High Court Considers Receiving Bank's Liability In Context Of APP Fraud

• Published date: 28 June 2022
• Subject Matter: Finance and Banking, Criminal Law, Financial Services, White Collar Crime, Anti-Corruption & Fraud
• Law Firm: Herbert Smith Freehills
• Author: Ceri Morgan, Nihar Lovell and Ariel Wiebe

The High Court has dismissed a claim brought by a company against a bank for knowing receipt and unjust enrichment in relation to funds received by the bank in the context of an authorised push payment fraud (APP): Tecnimont Arabia Ltd v National Westminster Bank plc [2022] EWHC 1172 (Comm).

This decision will be of interest to financial institutions faced with claims from non-customers seeking the recovery of funds mistakenly transferred, as part of a cyber-fraud, to their customers' accounts. The decision highlights that it will be difficult for non-customers to pursue such claims against a receiving bank where: (a) the funds transferred do not constitute trust property; and (b) the bank has not been enriched at the claimant's expense.

In the present case, the court was satisfied that the bank could not be liable for knowing receipt, because the property transferred was not trust property. Further, the bank could not be liable for unjust enrichment as the bank had not been enriched "at the claimant's expense" according to the test laid down in Investment Trust Companies v HMRC [2017] UKSC 275.

The court underlined that if it had found the opposite, it would have in any event accepted that the defence of change of position was available to the bank. The court noted that the bank would not have discovered (or been put on notice of the risk of) any fraud being committed by the customer. It could not be said that a reasonable person would either have appreciated that the transaction was probably fraudulent or would have made enquiries or sought advice which would have revealed the probability of fraud.

We consider the decision in more detail below

Background

The claimant company (Tecnimont) was the victim of an APP fraud. Tecnimont intended to make a payment of USD 5 million to an Italian entity in its group. Shortly thereafter, a third party fraudster gained unauthorised access to the email systems of Tecnimont's Italian entity through a phishing email. The fraudster then sent emails which appeared to originate from the Group Finance Vice President of the Italian entity, instructing Tecnimont that the funds should be sent to a bank account over which the fraudster had control (the Receiving Account). The Receiving Account was held with the defendant bank (Bank). Tecnimont, in the belief that this was a genuine request, asked its bank to transfer the USD 5 million to the Receiving Account (the Transferred Funds).

Once the Transferred Funds were deposited...