APP Fraud – A Bank’s Burden?

By Gerard Heyes and Victoria Atkins

Preventing APP fraud is at the top of the agenda for public and private bodies in the UK, hence the proposal of a mandatory reimbursement scheme for all Faster Payments APP frauds. Will banks have to bear the burden of such frauds?

KEY TAKEAWAYS

Authorised Push Payment (APP) fraud is, sadly, an increasingly common form of fraud where a payer, often an individual, is deceived into instructing their bank or other payment service provider (PSP) to send money to an account controlled by the fraudster. Whilst many presume these schemes typically target only the elderly or vulnerable, this is no longer the case. Fraudsters have developed increasingly elaborate and sophisticated ways in which to trick their victims.

Ofcom found that eight out of ten people surveyed have been targeted with scam texts or phone calls.¹ Fraudsters will impersonate organisations such as the National Health Service (NHS), banks or government departments using phone calls, texts, emails, fake websites and social media posts to get access to the personal and financial information of their victims. These details are ultimately used against the victim to persuade them that the payment instruction request is legitimate and build a narrative of deception to support the scheme.

According to UK Finance’s most recent annual report,² 44% of all financial fraud losses in 2021 were a result of APP fraud, with the reported cases totalling £583 million in value. The dramatic rise in APP fraud is thought to stem in part from the increase in the use of the Faster Payments system, which has tripled since 2014, and the ability for payments of up to £1 million to be sent almost immediately. As a result, preventing APP fraud is at the top of the agenda for public and private bodies in the UK as they push for greater consumer protection.

Regulatory intervention

In response, the Payment Systems Regulator (“PSR”) has proposed a mandatory reimbursement scheme for all Faster Payments APP frauds, which account for 98% of those reported.³ This will apply to all PSPs, signalling a drastic move away from the Contingent Reimbursement Model Code (CRM Code) introduced in 2019.⁴ The CRM Code is a voluntary system with only the ten largest high street banks as signatories, permitting partial reimbursement and leading to inconsistent results for victims in the UK.

The PSR proposes that individuals, micro-enterprises, and charities will receive reimbursement within 48 hours of the fraud being reported unless an exemption applies. The exemptions are limited to there either being reasonable grounds to suspect that the “victim” was involved in the fraud or where the victim has been grossly negligent (provided they are not considered to be vulnerable). However, the PSR has explicitly stated that victims must be reimbursed in the “vast majority of cases” so PSPs cannot expect to rely on these exemptions often.

It is proposed that the cost of reimbursement will ordinarily be split 50/50 between the sending and receiving bank but it is unlikely that this will reassure PSPs. It is clear that the PSR wishes them to bear the heavy financial burden of reimbursement unless and until such APP frauds can be detected and prevented.

Whilst the proposals are currently in the consultation phase, the amended Financial Services and Markets Bill is making its way through Parliament to enable the PSR to establish such a system of mandatory reimbursement and so it is expected to be implemented in 2024. The PSR has encouraged PSPs to review their fraud prevention systems for incoming and outgoing payments now, so they will be ready when the time comes.

The Court’s approach

The Court of Appeal has seemingly taken a similar victim-centric approach in its decision in Philipp v Barclays,⁵ when deciding whether the “Quincecare duty” could apply in an APP fraud context. The Quincecare duty is owed by a bank to its customers to refrain from making a payment when the bank is put on inquiry that a payment instruction may be as a result of fraud or an attempt to misappropriate funds. Historically, the duty has been construed as applying only to corporate customers. It was considered unfairly prejudicial to banks to expect the same level of scrutiny in respect of instructions provided directly by an individual account holder, as opposed to an agent on behalf of a company.

To cover the facts briefly, in 2018 Mrs Philipp was the victim of an elaborate APP fraud where the fraudsters impersonated the National Crime Agency and Financial Conduct Authority to persuade her to transfer £700,000 to the fraudsters’ UAE bank account.

The Court of Appeal in Philipp decided the preliminary issue of whether the Quincecare duty could apply and overturned the first instance decision to rule that it could. This was viewed as a significant extension of the duty and has been the subject of much legal commentary. However, as the decision has now been taken to the Supreme Court, the position is currently in somewhat of a state of flux. Judgement is expected imminently following a hearing in February 2023.

If the Court of Appeal decision is upheld, the Philipp case will have to be heard on its facts at a full trial to determine whether the duty was breached and so there will be limited guidance for banks on what weight the Court will give certain factors in the interim. If it is found on the facts that the bank had been put on inquiry that there may be a fraud when the payment instruction was made, the Court will have to decide whether an ordinary prudent banker acting with reasonable skill and care would have delayed the payment pending further inquiries.

As things currently stand, the extension of the Quincecare duty to APP fraud would provide another avenue of redress to victims of APP fraud. In reality, this will likely be used for high value APP fraud claims that arise prior to the implementation of the PSR’s proposed mandatory reimbursement scheme or those which fall outside of its scope, for example, overseas payments.

Given the volume and total losses of reported APP fraud claims, PSPs, including banks, will need to increase their efforts to prevent the transfers from taking place in the first place or pay the heavy price.

About the Authors

Gerard Heyes is a partner in the Financial Services Disputes team at Farrer & Co, specialising in complex financial markets litigation and contentious regulatory disputes.

Victoria Atkins is a litigator in the Financial Services Disputes team at Farrer & Co who has been recognised as a Legal 500 “Rising Star” for two consecutive years. She has a further specialism in commercial litigation as well as corporate and shareholder disputes, where she advises on complex high-value matters.

References

1. UK Finance Annual Fraud Report, The Definitive Overview of Payment Industry Fraud in 2021 (published 26/08/2022)
2. UK Finance Annual Fraud Report, The Definitive Overview of Payment Industry Fraud in 2021 (published 26/08/2022)
3. CP22/4: Authorised Push Payment (APP) Scams: Requiring Reimbursement (published 29.09.2022)
4. Contingent Reimbursement Model Code for Authorised Push Payment Scams, Lending Standards Board (latest version published 8 February 2023)
5. Philipp v Barclays Bank UK PLC & Anor [2022] EWCA Civ 318