Push Payment Fraud – derivative claim as a means of recovery

As part of October’s Cybersecurity Awareness month, we look at a recent innovative case where victims of an APP Push Payment Fraud were able to recover against the payment service provider (PSP) which paid away the proceeds of the fraud.

Facts

In Hamblin -v- Moorwand [2025] EWHC 817 (Ch), Mr & Mrs Hamblin (Claimants) were induced, by fraud, to pay almost £160,000, thinking it an investment, to a fraudster’s company, RND Global Ltd (RND) (Second Defendant). A director of RND had been the victim of identity fraud. The fraudsters had used his identity to open accounts with Moorwand Ltd (First Defendant)(Moorwand), a PSP and electronic money institution regulated by the FCA. These accounts permitted RND to operate an electronic wallet enabling it to make and receive payments in sterling, euros and bitcoin.

RND held the funds transferred by the Hamblins in an electronic wallet with Moorwand. The fraudster in control of RND then instructed Moorwand to pay RND’s monies away. The fraud on the Hamblins is commonly termed a “push” fraud, where the Hamblins’ consent to the payment had been extorted by a fraud against them. The consequence of this was that the Hamblins’ bank, in making the payment pursuant to their instructions, acted properly and within the terms of its mandate, so no claim could be brought there. RND was insolvent so, the only option for a recovery was the derivative claim on behalf of RND against the PSP, Moorwand.

The Hamblins commenced a claim against Moorwand and RND (in administration) seeking to recover the money, arguing among other things that Moorwand owed a duty of care, in contract and/or tort and/or agency, to take reasonable skill and care not to execute a payment instruction in circumstances when it was put on inquiry that the payments were not duly authorised by RND. The claim brought by the Hamblins was a derivative claim (i.e. where a claim vesting in a company is brought by a claimant other than the company whose claim it is), on behalf of RND, standing in RND’s shoes, as RND was now insolvent, suing Moorwand.

The case involved consideration of the Quincecare Duty, which prevents a bank/financial institution from executing a payment instruction given by an agent of its customer where it has reasonable grounds to believe that the instruction is an attempt by the agent to defraud the customer.

The judge at first instance permitted the Hamblins to pursue the derivative claim against Moorwand but concluded that Moorwand had not been put on inquiry for the purposes of the Quincecare Duty, so the claim failed. The Hamblins sought permission to appeal this decision.

High Court decision

On appeal, the court held that Moorwand had in fact been “on inquiry” for the purposes of the Quincecare Duty and consequently it should not have debited RND’s account without satisfying itself that the payment instructions it had received from the fraudster purporting to be RND’s director were not fraudulent.

The court clarified that a PSP (although not a “bank”) is within the scope of the Quincecare duty and the Quincecare Duties apply to PSPs as well as banks.

The judge held that where there are circumstances suggestive of dishonesty apparent to the PSP that would cause a reasonable person before executing an instruction to make inquiries to verify the agent’s authority, the PSP’s duty to exercise reasonable skill and care in and about executing the customer’s instructions requires the PSP to make inquiries to ascertain whether the instruction given is one actually authorised by the customer. If the PSP executes the payment instruction without making such inquiries, the PSP will be acting in breach of duty. So, in summary, the duty of care requires the PSP, if put on inquiry, not to act without checking that the order is indeed a valid order of the customer to transfer money. Where the PSP, without taking steps to clarify the customer’s intention, executes the order, the PSP will be acting in breach of its duty of care and will also be acting outside the scope of its mandate.

The court highlighted the following factors that, in its view, had put Moorwand “on inquiry”:

• The discrepancy between the description of RND’s business, as stated by the fraudster to Moorwand, and the uses to which money in the account was put, including transactions in bitcoin and the purchase of a watch.

• The material provided by the fraudsters in the account opening process that suggested that the person purporting to act for RND was not the real director. Among other things, the date of birth given for the director was incorrect and there were obvious concerns about the credibility of documentation provided concerning the company’s address.

These factors were sufficient to put the PSP on notice that something was amiss and that further questions should have been asked. Accordingly, the Court held that Moorwand should restore the monies (just under £160,000) improperly paid away from the RND account to the Fraudsters for the use of RND, enabling Mr & MRs Hamblin to claim against RND.

Comment

Without doubt, this case involved an innovative legal approach to seeking recovery. One of the main obstacles for APP fraud victims is that they require permission from the court to bring a derivative claim on behalf of the fraudster’s company. This case illustrates that permission will in certain circumstances be granted.

The case is a significant development in providing a potential route to recovery for APP Push Payment Fraud victims via the derivative action. It highlights the need for PSPs and other financial institutions to exercise reasonable skill and care when processing agent led payment instructions and reinforces the application of the Quincecare Duty in protecting corporate customers from fraudulent activities. Necessarily, this heightened accountability requires additional due diligence will be necessary when handling payment instructions which look to be outside the norm.