Santander UK Plc v CCP Graduate School Limited [2025] EWHC 667 (KB)

[2025] EWHC 667 (KB)Case No KA-2024-000063
IN THE HIGH COURT OF JUSTICE
KING’S BENCH DIVISION
ON APPEAL FROM MASTER BROWN
KB-2022-003539
Venue Royal Courts of Justice, Strand, London, WC2A 2LLDate 25/03/2025
Before
MRS JUSTICE JENNIFER EADY DBE
Between
SANTANDER UK PLCAppellantCCP GRADUATE SCHOOL LIMITEDRespondent
Alexia Knight (instructed by Addleshaw Goddard LLP) for AppellantRuhi Sethi-Smith (instructed to attend the hearing on a direct access basis for CCP Graduate School Limited; Saracens Solicitors) for the RespondentHearing Hearing date: 27 February 2025
Approved JudgmentThis judgment was handed down remotely at 10.30am on 25 March 2025 by circulation to the parties or their representatives by e-mail and by release to the National Archives(see eg https://www.bailii.org/ew/cases/EWCA/Civ/2022/1169.html)..............................Mrs Justice Jennifer Eady DBE:

Introduction

[1]The question at the heart of this appeal is whether, in circumstances where payments have been made into a bank account as a result of fraud, a tortious duty of retrieval can arise in relation to the receiving bank when the paying party (the victim of the fraud) is not a customer of that bank. The basis of such a duty is said to arise from the judgment of the Supreme Court in Philipp v Barclays Bank UK plc [2023] UKSC 25, [2024] AC 346, in particular at [118]-[119].[2]In giving this judgment, I am concerned with an appeal brought by Santander UK plc (“Santander”) against the decision of Master Brown, handed down on 14 March 2024, refusing part of its application for summary dismissal and/or strike out of a claim brought against it by CCP Graduate School Limited (“CCP”). At the oral hearing before me, Santander appeared by Ms Knight of counsel, who represented its interests below; CCP was represented by Ms Sethi-Smith of counsel, albeit other counsel had previously represented its interests before the Master.

The background

[3]CCP’s claim arises from an authorised push payment (“APP”) fraud; so called because a victim is induced (by fraudulent means) to authorise (“push”) the payment from their bank to a bank account controlled by a fraudster. Every year, thousands of individuals and businesses fall victim to APP frauds, which can have a devastating effect on people’s lives; the Payment Services Regulator’s annual fraud report for 2024 records that £459.7 million was lost to APP scams in the preceding year.[4]In the present case, CCP was the victim of an APP fraud when (by its director, Mr Pathirana) it was induced to make 15 payments (“the payments”) from its account (“the CCP account”) with the National Westminster Bank plc (“NatWest”) into an account at Santander, which was held in the name of PGW Consultants Limited (“the account”). For each of the payments, CCP provided the sort code and account number for the account, which was sufficient to provide the necessary authorisation for payment. For completeness, I note that it was CCP’s case before the Master that it had only provided a payee reference of “PGW Limited” (not “PGW Consultants Limited”), but the Master was clear:(i) the claim had not been pleaded as a breach of mandate, and (in any event)(ii) giving the sort code and account number was sufficient for NatWest to be authorised to make the payments (see the Master’s judgment at [25]-[30]); there is no appeal before me in respect of this ruling.[5]The payments were made between 13 September and 12 October 2016 and a total of £415,909.67 was transferred in this way. Shortly after receipt, on various dates and in varying sums, the fraudsters then transferred the payments out of the account to a number of other accounts held with different banks.[6]It is Santander’s case that, by the close of 20 October 2016, just £5.39 remained in the account. That case is supported by the print out of movements in and out of the account exhibited to the first statement of Mr Alexander Unger, solicitor for Santander, and is further confirmed by a letter of 13 December 2016, setting out the findings of the Financial Ombudsman Service. At the hearing before the Master, CCP accepted the defendants’ evidence in this regard (see paragraph 6 of CCP’s skeleton argument for the hearing on 19 July 2023).[7]As the Master records, however, there was some uncertainty as to precisely when CCP contacted NatWest to raise an alert as to the fraud. For CCP, it was said that Mr Pathirana had called NatWest about this on 21 October 2016, although it was NatWest’s case that it received no alert until 22 October 2016. In any event, it seems that Santander had received a contact from Lloyds Banking Group on 21 October 2016, which caused it to place a stop on the account at 10.17 am that day (see Santander’s Defence at [31]). From information provided by a fraud investigator from Lloyds on 25 October 2016, it appears that concerns had arisen after large sums had been paid from the account into an account held at Lloyds, only to be distributed out shortly after receipt. Santander was then contacted by NatWest on 22 October 2016, which was when it was notified that it was believed that CCP had been the victim of a fraud. Santander states (see its defence at [31(3)(iv)]) that it then gave indemnities to Lloyds, which enabled some of the sums to be recovered (albeit I understand this was limited to only £10,700 of the monies in question).[8]The giving of an indemnity from one bank to another was seen by the Master as an important feature of this case; he described the process as follows:
“54. ... it appears that perhaps the most obvious step, if not the principal step, that could be taken by a bank which is on notice of a fraudulent scheme such as the one alleged here, is to offer an indemnity to the bank receiving payment. Such an indemnity, I am told by counsel, is against liability which the receiving bank might incur to its customer (and, possibly, others) when preventing any further payment out and as I understand it, allows the account to be effectively frozen.”
Ms Knight has explained that the offer of an indemnity in these circumstances is a voluntary practice between banks, intended to address the need to urgently stop further payments out of an account notwithstanding specific instructions to make such payments on the part of the bank’s customer.[9]In his reasoning, the Master left open the question as to how far this practice might extend, observing:
“56. There are further issues arising which again I do not need to deal with in any detail. It appears to be suggested ... that it would be highly irregular, and give rise to GDRP obstacles, if the customer’s bank were to attempt to do more than merely providing an indemnity to the receiving bank, by (for instance) providing an indemnity to other banks further down the chain of payments. I take on board all these points. ...”
In any event, as the Master records (see his judgment at [52] and [55]), an indemnity was given to Santander by NatWest on either 24 or 25 October 2016.[10]There is no dispute before me that CCP, by providing the intended account number and sort code, authorised the payments in question. Equally, as Master Brown accepted, Santander received authorisation for payments out of the account from PGW Consultants Limited, which was its customer. In addressing a complaint made by CCP against Santander, by letter of 13 December 2016, the Financial Ombudsman Service found that:
“... It’s not reasonable to expect Santander to have known that the account holder was obtaining funds through a scam ... Santander can only know something is wrong when it has been notified of such an instance. ... NatWest contacted Santander on 22 October 2016 – the same day as you contacted NatWest. However, Lloyds contacted Santander on 21 October 2016 and Santander dealt with the account appropriately. ... You feel Santander dismissed information it was provided with or that it failed to act appropriately. But given the contact explained above, I’m satisfied that’s not the case.”

CCP’s claim and the Master’s decision

[11]By its claim, issued on 18 October 2022, CCP sought damages against both NatWest (the first defendant in the underlying proceedings) and Santander (the second defendant). As against NatWest, CCP contended that the bank owed it a contractual and/or tortious duty not to carry out its payment instructions without taking steps to ensure this was not an attempt to defraud it. This was put on the basis of a “Quincecare duty” (Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363), whereby, in certain circumstances, a bank can have a duty not to execute a payment instruction given by an agent of the customer without making inquiries. As for the claim against Santander, accepting that there was no contractual relationship, CCP pursued its case in tort, primarily arguing that, by allowing the payments to be removed from the account, Santander had failed in its duty of care to CCP; additionally, contending that there was a duty of retrieval in respect of the payments such as to give rise to a further breach of duty of care by Santander in the circumstances of this case (see the summary of the case put by CCP before the Master, at [58] of the judgment below).[12]Applications for the summary dismissal and/or strike out of CCP’s claims were pursued by both NatWest and Santander, and came before Master Brown for hearing on 19 July 2023 and 16 January 2024. Draft amended particulars of claim had been prepared by CCP shortly before the July hearing and a further version of those proposed amended particulars was drawn up afterwards. So far as relevant, the draft amended particulars of claim provide as follows:
“18. ... [Santander] by failing to take any prompt and effective steps to retrieve the sum [in question] to be removed from the PGW Consultants Limited’s account with [Santander] failed in its duty of care to the Claimant. ... PARTICULARS OF BREACH OF DUTY BY [SANTANDER] ... t) ... on 25 October 2016 ... a Fraud Investigator from Lloyds Banking Group, emailed [Santander] setting out her concerns regarding payments into the accountheld in the name of PGW Consultants Ltd. ... [She] told [Santander] that she had identified that a Lloyds Bank account had received large sums of money from the [Santander] account in the name of PGW Consultants Ltd. The Lloyds Bank account holder had then themselves distributed the funds out of the Lloyds Bank account shortly after receipt, which action ... [was] considered to be suspicious .... [CCP] will say that: ... c. That having been put on notice in this way, among the steps [Santander] acting as a reasonably prudent banker would have taken would have been to contact the banks into which [CCP’s] money had been transferred and either immediately sought a recall of those payments from the banks or other financial institutions to which they had been transferred or warned the receiving bank that there were grounds for suspecting that criminality was involved and not to allow any further movements of money from the account of PGW Consultants Ltd ... until such time as an investigation had been carried out. ... ”
PARTICULARS OF BREACH OF DUTY BY [SANTANDER] c. That having been put on notice in this way, among the steps [Santander] acting as a reasonably prudent banker would have taken would have been to contact the banks into which [CCP’s] money had been transferred and either immediately sought a recall of those payments from the banks or other financial institutions to which they had been transferred or warned the receiving bank that there were grounds for suspecting that criminality was involved and not to allow any further movements of money from the account of PGW Consultants Ltd ... until such time as an investigation had been carried out. ... ”

PARTICULARS OF BREACH OF DUTY BY [SANTANDER]

[13]By his judgment, handed down on 14 March 2024, Master Brown dismissed the claim against NatWest in its entirety.[14]As for the claim against Santander, the Master accepted there could be no Quincecare type duty in this regard, as:
“77. ... such a duty would be inconsistent with the contractual duty to effect any mandate by their customer. As the Supreme Court made clear in Philipp [Philippv Barclays Bank plc [2023] UKSC 25, [2024] AC 346] the Quincecare duty does not apply “to cases of the present kind where the customer has unequivocally authorised and instructed the bank to make a payment.” ...”
To the extent that CCP’s claim was based on an alleged breach of a Quincecare duty, the Master thus agreed that that aspect of the claim against Santander must be struck out.[15]Finding, however, that CCP’s claim had identified a second way of putting the claim against Santander, the Master characterised CCP’s alternative argument as being:
“79. ... substantially, founded on the recognition by the Supreme Court in Philipp that there could be a duty of retrieval (at [115] to [119] ...). That duty, it might be argued was not expressed or to be seen in terms of a contractual obligation (not perhaps on its face being necessary for the business efficacy of the contract) but a duty in tort. If such a duty applies to the customer bank, [CCP] effectively says that it is at least arguable that it would be anomalous if the bank the operates the account of the criminal gang (who can be assumed to have perpetuated the fraud) was not under a similar duty.”
[16]Thus viewing the case as one based on a “duty of retrieval”, the Master considered this was sufficiently arguable such that CCP’s claim against Santander should not, in this respect, be dismissed and/or struck out.[17]In reaching that view, the Master considered it was not necessarily fatal that there may have been no assumption of responsibility by Santander towards CCP:
“81. I can at least see how it might be said that it is not necessarily fatal to the claim that there may have been no assumption of responsibility by [Santander] to [CCP]. Although arising in quite different circumstances (liability of a public authority for abuse by a parent), in HXA v Surrey CC [2024] 1 WLR 335 Lord Burrows set out the following principles at [88]: “In the tort of negligence, a person A is not under a duty to take care to prevent harm occurring to person B through a source of danger not created by A unless (i) A has assumed a responsibility to protect B from that danger, (ii) A has done something which prevents another from protecting B from that danger, (iii) A has a special level of control over that source of danger, or (iv) A's status creates an obligation to protect B from that danger.” 82. It is perhaps (iii) and (iv) which are of some particular relevance here. On the assumption that [Santander] had at least some measure of control over the Payments and the movement of money from the account held by the fraudulent gang (it must be assumed) [CCP] argues that [Santander] is in a special position to take steps to recover the sums due.” “In the tort of negligence, a person A is not under a duty to take care to prevent harm occurring to person B through a source of danger not created by A unless (i) A has assumed a responsibility to protect B from that danger, (ii) A has done something which prevents another from protecting B from that danger, (iii) A has a special level of control over that source of danger, or (iv) A's status creates an obligation to protect B from that danger.”
[18]Acknowledging that, in Royal Bank of Scotland International Ltd (Respondent) v JP SPC 4 [2022] UKPC 18, [2023] AC 461 (“RBSI”), the Privy Council had accepted that the bank “had no special level of control over the source of danger (i.e. it was not in control of the fraudsters)” (RBSI [84]), the Master nevertheless considered that ruling could be distinguished:
“83. ... in that case the court was concerned with a Quincecare duty to a third party not a duty of retrieval, indeed the factual situation was, it might be said, quite different.”
In identifying (by way of footnote) the “quite different” factual situation in RBSI, the Master explained:
“It involved a claim by two investment funds against a bank where it was alleged that as a result of the fraud perpetuated by an Isle of Man company money in the company’s accounts with the defendant which were beneficially owned by the Claimant were paid out of that account for the benefit of the company’s owners or others”
[19]As for what was implied by a “retrieval” in this context, the Master described this as operating by means of a “chain of indemnities” (see [83] of the judgment below), referring back to his description (at [54] of the judgment) of the way in which banks offered indemnities in these circumstances. On that basis, the Master considered: “83. ... it might be said that the indemnity at least to some extent is intended to permit a bank to take steps which might countermand its own client’s instructions. So it is not entirely clear that their own client’s instructions can be a complete answer by [Santander] to the argument that a retrieval duty applies to a bank which receives payments made under an APP scheme (particularly, it might be supposed, where the client can be assumed to be the criminal gang behind it). 84. Moreover, and on a practical level, ... there seems to be at least some basis for arguing that if the retrieval duty recognised in Philipp is effective it is perhaps because the bank of the customer and presumed victim (the ‘customer bank’) could provide an indemnity to the first receiving bank (referred to in the evidence as ‘first generation’ bank) and that that indemnity in turn is passed on to the bank to which the funds are then transferred (‘second generation’ banks) and so on until the funds are located and frozen. If this is correct then the effectiveness of any steps taken by the customer bank to retrieve sums paid out would appear to be dependent on co-operation of the first and later generation banks. For this system to work, presumably it requires the indemnity to be passed on promptly (it can perhaps be assumed that criminal gangs would not leave money in a first generation account for long). But I think there might at least be some basis for arguing that the duty recognised in Philipp requires, or at least is consistent with, a duty on the first generation and later generation banks to take what at least appeared in argument to be the relatively straightforward step of passing on an indemnity to the next generation bank.” (emphases in original)[20]Accepting that there may be issues as to whether it was fair and reasonable for any retrieval duty to be recognised, given the potential exposure of banks to liability if parties were to trigger a requirement on banks to retrieve or recover payments made as a result of fraud, the Master nevertheless took the view that:
“85. ... the evidence produced in this application at the very least hints at there already being in place a system for retrieval and that any such system might be presumed to be capable of operating without difficulty. Indeed the possible existence of any such system strikes me as at least relevant to considering whether a duty should be recognised and on this point more material could be anticipated if I were not to strike the claim out...”
In the circumstances, the Master was not persuaded that the matter was sufficiently clear that CCP’s claim against Santander in respect of a “retrieval duty” should be struck out and/or dismissed on a summary basis.

The grounds of appeal and Santander’s arguments in support

[21]By its appeal against the Master’s decision, Santander submits that it was an error of law to find it arguable that it owed a duty of care to CCP (with whom it had no relationship) to take reasonable steps to retrieve the sums paid out to the fraudster/s. Submitting that the Master ought to have found there was no real prospect of CCP succeeding on its claim, Santander contends:(1) As a matter of law, it was wrong to hold (per [81] of the judgment below) that “it is not necessarily fatal to the claim that theremay have been no assumption of responsibility” by Santander to CCP; an assumption of duty was a necessary element of a tortious claim for pure economic loss.(2) The Master further erred in drawing an analogy with HXA v Surrey: first, because that decision was concerned with the existence of a duty to prevent, not rectify, harm, which was not this case; second, because he had failed to identify any status on the part of Santander that created an obligation to protect CCP from the relevant danger.(3) Failing to recognise that an alleged duty to retrieve fell outside the existing established categories of tortious liabilities, the Master had applied an incorrect test for the incremental development of duties in tort; applying the right test could only have led to the conclusion that there was no realistic prospect of CCP establishing a duty of care.(4) It was, further, an error of law to find that Santander owed a duty to the customer of the paying bank (NatWest) to take reasonable steps to retrieve the payments, when that was inconsistent with the Master’s earlier (correct) finding that Santander had no prior (Quincecare) duty to stop payments leaving the account.(5) The Master erred in his understanding of the decision in Philipp, confusing the legal relationship between a bank and its customer on the one hand, and a bank and a third party customer of a different bank on the other.(6) It was also a mistake in law to fail to give due weight to the finding in Philipp (at [117]) that a bank cannot countermand its customer’s instructions, to whom it owes a strict and overriding duty. As a consequence, the Master wrongly found the alleged duty to be arguable even though it would put a bank in a position of inherent conflict with its customer.(7) The Master had, further, erred in misdirecting himself as to the proper role of the courts (see Philipp at [6]).(8) A further error arose in relation to the nature and extent of CCP’s claim, which could (at most) be a claim for loss of a chance.

The case for CCP

[22]In seeking to resist Santander’s appeal, and uphold the Master’s judgment, CCP emphasises that the decision was not that a bank in the position of Santander does have a duty of retrieval, but that it was arguable that it can do so; that, CCP submits, was consistent with the decision in Philipp at [118]-[119]: had the Supreme Court intended to restrict the retrieval duty to the issuing bank, it would have made that clear. There was no reason why Santander could not be liable to CCP for losses flowing from harm that was reasonably foreseeable; to restrict the duty would be illogical and unfair, given the receiving bank in an APP fraud would have greater control over the money. The Master had correctly determined that the question whether Santander had complied with its duty to retrieve funds for the benefit of CCP was one that was inappropriate for summary disposal and must be determined at trial; CCP’s claim had more than a fanciful prospect of success. Turning to the specific arguments raised by Santander, CCP submits:(1) It was possible for a duty of care to arise in tort even where there was no assumption of responsibility; in Donoghue v Stevenson [1932] AC 562at 564, a duty of care was held to exist, notwithstanding the absence of a contractual relationship, where “(1) the article is dangerous per se, and(2) where the article is dangerous to the knowledge of the manufacturer”. In the present case the danger was Santander’s customer and the report made to Santander put it on notice of this. In relation to the recovery of pure economic loss, the law had developed so as to apply to other situations where there was no contractual relationship (see e.g. Spartan Steel v Martin & Co [1973] QB 27at 28), provided three factors existed (per Caparo Industries v Dickman [1990] 2 AC 605at 609): (i) a sufficient degree of proximity, (ii) relevant knowledge, and (iii) it would be fair, just and reasonable to impose liability. (2) There was no error in drawing an analogy with HXA v Surrey: as the holder of the funds, Santander had special control; once informed of the fraud, Santander should have retrieved the funds from the fraudsters to prevent harm to CCP. The Privy Council decision in RBSI was not binding on the Master and did not address the responsibility of a bank when fraud was reported.(3) The retrieval duty owed to customers (per Philipp) was not restricted to issuing banks; it fell squarely into the category of being (i) a coherent and incremental development from existing categories of case where a duty has been recognised, (ii) analogous with such proximate categories, (iii) one which avoided inappropriate distinctions, (iv) consistent with existing legal obligations in overlapping or proximate areas, and (v) just, fair and reasonable.(4) Such a duty did not contradict the finding that Santander had no prior duty to stop the payments leaving the account; rather, it recognised that the retrieval duty was engaged once evidence of the fraud has been revealed or provided to the bank. The retrieval duty was triggered by a different set of facts and at a different stage in the transaction process; it was not grounded in the prevention of harm but in the rectification of a wrong that had already occurred.(5) The decision in Philipp did not restrict the retrieval duty to the contractual relationship between the customer and its bank; there was no reason why this duty should not extend to a bank and a third party where the bank was in control of their funds. The Master’s analysis provided a judicial attempt to apply the principles set out in Philipp, key to which were the notification and the availability of funds if reasonable steps were taken upon notification.(6) As noted by Birss LJ at [27] of the Court of Appeal decision in Philipp v Barclays UK plc [2022] EWCA Civ 318, it is possible for duties to co-exist; where a receiving bank is told its customer is acting fraudulently, no conflict exists: it must act to prevent the promulgation of that fraud by taking steps to retrieve the money paid out of the customer’s account to other receiving banks.(7) More generally, the court’s common law function in the development of tortious duties was available in this case: the Supreme Court had already identified a retrieval duty, which was not restricted to issuing banks alone.(8) As for the nature of CCP’s claim, it was accepted that this was put as a loss of a chance. Analysis and conclusions The approach to an application for strike out/summary judgment

Analysis and conclusions

[23]The Master was concerned with applications to strike out CCP’s case on the basis that it disclosed no reasonable grounds for bringing its claim (CPR 3.4(2)(a)), alternatively for summary judgment on the basis that it had no real prospect of success and there was no other compelling reason why the case should proceed to trial (CPR 24.3). As Coulson LJ observed at [20]-[21] in Begum v Maran (UK) Limited [2021] EWCA Civ 326, where a strike out is thus sought on the basis of the pleaded case, there is no difference between the tests to be applied by the court under the two rules.[24]In determining Santander’s applications, the principles to be applied were thus as set out by Lewison J (as he then was) in Easyair Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch), at [15] (in that case in respect of an application for summary judgment). To summarise:(1) the court must consider whether the claimant has a “realistic” as opposed to a “fanciful” prospect of success;(2) a “realistic” claim is one that carries some degree of conviction - it is more than merely arguable;(3) in reaching its conclusion, the court must not conduct a mini-trial;(4) this does not mean the court must take everything a claimant says at face value – it may be clear there is no real substance in factual assertions, particularly if contradicted by contemporaneous documents;(5) the court must, however, take into account not only the evidence before it on the application, but also the evidence that can reasonably be expected to be available at trial;(6) even where there is no obvious conflict, the court should consider if there are reasonable grounds to believe a fuller investigation into the facts would alter the evidence available and so affect the outcome of the case;(7) that said, if an application gives rise to a short point of law, and the court is satisfied it has before it all the necessary evidence and the parties have had adequate opportunity to address the point, it should grasp the nettle and decide it: if a respondent’s case is bad in law, it will have no real prospect of succeeding on the claim.[25]The present case essentially turns on a discrete question of law: in circumstances in which a customer of the paying bank has been fraudulently induced to make payments into an account held at the receiving bank (with which the customer otherwise has no relationship), when notice of the fraud is given to the receiving bank, is it under a tortious duty to take reasonable steps to retrieve or recover those payments for the customer of the paying bank?[26]In argument, Ms Sethi-Smith suggested that the Master’s judgment had to be seen in the light of what could not be summarily determined. Master Brown had accepted that there might be further evidence available at trial as to whether indemnities could be offered to other receiving banks further down the chain of payments (see the Master’s judgment at [56]), and did not consider he should discount the possibility of payments having been made out of the account to other banks (to which Santander had failed to offer an indemnity) (see [88]) or that there were other steps Santander could have taken ([89]). Acknowledging that the Master found these were matters that could not be resolved before trial, I do not, however, consider this avoids the question of law raised by the appeal: if, contrary to the reasoning underpinning the Master’s judgment, Santander owed no duty of care to CCP, these additional questions will not arise; CCP’s case will be bad in law and bound to fail.

The legal basis for the duty alleged against Santander

[27]Focusing then on the legal basis for the claim, the basic framework of duties owed by banks in these circumstances is clear from the case-law (most obviously as summarised by Lord Leggatt JSC in Philipp v Barclays Bank UK plc [2023] UKSC 25; [2024] AC 346), as follows:(1) When the current account with a customer is in credit, the normal relation between a bank and its customer is one of debtor and creditor, such that the bank is prima facie bound to meet its debt when called upon to do so (Philipp [28]; Foley v Hill (1848) 2 HL Cas 28).(2) In making such payments, the bank acts as its customer’s agent (Philipp [28]; Hilton v Westminster Bank Ltd (1926) 43 TLR 124, 126); it is an agent with no discretion, and is bound to act in accordance with the authority conferred on it by its principal and to perform what it has agreed to do (Philipp [29]; Bowstead & Reynolds on Agency (22nd ed, 2021) article 36, at 6-002-6-003).(3) A bank cannot be obliged to act unlawfully, but (unless otherwise expressly agreed) a genuine or reasonable concern on the part of the bank is not enough: the concern must be valid (Philipp [32]; Westpac New Zealand Ltd v MAP and Associates Ltd [2011] 3 NZLR 751). Specifically, a bank cannot act contrary to the regulatory constraints against money laundering, as imposed by the Proceeds of Crime Act 2002; it is an implied term of the contract between the bank and its customer that the bank may refuse to execute a payment instruction if to do so would involve such an offence (Philipp [33]; Shah v HSBC Private Bank (UK) Ltd (No. 2) [2013] 1 All ER (Comm) 72 at [39]-[45])(4) There is an implied contractual duty on a bank to carry out the services it supplies to its customer with reasonable care and skill (section 13 Supply of Goods and Services Act 1982 and section 49 Consumer Rights Act 2015). Likewise, a similar duty is owed in tort, but, as that duty arises out of the contractual relationship, it is no more extensive than the contractual duty (Philipp [34]).(5) Moreover, the requirement to exercise reasonable care and skill can only apply insofar as the contract gives latitude in how the relevant services are carried out; as a bank’s obligation is to carry out payment instructions in accordance with its mandate from its customer, it has little latitude in performing its obligation (Philipp [35]). And although the duty to use reasonable skill and care will apply to “interpreting, ascertaining, and acting in accordance with the instructions of a customer” (Selangor United Rubber Estates Ltd v Cradock (No. 3) [1968] 1 WLR 1555 at p 1609), this will not arise where the bank receives a valid payment order which is clear and leaves no room for interpretation or choice about what is required to carry out the order; the bank’s duty is then to execute the order by making the requisite payment (Philipp [63]): “The law cannot coherently treat compliance with an authorised instruction as a breach of duty” per Lord Sumption NPJ in PT Asuransi Tugu Pratama Indonesia TBK v Citibank NA [2023] HKCFA 3 at [14].(6) The duty identified in Barclays Bank plc v Quincecare [1992] 4 All ER 363 - namely a duty not to execute a payment instruction given by an agent of the customer without making inquiries if the bank had reasonable grounds for believing that the agent was attempting to defraud the customer - is an application of the duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions (Philipp [97]).(7) This Quincecare duty does not, however, apply where the customer has unequivocally authorised and instructed the bank to make the payment, even where the customer has done so as a victim of an APP fraud (Philipp [100]).(8) And, where a customer has unequivocally instructed a bank to make payment, the fact that its instruction resulted from the deceit of a third party does not invalidate it or give rise to any claim against the bank (Philipp [102]-[105]).(9) The Quincecare duty does not extend to third parties: a duty to protect innocent third parties against fraud is not an ordinary incident of the contractual relationship between a bank and its customer (Philipp [67]), and there is no good reason for incrementally developing the tort of negligence to impose an equivalent duty of care to third parties (RBSI [80]; Larsson v Revolut Ltd [2024] EWHC 1287 (Ch) at [49]-[62]).[28]For CCP it is argued that the decision of the Privy Council in RBSI was not binding on Master Brown, but that, in any event, it did not determine the question whether there could be a duty of retrieval in circumstances in which a receiving bank has been alerted to a fraud relating to an account over which it had control. In this regard, CCP submits that the Master was correct to distinguish the ruling in RBSI, which was concerned with a Quincecare duty to a third party and not a duty of retrieval, and which related to circumstances in which it was expressly recognised that the receiving bank “had no special level of control over the source of the danger (i.e. it was not in the control of the fraudsters)” (see the Master’s judgment at [83], and RBSI at [84]).[29]In oral argument, Ms Sethi-Smith also placed emphasis on the recognition at RBSI [79] to the possibility “exceptionally, for a duty of care to be owed by a professional or a bank to someone who is not a client or customer as regards pure economic loss”. That observation, however, expressly related to cases in which the purpose of the service provided was to benefit the third party; as Lord Hamblen and Lord Burrows JJSC (giving the judgment of the Board) noted, that was not the position for a receiving bank in circumstances akin to those arising in the present case:
“79. ... in the present case, none of these factors applies. In particular, one cannot say that the purpose of the [receiving] Bank’s service was to benefit third party beneficiaries of the Accounts. Rather, the purpose was to benefit the customer. Equally, one cannot say that the Fund [the payee and victim of the alleged fraud] placed direct reliance on the [receiving] Bank, or that it was or ought to have been known to the [receiving] Bank that any such reliance was being placed.”
[30]That distinction appears to have been recognised by the Master: in saying (see [81]) that “it is not necessarily fatal to the claim that there may have been no assumption of responsibility” by Santander to CCP, the Master was acknowledging that there was no basis for considering that the kind of exception identified in RBSI arose here: Santander had not provided a service that had the purpose of providing any benefit to CCP, and there was nothing to suggest that CCP had placed any reliance on Santander (or that Santander ought to have known that it had). In short, there was no assumption of responsibility such as to give rise to a duty of care to a non-customer of the bank.[31]Having accepted that Santander could not be said to have assumed a responsibility to protect CCP, the Master considered it might nevertheless be arguable that Santander could be seen as having (per HXA v Surrey at [88] (iii)) “a special level of control” over the source of the danger (that is, to have had “at least some measure of control over the ... movement of money from the account”), such that it was “in a special position to take steps to recover the sums due” (see the Master’s judgment at [82]). As I understand the reasoning in this regard, once notified of the potential fraud on CCP, the Master considered it arguable that Santander’s status created “an obligation to protect [CCP] from that danger” (per HXA v Surrey at [88] (iv)).[32]In HXA v Surrey, it was common ground that (applying the earlier decision of the Supreme Court in N v Poole Borough Council [2020] AC 780) the claimants needed to establish a relevant assumption of responsibility on the part of the local authority, such as to give rise to a duty of care at common law to protect them from harm (HXA v Surrey at [3]). As Lord Toulson JSC had observed in Michael v Chief Constable of South Wales Police [2015] UKSC 2, [2015] AC 1732, at [97]:
“It is one thing to require a person who embarks on action which may harm others to exercise care. It is another matter to hold a person liable in damages for failing to prevent harm caused by someone else.”
Thus, in circumstances in which liability was claimed for an omission (a failure to benefit the claimants by protecting them from harm by a third party), the Supreme Court in N v Poole had made clear that “one of the recognised exceptional principles must be established” (HXA v Surrey [88]), relevantly:
“76. In the tort of negligence, a person A is not under a duty to take care to prevent harm occurring to a person B through a source of danger not created by A unless ... (iii) A has a special level of control over that source of danger, or (iv) A's status creates an obligation to protect B from that danger.”
[33]In the circumstances of this case, however, there is a fundamental difficulty in postulating a “special level of control” on the part of Santander in relation to the account given the primacy of its contractual relationship with its customer – the owner of the account. The duty of care identified by the Master’s judgment would be to protect CCP against the alleged fraud of Santander’s own customer. The fact that a fraudster held an account with Santander did not, however, give the bank any control over that customer; indeed, its obligation was to comply with its customer’s instructions. Equally, Santander had no relationship with CCP, and there could be no basis for assuming that its status as the bank at which the fraudster held an account in some way gave rise to an obligation to protect those who might be harmed by its customer’s actions. Thus, Lords Hamblen and Burrows JJSC, giving the judgment of the Privy Council in RBSI, were clear:
“84. Applying [the principles identified at [76] N v Poole] to the present case, it can be seen that the Bank had no special level of control over the source of the danger (ie it was not in control of the fraudsters) and ... it cannot be said to have assumed responsibility to protect the Fund [the victim of the fraud] from the fraud. Therefore, viewing this case through the lens of the conduct of the defendant being an omission, in the sense of a failure to protect the Fund from the fraud of the Bank’s customer, further supports the decision that the Bank owed no duty of care to the Fund.”
[34]The Master nevertheless sought to distinguish the conclusion reached in RBSI as being concerned with a Quincecare duty (not a duty of retrieval), involving a “factual situation” that was “quite different”.[35]While it is correct that a duty of retrieval had not been postulated in RBSI, I do not understand the facts of that case to otherwise give rise to a material difference. The issue the Privy Council had to address related to the bank’s failure to prevent wrongdoing on the part of its customer causing loss to a third party. Although CCP no longer seeks to pursue a claim put on the basis of a Quincecare type duty owed to it as a non-customer of Santander, no other material distinction with the factual situation of RBSI has been identified.

A duty of retrieval – Philipp [115]-[119]

[36]In order to understand the distinction thus made by the Master, it is necessary to consider the basis of the duty of retrieval that lies at the heart of his decision, stated to derive from Lord Leggatt’s judgment in Philipp at [115]-[119]. In that section of the judgment, consideration is given to the “fallback argument” by Mrs Philipp, that Barclays Bank was in breach of duty after the fraud had been discovered “in not taking adequate steps to recover the money which had been transferred” (Philipp [115]). Although expressing strong doubts as to whether there was any realistic basis on which Mrs Philipp might claim that delay on the part of the bank caused her to lose a substantial chance of getting any of her money back, the judge at first instance had considered that there were “too many imponderables in this counterfactual scenario for the matter to be decided ... on paper” (Philipp [119]). That, Lord Leggatt allowed, was “a matter of judgment” on which it would not be right for the Supreme Court to override the view taken by the judge.[37]In considering this argument, however, the judge had regarded it as untenable to suggest that Barclays should have taken steps to try to recall the payments before 27 March 2018, which was the date on which Mrs Philipp had herself notified the bank that she believed she was a victim of fraud. Although Barclays had in fact already put a stop on Mrs Philipp’s account as a result of a contact from the police on 16 March 2018, Lord Leggatt agreed that the judge’s decision in this regard “was undoubtedly correct”, noting:
“117. ... [Barclays] had no authority, let alone obligation, to attempt to reverse earlier transactions when to do so would have been directly contrary to its customer’s payment orders. ...”
[38]As for the duty that might arguably have arisen after receiving Mrs Philipp’s notification on 27 March 2018, Lord Leggatt articulated this as follows:
“118. ... it is arguable that, when [Mrs Philipp] reported that she had been induced to make the payments by fraud, the Bank’s staff should have sought her instructions on this point - which would surely have been given - as it was clear that Mrs Philipp would now wish any available steps to be taken to recover the money. The fact that the Bank made attempts on and after 31 May 2018 to recall the funds which had been transferred to the UAE ... indicates that there were steps that could be taken to try to do so and prompts the question of why the Bank did not take those steps sooner. These are not matters that can be resolved at this stage of the proceedings on an application for summary judgment.”
[39]The (arguable) duty identified is thus recognisable as a further potential application of the duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions (Philipp [97]). This is a duty arising from the contractual obligation owed by a bank to exercise reasonable skill and care (Selangor p 1609; Philipp [63]), such that, when notified of a potential fraud by its customer the bank arguably has a duty to obtain that customer’s instructions as to whether it should take steps to recover previously authorised payments out of the customer’s account. Akin to the Quincecare duty, this potential extension of the obligation owed by a bank in such circumstances is similarly no more than a facet of its contractual duty to properly ascertain and comply with its customer’s instruction. Relying on this part of the judgment in Philipp, however, the Master considered it arguable that a duty of retrieval might nevertheless arise in relation to a receiving bank, which had no contractual relationship with the victim of the fraud.[40]In determining whether this could give rise to a sustainable claim in the present case, I bear in mind that the decision of the Supreme Court in Philipp merely allowed that the judge at first instance made a permissible judgment call in not striking out the claim when(i) the victim was the bank’s customer, and(ii) that customer had notified the bank of the alleged fraud; even then, as Lord Leggatt made clear, any duty was dependent on first obtaining the customer’s instructions. I am unable to read into this part of the judgment in Philipp any basis for holding that there might be a freestanding duty upon a bank to take positive steps to unwind harm already caused to a third party (with whom it had no contractual relationship) by attempting to reverse payment orders previously entirely properly made on the instructions of its own customer; indeed, such a duty would plainly be in conflict with the observation made by Lord Leggatt at [117], that, absent instruction from its customer, the bank would have “no authority, let alone obligation, to attempt to reverse earlier transactions when to do so would have been directly contrary to its customer’s payment orders”. A duty of retrieval as a novel duty of care or incremental development of the law[41]The case of Larsson v Revolut Ltd [2024] EWHC 1287 (Ch) also concerned a form of APP fraud, whereby Mr Larsson (who was a customer of Revolut) had been induced to transfer money into five other accounts at Revolut, which was then transferred out by the fraudsters, leaving the destination accounts empty. When Mr Larsson sued Revolut in contract and tort, Revolut applied for the claims to be struck out and/or for summary judgment. Mr Larsson’s claim in tort was put on the basis that there was a duty owed by a recipient bank to a person who causes a payment to be made to an account held at that bank by one of its customers (and although Revolut is an electronic money institution and not a bank, for the purposes of the hearing of its application, it accepted that it would owe materially the same duties as a bank). Acknowledging that the recipient bank would, in general, owe no duty to a third party (such a duty being precluded by RBSI), Mr Larsson argued that the position was different where the person making the payment also happened to be a customer of the receiving bank (so not a “true” third party; see Larsson [43]); in such a case, the duty owed was to “have adequate systems in place, and to operate those systems, to minimise user error and fraudulent use of Revolut accounts” (Larsson [45]).[42]Considering whether such a duty of care should be recognised, Zacaroli J (as he then was) referred to the observations of Underhill LJ (with whom the other members of the Court of Appeal agreed) at [55] Benyatov v Credit Suisse Securities (Europe) Ltd [2023] EWCA Civ 140, as follows:
“The correct course for a court which has to decide whether a duty of care should be recognised in a novel situation is to take the incremental approach endorsed in Robinson [Robinson v Chief Constable of West Yorkshire Police [2018] UKSC 4, [2018] AC 736]. That will in principle involve consideration of the three “Caparo factors” to the extent that they are in issue. It may be a useful analytical tool, particularly in considering the factors of proximity and/or “fairness, justice and reasonableness”, to ask whether the defendant can be regarded as having assumed a responsibility to take care to protect the claimant against a loss of the kind claimed; but its usefulness will depend on the issues in the particular case.”
[43]As Zacaroli J noted (Larsson [47]), the “Caparo factors” are those identified by the House of Lords in Caparo Industries plc v Dickman [1990] 2 AC 605: foreseeability, proximity, and fairness, justice and reasonableness. Applying this approach, Zacaroli J was clear: just as it was accepted that no duty of care was owed to a “true” third party (RBSI), no duty arose simply because the payee happened to be a customer of the receiving bank. In circumstances in which the payment in question was unconnected with the banker-customer relationship (as was the position when Mr Larsson was transferring monies to other accounts at Revolut), Zacaroli J did not consider any proximity that would otherwise exist between Revolut and Mr Larsson as its customer as relevant. As for what would be “fair, just and reasonable”, observing that the burden that would be placed on banks “would be materially the same as if such a duty was owed to all third party payers” (Larsson [52]), Zacaroli J rejected Mr Larsson’s case as crossing the line “between the proper role of the courts, and the role of the legislator and regulator” (Larsson [57]).[44]In my judgement, the same analysis applies in the present case. Although Larsson concerned an argument founded upon a Quincecare type duty, the same points would apply to any attempt to extend an arguable duty of retrieval, as allowed in Philipp, to third parties such as CCP.[45]Even if it is assumed that a bank in Santander’s position might reasonably foresee harm to innocent third parties once alerted to the fact that one of its accounts had been used by fraudsters, it has no relationship with such a third party as would give rise to the necessary quality of proximity (and see the clear ruling at [84] RBSI). Although, as previously discussed, the Master seems to have considered that proximity was established by reason of Santander’s “special level of control” over “the movement of money from the account held by the fraudulent gang” (see the judgment below at [82]), there could be no basis for implying such “control” on the part of a bank in these circumstances: at the time when the money was removed from the account, Santander’s only obligation was to obey the instructions of its customer. Equally, even when Santander had been notified (by Lloyds) about the potential fraud (on 21 October 2016, when Santander put a stop on the account), and told (by NatWest) of the identity of CCP as the victim, I am unable to understand what “status” Santander could be said to have had such as to create an obligation to protect CCP from danger (not least as, by close of business on 20 October 2016, all but £5.39 had been removed from the account).[46]As for the question whether it would be fair, just and reasonable that a duty of care should be imposed on Santander in these circumstances: given that it is clear that this would not be so in respect of a potential third-party Quincecare duty (per RBSI and Larsson), I cannot see how a different conclusion could sensibly be reached in relation to a potential duty of retrieval said to be owed to non-customer third parties. In saying this, I recognise the very real harm suffered by victims of APP fraud and it is apparent that the voluntary scheme of indemnities operated by banks seeks to mitigate this harm. The existence of such a scheme does not, however, provide a proper basis for the implication of a duty of care in these circumstances; the fact that banks are willing to take steps to try to assist victims of fraud does not mean that the courts should find they have a legal obligation to do so.[47]As presently pleaded, the duty for which CCP contends would require that, upon a fraud alert being raised by a stranger in relation to an account held by one of its customers, a bank must contact all other banks into which monies from the account have been transferred, and (contrary to the instructions of its customer) either seek an immediate recall of those sums or otherwise not allow further movements of those monies. That, it seems to me, would put a bank in the impossible position of having to make a speedy adjudication upon an allegation of fraud made against one of its customers by a third party. Even if it were possible to overcome that difficulty, it is hard to see how such an obligation would work given the number of transactions likely to be involved and the speed at which such transactions are required to be made; it would, as observed in RBSI at [80], place an unacceptable burden on banks going outside their contractual obligations with their customers - as Santander has pointed out, in its skeleton argument for this appeal:
“36. The essence of modern day banking is that banks are required to process a high volume of payments within the short timescales expected or demanded by their customers. For example, in March 2021 alone, almost 560 million BACS payments, 4.4 million CHAPS payments and 292 million Faster Payments were processed, to the total value of over £8.5 trillion (See https://www.wearepay.uk/wp-content/uploads/Monthly-Payment-Statistics-Mar-2021.pdf.) The processes are largely automated without human intervention and the volume and required speed of transactions makes manual checks impossible. Time is frequently of the essence. The sort of onerous duty which CCP seeks to impose on Santander – involving an as-yet unparticularised chasing of funds through a chain of subsequent generation of receiving banks (potentially – indeed, arguably likely – out of the jurisdiction) – is entirely at odds with the nature and scale of the task with which banks are faced, ....”
[48]The incremental development of a duty of care is not a purely academic exercise; determining what is fair, just and reasonable requires that regard is had to the relevant context. As Lord Leggatt noted in Philipp at [16], banks operate in a heavily regulated legal environment, which recognises the balance that has to be struck between the need for payments to be facilitated at speed and the desirability of increasing protections against fraud. The Payment Services Regulations 2017 (SI 2017/752) (“the PSR”) can be seen to weigh on the side of the balance that seeks to ensure a speedy and unhindered payment system, providing that a payment order executed in accordance with the unique identifier will be deemed to have been correctly made (regulation 90(1) PSR), albeit that may make it harder to protect victims of APP frauds. On the other side of the balance, recognising a need to do more for fraud victims, a mandatory reimbursement scheme was established by the Financial Services and Markets Act 2023 (which received Royal Assent on 29 June 2023), which would, as from 7 October 2024, reimburse a victim of an APP fraud to a maximum of £85,000.[49]Any consideration of the history of these measures (summarised in Philipp at [19]-[21]), and the regulatory environment more broadly, underlines why an obligation such as that contended by CCP is not to be implied at common law. The point is clearly made in Philipp: see per Lord Leggatt at [22]-[24], and as summarised at [6]:
“... Whether victims of such frauds should be left to bear the loss themselves or whether losses should be redistributed by requiring banks which have made or received the payments on behalf of customers to reimburse victims of such crimes is a question of social policy for regulators, government and ultimately for Parliament to consider… it is not a question for the courts. It is not the role of the courts to formulate such policy, still less to impose on the parties to a contract an obligation to which they have not consented and cannot reasonably be presumed to have consented since it is inconsistent with the normal and established allocation of risk and responsibility under contracts of the relevant type.”

Decision

[50]On the particular facts of this case, it is hard to see that CCP’s claim could ever have been anything more than fanciful. The undisputed chronology makes clear that the money had been removed from the account before Santander was alerted to a possible fraud. As soon as it was so notified (by Lloyds, on 21 October 2016), Santander put a stop on the account and, when it was contacted by CCP’s bank (on 22 October 2016), Santander duly offered indemnities to Lloyds. The time-line in the present case stands in contrast to that in Philipp, where attempts to recall the payments were not made until the end of May 2018, notwithstanding the fact that Mrs Philipp had alerted the bank to the fraud on 27 March 2018.[51]Even if there was any dispute as to the chronology, however, for the reasons I have provided, I am, as a matter of law, unable to see any proper basis for considering that the claim could have any realistic prospect of success. That a receiving bank in these circumstances cannot be taken to have assumed any responsibility to the third-party victim of the fraud was made clear in RBSI. The identification in Philipp of an arguable duty of retrieval, owed by a bank to its own customer and arising out of the contractual relationship between them, does not alter that position. Acknowledging the potential existence of such a duty does no more than allow that this might be a further facet of the bank’s contractual obligation to properly ascertain and comply with its customer’s instruction; it provides no basis for the incremental development of an equivalent duty owed to a party with whom the bank had no contractual relationship. To imply such a duty would, in my judgement, cross the line between the proper role of the courts and that of the legislator and regulator (Larsson [55]).[52]In the circumstances, I am satisfied that the Master erred in dismissing Santander’s application for strike out/summary judgment in respect of the claim based on a duty of retrieval. CCP’s case in this regard was bad in law and could have no real prospect of success. I therefore allow the appeal and set aside the Master’s judgment, substituting a finding that the application for strike out/summary judgment should be allowed in its entirety.[53]This judgment having been circulated to the parties and their legal representatives in draft form in advance of handing down, the parties are directed to file an agreed draft minute of order (or, in the absence of agreement, a draft minute of order that highlights any points in dispute) at least two working days before the date fixed for the handing down of judgment. Should either party seek to make any further applications consequential upon my decision herein, such application, together with concise written submissions in support, should also be filed and served at least two working days before the date of hand down.