/security

News and resources on cyber and physical threats to banks and fintechs worldwide.

Santander scores victory in APP fraud retrieval case

Santander has scored a significant High Court victory in a push payment fraud case over its responsibility to return £415,000 that was sent to a scam account.

  3 1 comment

Santander scores victory in APP fraud retrieval case

Editorial

This content has been selected, created and edited by the Finextra editorial team based upon its relevance and interest to our community.

Between 13 September and 12 October 2016, CCP Graduate School was duped by fraudsters to authorise payments totalling £415,909.67 from its account with National Westminster Bank into an account at Santander, which was held in the name of PGW Consultants Limited.

Consistent with the fraudsters’ directions, CCP’s instructions identified the account holder as “PGW Limited”. The payments were processed without reference to the account name of the recipient, in accordance with standard practice at the time.

On 18 October 2022, CCP brought claims against both NatWest and Santander. CCP alleged that Santander owed a duty to take reasonable care to prevent Santander accounts from being used as instruments of fraud, and had breached that duty by allowing the funds received into the account from the NatWest account to be transferred out.

Both banks applied for the claims against them to be struck out, and for reverse summary judgment. While NatWest was given the all-clear, CCP cross-applied for permission to amend its claims against Santander, to allege breaches of a “retrieval duty”.

In ruling in Santander's favour, Court judge Jennifer Eady stated that "a receiving bank in these circumstances cannot be taken to have assumed any responsibility to the third-party victim of the fraud" and that there was no basis for finding that Santander’s status as the fraudster’s bank in “some way gave rise to an obligation to protect those who might be harmed by its customer’s actions".

Also of significance for the banking industry is the finding, in respect of the system of indemnities, that “the fact that banks are willing to take steps to try to assist victims of fraud does not mean that the courts should find they have a legal obligation to do so.”

Eady noted that requiring banks to investigate and halt every suspected fraudulent transfer would create "an unacceptable burden".

The case follows a similar 2023 Supreme Court case against Barclays, which largely dismissed claims about banks' responsibilities in APP fraud scenarios.

Sponsored [On-Demand Webinar] Why Financial Services firms are prioritising application modernisation in 2025

Comments: (1)

A Finextra member 

If a receiving bank cannot be held responsible to a third party victim of fraud, by the same logic nor can a social media company when their platform is used to initiate frauds.

Banks still need to do more to prevent fraudsters from operating bank accounts. The APP reimbursement rules, which came into effect after this fraud, go some way to encourage banks to do more (by making the fraudster's bank 50% liable for fraud up to £85k).

 

[Webinar] Conducting the payments orchestra: Why IT will drive future transaction banking modelsFinextra Promoted[On-Demand Webinar] Conducting the payments orchestra: Why IT will drive future transaction banking models