Santander UK Plc v CCP Graduate School Limited

A receiving bank does not owe a tortious duty to retrieve payments made into its customer’s account by a fraud victim who is a customer of another bank. The arguable retrieval duty identified in Philipp is a facet of the contractual duty owed by a bank to its own customer to ascertain and comply with instructions. It does not create a freestanding duty to reverse authorised payments or protect non-customers from fraud by the receiving bank’s customer. The absence of contractual relationship, assumption of responsibility, proximity and special control is decisive. The voluntary inter-bank indemnity scheme does not justify imposing such a duty at common law. Questions concerning redistribution of APP-fraud losses are matters for regulators, government and Parliament.

CCP Graduate School Limited was induced by an authorised push payment fraud to transfer £415,909.67 from its NatWest account into an account held by the alleged fraudster at Santander. Most of the money had left the Santander account before Santander was notified of the fraud.

CCP sued NatWest and Santander. Master Brown struck out the Quincecare-based claim against Santander but held that a separate claim based on a tortious duty of retrieval was sufficiently arguable to proceed. Santander appealed that decision. The central issue was whether a receiving bank, which had no contractual relationship with the victim, owed a duty to take reasonable steps to retrieve or recover the payments after notification of the fraud.

1. Appeal allowed. Santander’s application for strike out and/or summary judgment was allowed in its entirety. The Master’s judgment was set aside.
2. On an application under CPR 3.4(2)(a) and CPR 24.3, the court must ask whether the claim has a realistic, rather than fanciful, prospect of success. Where the issue is a short point of law and the necessary material is available, the court should decide it without sending a legally hopeless claim to trial.
3. The ordinary banker-customer relationship is contractual. A bank must comply with its customer’s valid payment instructions, subject to legal and regulatory constraints. The duty of reasonable care and skill does not permit the bank to treat compliance with a clear authorised instruction as a breach of duty.
4. The Quincecare duty is an application of the bank’s duty to interpret, ascertain and act on its customer’s instructions. It does not apply where the customer unequivocally authorised the payment, including in an APP fraud, and it does not extend to third parties.
5. The retrieval discussion in Philipp concerned a possible further facet of the contractual duty owed by a bank to its own customer. It depended on obtaining that customer’s instructions. It did not establish a freestanding tortious duty owed by a receiving bank to a victim who was a non-customer.
6. The principles in RBSI, HXA and Larsson precluded the alleged duty. Santander had not assumed responsibility to CCP, had no special level of control over the fraudster, and its status as the fraudster’s bank created no obligation to protect CCP. Imposing the duty would also be inconsistent with the bank’s obligations to its customer and would not be fair, just and reasonable.
7. The voluntary indemnity arrangements between banks were insufficient to support a common-law duty. The proposed obligation would require rapid adjudication of third-party fraud allegations and tracing payments through potentially extensive chains of banks. The regulatory framework, including the Payment Services Regulations 2017 and later reimbursement provisions, reinforced that the allocation of APP-fraud losses was a matter for the legislature and regulators.
8. On the undisputed chronology, the money had substantially left the account before Santander received the fraud alert. In any event, CCP’s pleaded retrieval claim was bad in law and had no real prospect of success.

• High Court (King’s Bench Division): Santander’s appeal from Master Brown’s decision of 14 March 2024 was allowed. The Master’s refusal to strike out or summarily dismiss the retrieval-duty claim was set aside, and the application was allowed in full.