No Duty of Retrieval on Receiving Banks: High Court Rules Against Extending Receiving Bank’s Liability in Fraud Case

Santander UK plc v CCP Graduate School Ltd [2025] EWHC 667 (KB)

On 25 March 2025, the High Court delivered a significant judgment in Santander UK plc v CCP Graduate School Ltd, addressing whether there is a tortious duty of retrieval on a receiving bank in relation to funds it receives as a result of APP fraud, when the victim of fraud is not a customer of the receiving bank.

Facts

CCP Graduate School Ltd (“CCP”) was deceived into transferring £415,909.67 from its account with NatWest into an account at Santander held by a fraudulent entity, PGW Consultants Limited.

On uncovering the fraud, CCP tried to recover the lost funds by suing both its own bank, NatWest, and the receiving bank, Santander.

First instance

CCP’s claim against NatWest was that the bank owed It a contractual and/or tortious duty not to carry out its payment instruction without taking steps to ensure that this was not an attempt to defraud it. This was put on the basis of a “Quincecare duty” whereby in certain circumstances a bank can have a duty not to execute a payment instruction given by an agent of the customer, without making inquiries. The Master in first instance dismissed the claim against NatWest in its entirety.

It is clear to us that this was not a case which fell within the Quncecare Duty. For more information on the Quincecare Duty, please click here for our summary of Philip v Barclays Bank (one of the main cases on Quincecare).

It is worth noting that the payments were made prior to the new rules on APP Fraud coming into force. You can view our webinar on the APP Fraud rules by clicking here.

CCP’s claim against Santander hinged on the idea that Santander (the receiving bank) had breached a “retrieval duty” to recover the stolen funds. What they argued was that Santander, once notified of the fraud, should have taken reasonable steps to freeze or recall the funds from the fraudster’s account. It argued that this “retrieval duty” could arise in tort, even without a contractual relationship between the Santander and CCP.

The Master at first instance found that:

• despite no contractual duty existing, since CCP wasn’t Santander’s customer, a tortious duty might arise because Santander had some control over payments from the criminal’s account;
• this potential tortious liability could place it in a special position to recover funds; and
• the claim was at least arguable and CCP should be allowed to run this line or argument against Santander.

Santander appealed against the Master’s decision allowing CCP to run a case against it on this duty of retrieval.

The Court’s decision on appeal

Mrs Justice Eady determined that no tortious duty could arise in this case for several reasons:

• having a fraudster as a customer did not create obligations to protect potential victims. In fact, the bank’s primary obligation was to comply with its customer’s instructions;
• when considering whether a duty of care should be recognised in a novel situation, the court must take an incremental approach and consider the factors of foreseeability, proximity and fairness, justice and reasonableness. Mrs Justice Eady concluded that these factors were not satisfied and found no basis for developing the law in this direction;
• she also highlighted practical problems and conflicts that such a duty would create in that a receiving bank would be compelled to make immediate judgments about freezing or recalling funds based solely on allegations of fraud, potentially conflicting with its obligations to its innocent customers – this would place an “unacceptable burden “on banks beyond their contractual obligations;
• she acknowledged the existence of a voluntary scheme of indemnities operated by banks to mitigate the harm caused by APP fraud. However, she noted that the existence of a voluntary scheme does not provide a proper basis for the implication of duty of care in these circumstances. She noted that the fact that banks are willing to take steps to try to assist victim of fraud does not mean the courts should find they have a legal obligation to do so.

Comment

If the courts had permitted CCP’s claim against Santander to succeed, this could have created a disproportionate expansion of the duty of care owed by receiving banks. If CCP’s position had been accepted, banks would not only owe their direct customer a duty of care but also third parties. This would have created to much of a conflict for a bank between its duty to execute its clients’ instructions and its duty towards third parties which it knows very little about.