The decision will be reassuring to banks in New Zealand as they continue to confront the ever-increasing problem of APP Fraud.
The claim and relevant background
CCP was a victim of APP Fraud. It had been induced to authorise 15 payments from its NatWest bank account into an account at Santander, totalling GBP415,909.67. The Santander account belonged to a fraudster. After the fraudster received each of CCP’s payments, it transferred them out of the account, into accounts held with other banks.
CCP, in reliance on the Philipp decision (see our update on that decision here), argued that Santander, as the receiving bank, owed a tortious duty of retrieval and recovery of those funds. It argued that once Santander was notified of the fraud, Santander had an obligation to try to reverse the proper and validly made payment instructions of its own customer.
Santander applied to strike out the claim. In the first instance decision, the Master held that it was at least arguable that Santander owed CCP a retrieval duty. Santander appealed.
The decision on appeal
The High Court ruled in favour of the bank. It held that Santander did not owe CCP any “duty of retrieval.”
Relying in part on the Philipp judgment, the Court found that:
- There is no duty on a bank to take positive steps to unwind the harm caused by APP Fraud to a third party with whom it has no contractual relationship. If this duty did exist, it would conflict with the bank’s strict duty under its contract with a customer to make payments from the customer’s account in compliance with their instructions. As the Supreme Court made clear in Philipp, a bank has no authority, let alone an obligation, to attempt to reverse earlier transactions when this would be contrary to its customer’s payment instructions. If Santander did owe such a duty of retrieval, this would be by way of a further application of the duty of care owed by a bank to interpret, ascertain and act in accordance with its customer’s instructions. Such a duty would therefore not arise between a bank and a third party where no contractual relationship exists, like in this case.
- No duty of retrieval arose simply because a fraudster held an account with the bank, and the bank had no “special level of control” over the movement of money from the fraudster’s bank account. Absent any notification that the account may be used for the purposes of fraud, all the bank was required to do in these circumstances was to obey the instructions of its customer. Even once the bank was notified about the potential fraud by its customer, the bank had no “status” so as to create a special obligation to protect the third-party victim from danger.
- While the banks themselves may be willing to take steps to try and assist victims of fraud, for example by providing voluntary indemnities, this does not mean that the courts should find a legal obligation to do so exists. The duty of retrieval as claimed by CCP would require a bank to make a speedy adjudication upon an allegation of fraud made against one of its customers by a third party. This is an impossible position for a bank, given the number and speed of transactions being processed.
As it did in Philipp, the Court acknowledged the real harm that victims of APP Fraud suffer. However, the Court said that any mechanism to address the harm of APP Fraud is a question of social policy for regulators, government, and ultimately Parliament to consider.
Comment
As we have previously highlighted, in New Zealand, our Supreme Court has already held in Westpac v MAP that banks are under a strict duty to comply with legitimate payment directions made by their customers. That is consistent with the English Court’s conclusion that banks do not owe a duty to protect the position of a third party.
We consider that any further developments to banking obligations in New Zealand are most likely to follow from industry-led regulatory change, rather than judgments from the New Zealand courts.
The Banking Ombudsman’s Practice Note on Fraud and Scams includes guidance on the steps that a sending back should take to protect its own customers in the event of fraud. The Practice Note also refers to a recipient bank contacting its customers who have received fraudulently obtained funds as soon as possible once notified but does not impose obligations directed at the defrauded party. The Banking Ombudsman’s terms of reference do not empower it to handle complaints against recipient banks.
In late 2024, the Banking Ombudsman proposed changes to its terms of reference. These would enable it to hear about recipient banks. The Banking Ombudsman also proposed an amendment to the Code of Banking Practice (Code) to include two new commitments:
- To take reasonable steps to detect accounts which may be, or are being, used to receive scam funds.
- Respond reasonably following notice of concerns about an account or funds at a recipient bank.
Key stakeholders, such as the New Zealand Banking Association, have expressed support for expanding the Banking Ombudsman’s terms of reference, once the industry completes work on a framework for APP Fraud compensation more broadly, and makes related updates to the Code.3
If you have any questions about the matters raised in this article, please get in touch with the contacts listed or your usual Bell Gully adviser.
[1] Philipp v Barclays Bank UK PLC [2023] UKSC 25.[2] Santander UK PLC v CCP Graduate School Ltd [2025] EWHC 667 (KB).[3] New Zealand Banking Association – Te Rangapū Pēke Submission to the Banking Ombudsman Scheme on the consultation on proposed rule changes (13 December 2024).