Authorised Push Payment fraud: where are we now?

A recent report by UK Finance estimates that in 2024, Authorised Push Payment (“APP”) fraud in the UK generated gross losses for consumers of just over £450 million. That is likely to underestimate the total losses and, based on our experience of advising on related issues, this is a form of fraud which affects individuals and businesses with concerning frequency.  

APP fraud occurs where victims are tricked into willingly sending money from their own bank account to that of a fraudster, who then disappears with it. Given the difficulties in recouping their funds from the fraudster, victims will often look to an easier target to compensate them for their losses – their own bank. 

Until relatively recently, there was no statutory scheme in place requiring a victim’s bank to reimburse them for losses resulting from an APP fraud. As a result, victims have historically brought claims against their banks in the civil courts, in an attempt to hold them liable for those losses. A 2023 Supreme Court decision in an English case, Philipp v Barclays Bank UK Plc, closed off many of the routes to a successful claim. It did not, however, shut the door entirely, and some potential routes to recovery remain – albeit that these routes remain untested.  

Since Philipp, the Payment Systems Regulator (“PSR”) has introduced mandatory rules which require victims to be reimbursed in certain circumstances, with the reimbursement payment being split 50:50 between the victim’s bank and the fraudster’s bank. The PSR’s scheme, effective from October 2024, provides significant protection, but it does not apply in all cases. As a result, where it cannot offer a remedy, there is still scope for a victim to bring a civil claim.

Key issues

When will APP fraud victims be reimbursed under the PSR’s rules?

Under the PSR’s rules, certain payments made by a victim to a fraudster via CHAPS or Faster Payments must be automatically reimbursed. The regime is, however, subject to important limits and exceptions. The victim must be a consumer, microenterprise or charity. Only domestic payments are in scope. Importantly, reimbursement is limited to £85,000 per claim. Banks are also not required to reimburse payments where the claim is classed as a “civil dispute” (i.e., where a customer has paid a legitimate supplier for goods and services but has not received them or is dissatisfied), or where the victim has acted fraudulently or with gross negligence – our experience shows that whether the latter applies is frequently a point of dispute.

As a result, there will still be cases of APP fraud which fall outside the PSR’s regime. In those cases, it may be worth the victim considering a civil claim against its own bank.

If a customer seeks to send funds to a fraudster, is their bank ever obliged to query or not execute their instructions?

The most intractable problem for a victim seeking to bring a civil claim against their bank is that the victim will generally have given an unequivocal instruction to the bank to make a payment to the fraudster, albeit in circumstances where the victim has been deceived as to whom and why the payment is being made. This raises a question as to whether the victim’s bank is ever subject to a duty to probe their payment instructions, and/or to decline to execute them – and whether, if that duty is breached, the bank can be liable to the victim in damages. 

In Phillip, the Supreme Court held that a bank’s core duty is to execute its customer’s instructions, even where those instructions will result in payment to a fraudster. The risks or wisdom of the customer’s decision to transfer the funds are not the bank’s concern. This absolves banks in most circumstances of any duty to probe the instructions they receive from their customers, or to refrain from executing those instructions. The one exception to this is where the payment instruction is given by the victim’s agent and the bank fails to make the enquiries that a reasonable person would have made to verify the agent’s authority. This limits the circumstances in which a victim can make a successful civil claim against their bank in respect of an APP fraud.  

If a customer has sent funds to a fraudster, is their bank obliged to try to retrieve those funds from the fraudster’s bank?

The Supreme Court in Phillip did leave open the question of whether a victim’s bank could owe a duty to the victim to try to retrieve their funds from the fraudster’s bank, which, if breached, would make the victim’s bank liable to them. The claimant customer in Phillip argued that such a duty existed, and that it had been breached. The Supreme Court refused to dismiss her arguments on a summary basis, recognising that they had at least some prospect of success at trial. However, those arguments were never fully tested because the case subsequently settled.

A claimant customer in a subsequent English case, Dawn Barclay-Ross v Starling Bank Ltd [2025] EWHC 2158 (KB), made similar arguments. Again, the court refused to strike those arguments out, recognising that they may have some prospect of success, but the claim was discontinued before they could be fully aired at trial.

Claims against a victim’s bank based on breach of a duty to seek to retrieve the victim’s funds from the fraudster’s bank may therefore provide a route to making a victim whole – albeit that to date no claim based on this argument has gone to trial and succeeded in either England or Scotland and it is therefore yet to survive the heightened scrutiny of its merits that this would bring.

Can a victim bring a claim against the fraudster’s bank?

In addition to a victim pursuing their own (paying) bank, there have been cases where the victim has sought to fix the fraudster’s (receiving) bank with liability for their loss. However, the English High Court held last year, in Santander UK PLC v CCP Graduate School Ltd, that a victim’s claim against the fraudster’s bank was fanciful. In doing so, it rejected the notion that a fraudster’s bank could owe a duty to a third-party victim of the fraudster not to release the victim’s funds to the fraudster, or to try to retrieve the victim’s funds once released. This is therefore unlikely to be a fruitful route for claims in most circumstances.

Where does this leave victims?

• The first step for any victim of an APP fraud will be to consider whether they can obtain reimbursement under the PSR’s reimbursement regime. This will make many victims whole very quickly.
  
  
• If the PSR’s regime will not make good the loss, a victim may wish to consider a civil claim against their bank instead. While some of the routes to successful civil claims have been shut off, recent decisions have left some potential arguments open. There are as yet no cases where these arguments have been run to a successful conclusion, but a claim based upon them will at a minimum apply pressure to a bank and perhaps bring them to the table for settlement discussions.

If you would like to discuss any of the above and require support with any actual or potential dispute, please get in touch with one of the contacts below. 

Related News, Insights & Events