No “retrieval duty” for banks receiving APP Victims’ money
In the recent case of Santander UK PLC v CCP Graduate School Limited [2025] EWHC 667(KB), Mrs Justice Eady allowed Santander’s appeal for strike out/summary judgment, declining to impose a duty on receiving banks in cases involving funds transferred by victims of Authorised Push Payment (APP) fraud.
Background
CCP Graduate School Limited was the victim of APP fraud, having made 15 payments from its NatWest account to an account held by Santander. By the time CCP discovered the fraud, only a small portion of the funds remained in the Santander account. CCP brought claims against both NatWest and Santander, alleging that both banks owed a Quincecare duty and a duty of retrieval, the latter being a novel duty argued in light of Philipp v Barclays Bank UK Plc [2023] UKSC 25.
Santander appealed Master Brown’s decision. Mrs Justice Eady considered the appeal on two grounds advanced by CCP:
- The Quincecare duty/duty of care; and
- The duty of retrieval.
Quincecare Duty/Duty of Care
It is well established that a bank, as an agent of its customer, must act within the authority conferred by the customer and may refuse to execute instructions if doing so would involve committing a crime. The Quincecare duty arises where a bank receives payment instructions from an agent of the customer and has reasonable grounds to suspect fraud.
However, this duty does not apply where the customer has directly and unequivocally authorised the payment. Furthermore, in RBSI v JP, the Privy Council rejected the extension of the Quincecare duty to third parties. Although not binding on English courts, Master Brown declined to follow this authority.
In HXA v Surrey [2023] UKSC 52, the Supreme Court emphasized the need for an assumption of responsibility to establish a duty of care. Master Brown found that Santander had some control over the movement of funds, potentially placing it in a special position to act.
Mrs Justice Eady disagreed, finding that Santander had no such control. The bank’s obligations were owed solely to its customer—the fraudster—and it had no relationship with CCP. Therefore, no duty of care could arise.
Duty of Retrieval
The fallback argument, based on a “duty of retrieval,” suggested that Santander failed to take adequate steps to recover the funds after being notified of the fraud. This argument sought to extend the bank’s duty of care to include post-fraud recovery efforts, even in the absence of a contractual relationship with the victim.
Mrs Justice Eady applied the incremental approach from Robinson v Chief Constable of West Yorkshire Police and the Caparo test. She concluded that:
- Even if harm to third parties was foreseeable, there was no proximity between Santander and CCP.
- The imposition of such a duty would not be fair, just, or reasonable.
She emphasised that requiring banks to act on fraud alerts from third parties would impose an unreasonable burden, forcing them to adjudicate fraud claims without due process and potentially causing them to breach their obligations to their own customers.
The court also considered the Payment Services Regulations 2017 and the Financial Services and Markets Act 2023, which introduced a mandatory reimbursement scheme for APP fraud victims, capped at £85,000. These measures were deemed sufficient to protect victims, negating the need for a standard law duty of retrieval.
Conclusion
Mrs Justice Eady granted Santander’s application for strike out/summary judgment. She held that CCP’s claim was fanciful, as the funds had already been removed before Santander was alerted. Even if the timeline were disputed, there was no legal basis for imposing a duty on the receiving bank, which had no contractual relationship with the victim.
This judgment confirms that receiving banks do not owe a duty of care to third-party victims of fraud. Victims of APP fraud should instead pursue claims against their own banks under the Quincecare duty or seek reimbursement under the statutory scheme provided by the Financial Services and Markets Act 2023.
