Authorised Push Payment (APP) Fraud - An Update

The Framework required all UK Payment Service Providers to reimburse customers who fall victim to APP fraud. 

The introduction of this Framework followed some high-profile claims including the Supreme Court ruling in Phillip v Barclays Bank [2023] which we discussed in July 2023 and Larsson v Revolut Ltd [2024]  which we commented on in August 2024.

The recent case of Hamblin and Anor v Moorwand Ltd and Anor [2025] brings APP fraud back into the spotlight and considers an alternate route for victims of fraud to seek to recover their funds.

Background

The Hamblin case centres on the Quincecare duty, a legal principle originating from the case of Barclays Bank v Quincecare [1992], which requires banks and payment service providers (“PSPs”) to decline to execute payment instructions from a customer if they have reasonable grounds to suspect fraud. 

The Quincecare duty was revisited in the Supreme Court’s decision in the Philipp case referred to earlier which clarified that this duty is part of the general duty of care owed by financial institutions to their customers.

The Hamblin case also considers the Payment Services Regulations (“PSRs”), particularly the 2009 and 2017 versions, which govern the authorisation and liability of payment transactions.

Facts of the Case

The claim arose after Mr and Mrs Hamblin were victims of an APP fraud, whereby they transferred £160,000 to RND Global Ltd, whose accounts were fraudulently opened with Moorwand Ltd. 

The funds were held briefly in RND’s electronic wallet and then paid away by Moorwand based on instructions from fraudsters who were impersonating RND’s director. 

The Hamblins brought a derivative claim against Moorwand, arguing it had a duty to verify the legitimacy of the payment instructions. A derivative claim is a type of legal action where a claim is brought on behalf of a company by someone other than the company itself.

Court’s Decision on Quincecare Duty

The High Court found that Moorwand had been “put on inquiry” and therefore should have investigated the authenticity of the payment instructions. The court cited inconsistencies in the account opening documents and suspicious transactions, such as luxury purchases, as red flags. The court reaffirmed the position that a PSP must not execute instructions without verifying them when dishonesty is reasonably suspected, aligning with the principles laid out in the Philipp judgment.

The court rejected the Hamblins’ claim under regulation 55 of the PSRs 2009, stating that Moorwand had followed the agreed procedures for authorisation. However, it clarified that compliance with procedural mechanics does not absolve a PSP from its Quincecare duty. 

As a result the court found that even if a transaction is technically authorised, the PSP may still be liable if it fails to act with reasonable care when fraud is suspected.

Commentary on Derivative Actions 

Garon Antony, Financial Services Partner, comments:

“The judgment is notable for allowing a derivative action in the context of APP fraud which is an alternate route for potential victims of APP fraud to consider when seeking to recover their losses. 

“Unfortunately, as the defendant in this case did not appeal the decision of the judge at first instance to give the Hamblins permission to bring the derivative claim, the use of such an action for these purposes was not considered in the judgment. 

“Consequently, it is unclear how viable this route may be as a mechanism for victims to recover monies lost to APP fraud from banks and other firms subject to the Quincecare duty; that said it certainly opens more potential recovery avenues and as we are seeing fraudsters becoming more adept in their efforts to defraud innocent customers this potential is to be welcomed.”