Court Of Appeal Finds No Breach Of So-called Quincecare Duty In “derivative” Action Brought By APP Fraud Victims Against PSP

The decision reinforces the high threshold for appellate intervention in first instance judgments, but leaves open whether derivative actions can be used to circumvent the Supreme Court’s decision in Philipp v Barclays

The Court of Appeal has allowed an appeal by a payment services provider (PSP), finding that it was not put on enquiry that transfer instructions were allegedly given without its customer’s authority and therefore it did not breach its so-called Quincecare duty:Hamblin & Anor v Moorwand Ltd & Anor [2026] EWCA 942.

The case involved a novel spin on the traditional Quincecare duty claim. The claimants were victims of an authorised push payment (APP) fraud and brought proceedings against the receiving PSP by way of a derivative action on behalf of the PSP’s corporate customer. At first instance, the claimants were granted permission to use the derivative action mechanism, but the claim was dismissed. On appeal to the High Court (which did not include any appeal of the judge's decision to grant permission to bring the claim derivatively), the trial judge’s decision was overturned. The present judgment represents the PSP’s successful appeal of the High Court’s decision.

The decision is significant because it reinforces the high threshold for an appellate court to interfere with a trial judge's evaluative assessment of the facts. In short, the Court of Appeal held that the trial judge was entitled to conclude, on the evidence before him, that the PSP was not put on enquiry that payment instructions were being given without its customer's authority. The High Court was wrong to overturn that finding. Perhaps more interesting, however, are the following two novel and potentially far-reaching issues, which the Court of Appeal deliberately left unanswered. 

First, whether victims of APP fraud can use the derivative action mechanism to sidestep the limitations on so-called Quincecare claims established by the Supreme Court’s decision in Philipp v Barclays Bank UK plc [2023] UKSC 25 (see our blog post). Philipp clarified that this is a limited duty to act with reasonable skill and care when processing customer payments, which applies to “interpreting, ascertaining, and acting in accordance with the instructions”. This duty cannot arise in an APP fraud context, because the mandate is validly made by the victim of the fraud. By upholding the first instance decision in the present case, the Court of Appeal’s judgment may open the door to third-party APP fraud victims bringing a claim in the name of the corporate customer through which the fraud was perpetrated (even where the company is set up as a vehicle of the fraud from the outset). Notably, this would give rise to a disparity in the prospects of successful recovery for APP fraud victims, depending on whether the fraudster operated through a corporate vehicle rather than an account held in the name of an individual.

Second, whether the Quincecare duty can apply at all where payments are processed electronically without human intervention, and if so, what form any monitoring obligation might take in that context. 

The Court of Appeal was conscious of the potential significance of both issues, but could not address them because they were not formally before the court on appeal. The payment services industry must therefore wait for these points to come before the court again. Importantly, any decisions in future claims will be undisturbed by the outcome of this case, since the key findings were made in the County Court and are therefore not binding.

We consider the decision in more detail below.

Background

The background to this case is more fully set out in our previous blog post.

In summary, a fraudster (X) set up an "electronic wallet" with the defendant PSP, which was held in the name of a corporate entity (RND). The name of a real person – a Mr Stanfield – was used in the incorporation documents for RND and to open the account (the real Mr Stanfield having been the victim of identity theft). As part of an APP fraud, X persuaded two individuals to make a payment into the electronic wallet, and the funds were subsequently paid away pursuant to instructions given on behalf of RND by X, pretending to be Mr Stanfield. The claimants (the victims of the APP fraud) were granted permission by the judge at first instance to bring a "derivative" action against the PSP on behalf of RND, as the PSP's corporate customer. The claim alleged breach of (among other things) the PSP's so-called Quincecare duty owed to RND. 

At first instance, the trial judge dismissed the claim. On appeal to the High Court (which did not include any appeal of the judge's decision to grant permission to bring the derivative claim), the trial judge’s decision was overturned. The High Court found that the PSP failed to make necessary inquiries, thus breaching its Quincecare duty in paying away the sums in question. Consequently, the PSP was ordered to restore the funds to RND’s account.

The PSP appealed.

Court of Appeal decision

The Court of Appeal allowed the appeal. It found that the threshold for revisiting the trial judge’s evaluative conclusion that the PSP was not put on enquiry that the transfer instructions were given without RND’s authority was not met in this case. 

The key aspects of the decision which will be of interest to financial institutions are set out below.

Trial judge’s conclusion as to the authority of X

The PSP challenged the High Court’s conclusion that the trial judge made an error of law (which rendered the trial judge’s evidential assessment flawed). This ground placed particular focus on the High Court’s conclusion that the trial judge incorrectly equated RND’s agent with RND itself. It said the trial judge failed to take account of the fact that X was not in fact acting as the agent of RND and the only person who could act for RND was the real Mr Stanfield. The High Court ruled that this conflicted with the principle recognised in Singularis Holdings Ltd v Daiwa Capital Markets Europe Ltd (Rev 1) [2019] UKSC 50 (see our blog post) that the knowledge of a director acting in fraud of their corporate principal is not to be attributed to the company.

The Court of Appeal said that this criticism would have force, if the trial judge’s decision was premised on attribution (either on the basis that X was acting with RND’s actual authority or by way of a defence of illegality). However, the trial judge did not decide the case on either of those bases. Rather, it was decided on the basis that the PSP was not put on enquiry that X was acting in fraud of RND. In other words, the trial judge’s decision did not rest on X’s actual authority to give the payment instructions in issue, but on whether the PSP was put on notice that those instructions were given in fraud of RND. Conversely, if the judge had decided the point the other way and found that the PSP was on enquiry that X was defrauding RND, then the instructions would have been given without authority. Accordingly, the High Court erred in its analysis of this ground.

Trial judge’s consideration of the facts relevant to whether the PSP was put on notice

At trial, the claimants relied upon a series of regulatory breaches by the PSP when setting up the accounts, arguing that if the PSP had complied with its money laundering obligations, it would have acquired information which would have put it on enquiry in respect of the fraudulent transfer. For example, the documents provided by RND for the purpose of opening the account included an invoice purportedly addressed to Mr Stanfield, but there were irregularities including: (i) reference to another customer’s name; and (ii) the date of the invoice pre-dated the incorporation of RND. An internal email from someone at the PSP commented that the document looked “fake” and said proof of the company’s address should be requested, but there was no evidence that the PSP made this request of RND.

The High Court concluded that the trial judge had erred in his evaluative assessment by wrongly concluding that the PSP’s money laundering/regulatory failures were irrelevant to the question of whether the PSP was “on notice” that X did not have authority to give the transfer instructions. However, the Court of Appeal noted that the trial judge had expressly recognised:

“Whilst it is entirely right to say that regulatory failures (for instance: failure to monitor for money laundering) are not relevant to the Quincecare duty, it is an error to assert … that where facts are relevant to one duty they are, ipso facto, irrelevant to another.”

In the Court of Appeal’s view, the trial judge reached the conclusion that the PSP was not put on enquiry despite the matters giving rise to the regulatory findings. The Court of Appeal recognised that this conclusion might be regarded as favourable to the PSP, and also that the High Court could legitimately have reached a contrary conclusion if it had been considering the matter afresh. However, the Court of Appeal accepted that the trial judge’s decision was open to him on the evidence before him. 

Threshold for interfering with the trial judge’s decision

The Court of Appeal noted that the threshold for revisiting the evaluative conclusions of a trial judge is high. Given the Court of Appeal’s conclusion that the trial judge did not make the two errors of principle identified by the High Court, it held the threshold was not met. On this basis, the Court of Appeal allowed the PSP’s appeal.

Significance of derivative actions in the context of APP frauds

The Court of Appeal acknowledged the potential significance of derivative actions in the context of APP fraud claims. The derivative action here was based on the asserted Quincecare claim of RND against the PSP. This claim was brought on behalf of RND by the claimants (the victims of the APP fraud), on the basis that RND held the amounts received on constructive trust for the claimants. 

The Court of Appeal noted that in ordinary circumstances, the PSP would not owe a duty to the claimants (as a third party), when acting on payment instructions apparently given by RND (its customer), per JP SPC 4 v Royal Bank of Scotland International Ltd [2022] UKPC 18 (see our blog post). However, by relying on the derivative action mechanism, the claimants could potentially achieve a similar (perhaps better) outcome, than if they had benefited from a duty of care in tort, because:

• Under a tortious claim, the claimants would have been in competition with other creditors of RND, whereas under a constructive trust, the claimants would be entitled to full restoration of their account in respect of the transfers.
• Under a tortious claim, any damages awarded to the claimants could be reduced on the basis of contributory negligence; whereas any fault on behalf of the claimants would not be relevant to a claim by RND against the PSP in debt.
• A claim based on a derivative action would not require the claimants to prove that the PSP knew that it had received trust assets or assets being applied in breach of fiduciary duty.

The Court of Appeal commented that the trial judge was alive to the potential significance of this aspect of the claim, observing that the derivative mechanism would allow them to “get around” the “legal barrier” for APP fraud claims based on the so-called Quincecare duty, imposed by the Supreme Court in Philipp v Barclays.

Notwithstanding the novelty of the claim, these issues were not before the Court of Appeal to decide, because the PSP did not appeal the trial judge’s finding that a derivative action could be brought, and there was no attempt to revive the challenge to the derivative action. In consequence, the Court of Appeal noted that it was not necessary for it to consider a number of issues potentially raised by a case of this kind, including:

1. Whether the directors of a company will lack actual authority to give instructions on behalf of a company, where the company is set up as a vehicle of the fraud from the outset.
2. Whether a bank can defend claims of this type on the basis of breach of contract, where the contract between the bank and the company includes warranties or representations as to the legitimacy of the company’s operations (and whether the directors’ knowledge of the ongoing fraud is attributable to the company for this purpose).
3. The position where the claim asserted on the company’s behalf is not simply restoration of the account but a claim for damages, on the basis that the making of enquiries by the bank would have prevented further frauds being perpetrated (and the company becoming liable for them) or prevented other transfers from the account.

Application of Quincecare duty to electronic transfers

The Court of Appeal observed that a number of the key cases considering the so-called Quincecare duty had involved transfer instructions given by the bank’s customer in person or by telephone, whereas in this case the precise payment mechanics were obscure. Accordingly, the trial judge was not asked to make any findings on whether payment requests were processed without human intervention. Further, no arguments were made by either side as to whether a Quincecare duty could apply to payments processed without human intervention, in particular what monitoring duty there might be in such circumstances (whether undertaken algorithmically or otherwise).

On that basis, the Court of Appeal said that it could not fairly address these questions on this appeal. For the same reason, the Court of Appeal could not make any findings on whether, if a transfer is deemed authorised for the purposes of the Payment Services Regulations, this will impact whether or not authority is established for the purpose of the Quincecare duty.