APP fraud: recovery against financial institutions

What is “authorised push payment” fraud?

According to the National Crime Agency, fraud is the most prevalent crime in the UK, the majority of which is cyber-enabled.¹ An increasingly common tactic involves fraudsters impersonating law enforcement officers or bank staff to pressure individuals into paying them. Where the victim is deceived into authorising their bank (i.e. the “paying bank”) to make such a payment, this is known as “authorised push payment” (APP) fraud, so-called because, on its face, the payment was authorised by the victim as opposed to criminals directly stealing from the victim’s account.

UK Finance reported that there were over 240,000 instances of APP fraud in 2025, totalling losses of £576.4 million (up 19% from 2024). Of that, banks reimbursed £354.3 million to victims (61% of losses).² According to the National Crime Agency, fraud remains the most prevalent headline crime in 2025 and accounts for 45% of all crime in England and Wales.³

Where does the mandatory reimbursement scheme stop?

For consumers, micro-enterprises or small charities, the first port of call is not litigation. Since 7 October 2024, the Payment Systems Regulator introduced a mandatory scheme requiring payment service providers to reimburse victims of APP fraud.⁴ The main features are:

• Reimbursement of up to £85,000 per claim, with the cost shared equally between the sending and receiving institutions.
• Reimbursement by the sending institution within 5 business days, which may be extended up to 35 business days if they need to investigate further.
• An excess of up to £100 may be deducted from any amount that is reimbursed (other than claims made by vulnerable customers).
• Reimbursement may be denied if the institution can demonstrate that the victim has, with gross negligence (i.e. a significant degree of carelessness), failed to meet the “consumer standard of caution” (unless the victim is a vulnerable customer). The customer should have regard to warnings by the institution, promptly report the fraud to the institution and the police, and share information with the institution.

The scheme only applies to domestic Faster Payments and CHAPS payments; international transfers are not covered.

The Financial Ombudsman Service offers a further route for consumers and eligible small businesses, with a compensation limit of £455,000 for acts or omissions that occurred on or after 1 April 2019.

Why go after financial institutions?

It seems obvious (and just) that a victim should seek to recover their losses from the perpetrators. Legal mechanisms available to support such a claim include: (1) third party disclosure orders (Bankers Trust / Norwich Pharmacal) against the bank which received the payment (i.e. the “recipient bank”) to identify the account holder and ascertain whether the funds have been transferred onwards (and if so, where); (2) freezing/proprietary injunction to preserve funds for recovery.

Such exercises are, however, difficult and expensive in practice; often the culprits have absconded, and the defrauded sums have long been dissipated. Alternative potential avenues of redress are the paying bank or recipient bank, whose identities are known and liquidity most likely not in doubt.

Can you claim against the paying bank?

In the landmark decision Philipp v Barclays Bank UK plc,⁵ the Supreme Court explained the (commonly called) “Quincecare duty” owed by the bank to its customer⁶ as being not a special rule of law, but simply an application of the general duty to follow the customer’s instructions. Where there are reasonable grounds for the bank to believe that the person giving the payment instruction is attempting to defraud the customer, the bank must first make inquiries to verify that the instruction was actually authorised before executing it. Where the paying bank follows an instruction which is not authorised, it cannot debit the customer’s account. The consequence is that the customer victim can sue:

1. In debt: as the debit was unauthorised, the amount remained to the credit of the customer at law. The bank has to restore the account to its correct balance; and/or
2. For damages in breach of contract and/or tort: the bank may be in breach of its contractual mandate and/or have failed to carry out its services with reasonable care and skill.⁷

Individual victims versus corporate victims

It would be difficult for most individual victims to recover from the paying bank: while they may be mistaken when giving instructions, they nevertheless intended the bank to effect payment. Philipp makes clear that, if there is no independent reliable information to suggest to the bank that the instruction was not authorised, it need not be concerned with the wisdom or purpose of the customer’s payment decision.⁸ On those facts, Mrs Philipp, who was persuaded by a fraudster to make payments, had confirmed her instructions in person and on the telephone with her bank. That did not give rise to any claim against the bank.

In contrast, where the bank customer is a company, it is at law a separate legal entity which necessarily operates through its officers. There is accordingly a real risk that the representatives giving instructions on the company’s behalf to the bank may lack authority (whether actual or apparent).⁹ Corporate victims could argue that the representative acted dishonestly such that the bank was placed on inquiry. This argument was successful in an earlier decision by the Hong Kong Court of Final Appeal, PT Asuransi Tugu Pratama Indonesia TBK v Citibank NA¹⁰ (Lord Sumption NPJ giving the judgment, the reasoning of which was largely consistent with Philipp). In that case, the company victim claimed against the bank for payments made upon dishonest instructions of its two authorised signatories to themselves and other officers. The court found that the operation of the account was unauthorised, the bank was put on inquiry, and its inquiries were inadequate.

Given the analysis in Philipp that the issue is essentially one of authority based on general principles of agency, the following arguments appear to be available.

First, an agent acting contrary to a principal’s interests (even if not extracting gain for themselves) may be sufficient to put the bank on inquiry. Support is found in Philipp, which states that an agent’s authority only includes authority to act honestly in pursuit of the principal’s interests.¹¹ Thus, where an agent was deliberate or reckless (albeit possibly honestly) in giving a payment instruction contrary to their principal’s interests, the bank may be required to make reasonable inquiries before relying on that instruction.

Second, the bank does not need to be aware of the precise reason for a lack of authority before it may be liable. It would frequently be the case that, in giving the payment instruction, the employee has failed to comply with internal authorisation procedures of the company that are not known to the bank. However, if there are suspicious circumstances about the transaction apparent to the bank, it should nonetheless have to make reasonable inquiries.

Can you claim against the recipient bank?

Claims against recipient banks have traditionally been difficult to pursue by reason of the absence of contractual or tortious duties towards the victim.¹² Unjust enrichment claims (on the ground that the payment was made under a mistake) were similarly challenging by reason of case law to the effect that a recipient bank was not enriched by the receipt of funds for an account holder (Jeremy D Stone Consultants Ltd v National Westminster Bank plc¹³) and any enrichment was not at the victim’s expense (Tecnimont Arabia Ltd v National Westminster Bank plc¹⁴).

However, HHJ Paul Matthews rejected these arguments in his judgement on a reverse summary judgment application in the case of Terna Energy Trading DOO v Revolut Ltd (Payne Hicks Beach LLP acted for the successful respondent).¹⁵. In Terna the claimant was fraudulently induced by third parties to make a payment to the defendant “electronic money institution” (EMI) and sought recovery in unjust enrichment.

On “enrichment”, the Judge rejected the argument that, where a bank receives a payment, an immediate balancing liability matches it in the form of a debt owed to its customer, such that the bank cannot be enriched. The question of enrichment is inherently tied to the question of whether the defendant (agent) is under any liability to account to its customer (principal) for the payment (i.e. whether the defendant has any defences). Further, the defendant was the legal and beneficial owner of the incoming payment (EMIs are not relevantly different from ordinary banks). The Judge considered that Jeremy D Stone was not binding and, in any event, wrong in principle.¹⁶

On “at the claimant’s expense”, the Judge held that this requirement was satisfied whether viewing this as a case of agency or a series of co-ordinated transactions (applying Investment Trust Companies v HMRC¹⁷). The transaction intended by the claimant was a transfer of funds from its account with its bank to the defendant. It did not make any difference how many correspondent banks were involved along the way (declining to follow Tecnimont).¹⁸

While Terna settled shortly before trial in February 2026, HHJ Paul Matthews’ judgment leaves the door open for victims to claim unjust enrichment against recipient banks.

Further, the approach in Terna was followed (albeit strictly obiter) in D’Aloia v Persons Unknown, Binance Holdings Ltd & Ors.¹⁹ That case involved a claim by a victim of a cryptocurrency scam against various defendants, including Bitkub, a Thai crypto-exchange. It was argued that the victim’s USD Tether,²⁰ which passed through various crypto-exchanges, had arrived in a digital wallet linked to a fraudster’s (one Ms H) account on Bitkub.

While the victim was fundamentally unsuccessful due to a lack of evidence that the crypto in Ms H’s account was either traceable to the victim’s funds or received at the victim’s expense,²¹ the Judge considered that, in principle, Bitkub was enriched at the point of receipt.²² To establish a defence, Bitkub had to act in good faith when it paid the funds away at Ms H’s instructions. On the facts, the Judge found that Bitkub had actual notice of suspicious activity on the account, including that Ms H’s withdrawals were in breach of her account limits imposed to counter money laundering. In turn, this should have caused Bitkub to suspend her account pending an investigation; thus, had the defences been relevant, Bitkub failed to discharge its burden of proving them.²³

Can you claim where the fraud was carried out through a company?

Moorwand Ltd v Hamblin²⁴ demonstrates a novel, though unsuccessful, attempted recovery of funds where the fraud was perpetrated via a corporate vehicle. In that case, victims of an APP fraud (respondent claimants) had paid funds to a company, RND (respondent defendant), which had an account with Moorwand Ltd (an EMI and appellant). The victims had been deceived into making “investments” which were then dissipated upon the instructions given by a fraudster (“X”) to Moorwand. It transpired that a few months earlier, X had incorporated RND and impersonated one “Mr Stanfield” to be RND’s sole shareholder/director (the real Mr Stanfield having been a victim of identity theft); X then opened RND’s account with Moorwand using the real Mr Stanfield’s identity documents without his knowledge.

The claimants had obtained permission to bring a derivative claim on behalf of RND against Moorwand (as RND’s paying institution) on the basis that RND held the credit as constructive trustee for the APP fraud victims. However, the Court of Appeal upheld the trial judge’s dismissal of the claim, based on the factual finding (upon a single joint expert’s report) that Moorwand had not been put on inquiry (in the Philipp sense) that X was acting in fraud of RND when X gave transfer instructions to Moorwand, even though Moorwand might have breached regulatory obligations.²⁵

Does a bank owe a duty to retrieve funds?

A final point of interest is, upon a fraud being discovered, whether the bank owes any duty to take steps to recover funds which had been transferred away; if that exists, the bank could be found liable for sums that could have been (but were not) recalled promptly. In the case of the paying bank, Philipp held that this proposition was arguable and could not be summarily dismissed.²⁶

However, in the case of recipient banks, it was held in Santander UK Plc v CCP Graduate School Ltd²⁷ that no duty of retrieval exists. The court refused to recognise such a ‘novel’ duty of care in tort, because: (1) there is no relationship of proximity between the victim and the recipient bank; (2) when the time funds were removed, the bank’s only obligation was to obey its customer’s instructions (albeit a fraudster); (3) banks would otherwise be in an impossible position of having to make a speedy adjudication when a third party alleges fraud against one of its customers. Whether the law should impose such a duty is therefore a question for Parliament.²⁸

Where does this leave a victim of APP fraud?

The pattern in the recent case law is that the courts have narrowed the route against the victim’s own bank while leaving a genuine opening against the institution that received the money. For consumers, the reimbursement scheme will usually resolve matters. For companies, high-value losses and anything with a cross-border element, recovery still depends on the civil litigation routes: debt and damages claims against the paying bank, unjust enrichment claims against the recipient bank, and swift disclosure and freezing relief where it is advisable to pursue the fraudsters.

The Dispute Resolution team at Payne Hicks Beach acts for corporate and individual victims of civil fraud, and for those bringing and defending claims against financial institutions.