APP (authorised push payment) fraud continues to be a huge criminal enterprise. This type of fraud, where the perpetrator is unknown, makes recovery, whether through civil courts or criminal law enforcement, difficult (albeit not impossible). Money paid away by a victim to a fraudster’s bank account is most often immediately passed to one or more further accounts controlled by the fraudster, frequently held abroad, making tracing and freezing the funds problematic. That has resulted in pressure on UK banks to compensate victims, even where the bank is not at fault. Compensation of up to £85,000 for payments made on or after 7 October 2024 is now available under the mandatory compensation scheme introduced by the Payment Systems Regulator, but this does not apply to sums over £85,000 or payments made from a UK to a foreign bank. In such cases, the victim must fall back, in most cases, on trying to track the stolen money. An alternative, which is often seen as the easier route, is trying to allege negligence by one of the banks through which the stolen funds have passed to try to recover from them.

The Court of Appeal in a recent decision in Santander UK PLC v CCP Graduate School Ltd has clarified the limited scope of duties owed by the bank which initially receives the APP payment from the victim (the first recipient bank). If, by the time the first recipient bank is notified of the fraud, its customer has already paid away the funds to other bank accounts, the first recipient bank has no duty to try to retrieve that money.

The decision of the Supreme Court in Philipp v Barclays Bank UK PLC [2022] EWCA Civ 318 had left the door open to a duty on a bank to retrieve APP payments once it has been notified that they were obtained by fraud. The Court of Appeal has, however, explained that this duty can only apply between a bank and its customer, being no more than a “facet of the bank’s contractual obligation to properly ascertain and comply with its customer’s instruction.” We as lawyers will always look for creative ways to reunite clients with their stolen funds. However, this decision shuts the door on a victim’s claim against a recipient bank (as opposed to the victim’s own bank which makes the payment) which fails to take steps to recover stolen money after that money has already been paid onto further accounts.

Santander UK PLC v CCP Graduate School Ltd [2025] EWHC 667 (KB) (25 March 2025)