/security

News and resources on cyber and physical threats to banks and fintechs worldwide.

Santander scores victory in APP fraud retrieval case

Santander has scored a significant High Court victory in a push payment fraud case over its responsibility to return £415,000 that was sent to a scam account.

  4 2 comments

Santander scores victory in APP fraud retrieval case

Editorial

This content has been selected, created and edited by the Finextra editorial team based upon its relevance and interest to our community.

Between 13 September and 12 October 2016, CCP Graduate School was duped by fraudsters to authorise payments totalling £415,909.67 from its account with National Westminster Bank into an account at Santander, which was held in the name of PGW Consultants Limited.

Consistent with the fraudsters’ directions, CCP’s instructions identified the account holder as “PGW Limited”. The payments were processed without reference to the account name of the recipient, in accordance with standard practice at the time.

On 18 October 2022, CCP brought claims against both NatWest and Santander. CCP alleged that Santander owed a duty to take reasonable care to prevent Santander accounts from being used as instruments of fraud, and had breached that duty by allowing the funds received into the account from the NatWest account to be transferred out.

Both banks applied for the claims against them to be struck out, and for reverse summary judgment. While NatWest was given the all-clear, CCP cross-applied for permission to amend its claims against Santander, to allege breaches of a “retrieval duty”.

In ruling in Santander's favour, Court judge Jennifer Eady stated that "a receiving bank in these circumstances cannot be taken to have assumed any responsibility to the third-party victim of the fraud" and that there was no basis for finding that Santander’s status as the fraudster’s bank in “some way gave rise to an obligation to protect those who might be harmed by its customer’s actions".

Also of significance for the banking industry is the finding, in respect of the system of indemnities, that “the fact that banks are willing to take steps to try to assist victims of fraud does not mean that the courts should find they have a legal obligation to do so.”

Eady noted that requiring banks to investigate and halt every suspected fraudulent transfer would create "an unacceptable burden".

The case follows a similar 2023 Supreme Court case against Barclays, which largely dismissed claims about banks' responsibilities in APP fraud scenarios.

Sponsored [Webinar] Behavioural Biometrics: Meeting the deployment challenge

Comments: (2)

A Finextra member 

If a receiving bank cannot be held responsible to a third party victim of fraud, by the same logic nor can a social media company when their platform is used to initiate frauds.

Banks still need to do more to prevent fraudsters from operating bank accounts. The APP reimbursement rules, which came into effect after this fraud, go some way to encourage banks to do more (by making the fraudster's bank 50% liable for fraud up to £85k).

 

Ketharaman Swaminathan

Ketharaman Swaminathan Founder and CEO at GTM360 Marketing Solutions

Kudos to the court for this verdict. 

In my blog post titled Fraud v Scam: Who Is Liable For Cybercrime and many subsequent comments, I'd said:

"People want to hold the Alleged Scammer's bank responsible on the ground that it opened an account in the name of the Alleged Scammer despite doing KYC. They seem to assume that KYC is character certification. But it's not. As long as you produce the necessary KYC documents, a bank is not under any obligation to vet your character before opening an account in your name (Not legal advice.)".

In response, some people claimed that payee bank is indeed responsible for vetting the payee as part of KYC / KYB and should not open an account for him / her.

This verdict renders the point moot. Even assuming that the payee bank is responsible and has failed in its duty, this verdict makes it clear that that's a different infraction and that the payee bank is still not responsible to the payor / victim for his / her loss.  

Webinar – Transforming Wealth Management through Macroeconomic InsightsFinextra PromotedWebinar – Transforming Wealth Management through Macroeconomic Insights