courts are sympathetic to those impacted by APP fraud, and recognise the real harm caused to victims, this decision shows they are increasingly alive to the difficulties that banks face in the modern day environment of having to process a very high volume of transactions in a short space of time. Given the Court’s rejection of  a retrieval duty for receiving banks, victims of APP fraud who are not fully compensated by the reimbursement scheme may shift back to seeking to establish the scope of a retrieval duty for sending banks, who have a direct relationship with the victims. It remains to be seen whether the Courts will adopt an equally pragmatic approach to the scope of any such duty. Claims for dishonest assistance and knowing receipt are also likely to continue, particularly where the receiving bank is on prior notice and facilitates the fraudulent transfer for their customer.