Triggering PSPs’ Quincecare duties in APP fraud cases: The ‘derivative claim’

In Hamblin and another v Moorwand Ltd and another company [2025] EWHC 817 (Ch), the High Court found in favour of victims of an authorised push payment (APP) fraud. The victims brought a derivative claim against a payment services provider (PSP) for breaching its Quincecare duty to its corporate customer, and the High Court ordered the PSP to reinstate the funds it paid out from the corporate customer’s account. Banks and PSPs should take note of this decision as it opens up a new route for APP fraud victims to bring a claim against them for breaching their Quincecare duty, a novel development following the narrowing of the duty under Philipp v Barclays Bank UK PLC.

Background

The Appellants, Mr and Mrs Hamblin, were victims of an APP fraud. They were induced to pay £160,000 to an account of the now-insolvent RND Global Ltd (RND) held with the PSP, Moorwand Ltd (Moorwand).

Moorwand subsequently paid the money away pursuant to payment instructions given by RND. These instructions were in fact given by a fraudster impersonating RND’s agent (“Mr Stanfield”). There were a number of factors which suggested Mr Stanfield was being impersonated, and the central question was whether Moorwand had been “put on inquiry” under its Quincecare duty to investigate the validity of those instructions.

The Appellants commenced proceedings against Moorwand and RND, pursuing both (a) a claim in their own right and (b) a derivative claim on behalf of RND against Moorwand (the Derivative Claim). The first instance judge dismissed both claims.

The Appellants then sought to appeal the first instance judge’s decision on the Derivative Claim and brought another derivative claim on behalf of RND, contending that the judge had “wrongly held that RND had consented to the withdrawals from the account for the purposes of Regulation 61 of the Payment Services Regulations 2009” (the Payment Services Claim).

The Issues

Marcus Smith J considered three main issues in this judgment:

1. whether the first instance judge was correct to dismiss the Derivative Claim;
2. whether the exclusion clause in the terms of business between RND and Moorwand excluded the Derivative Claim; and
3. whether the judge was also right to dismiss the Payment Services Claim.

Issue 1: appeal on the Derivative Claim

Smith J allowed this appeal and ordered Moorwand to restore the monies (just under £160,000) back to the RND account for the use of RND.

He first established that principles from Philipp applied here because of the APP fraud context. However, the “facts concerning the APP fraud are altogether irrelevant for the purposes of this appeal” (emphasis added).

Smith J then held that the first instance judge erred in equating RND’s agent with RND itself. The knowledge of a fraudulent director cannot be attributed to their corporate principal, so RND was in fact an “innocent principal” defrauded by its agent. Its agent was later found not to be involved at all and was a victim of identity fraud himself.

Smith J also held that the first instance judge wrongly discounted a number of red flags relating to the actions and identity of RND’s agent. Transfers were made from the RND account to purchase bitcoin and a luxury watch, both of which were inconsistent with RND’s stated business. The single joint expert at the first instance hearing stated that these transfers should have “triggered [Moorwand’s] suspicions of money laundering” and led to the cancellation of the transfers. There was also evidence that Mr Stanfield was impersonated, including his incorrect birthdate on RND’s Companies House page, a wrong home address given to Moorwand, and a utility bill given for proof of address that had an entirely different name on its face.

Taking these factors into account, Smith J held that Moorwand was “put on inquiry” and its Quincecare duty was engaged. This meant it had to satisfy itself that “the payment instruction it was receiving from Mr ‘Stanfield’ were proper and not in fraud of RND”. Moorwand, having made no inquiries as to the actual authority of RND’s agent, exceeded its own authority to debit the account and was therefore liable in debt to reinstate the account.

Issue 2: the exclusion clause

Having established that the Appellants had a valid Derivative Claim, Smith J then considered whether this claim would nevertheless fail based on the exclusion clause contained within the agreement between RND and Moorwand, which provided:

“IN NO EVENT SHALL COMPANY OR ANY PERSONS OR ENTITIES ASSOCIATED THEREWITH BE LIABLE FOR ANY DIRECT, INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN ANY WAY CONNECTED WITH THIS AGREEMENT OR THE SUBJECT MATTERS HEREOF (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, OR LOSS OF BUSINESS INFORMATION) EVEN IF COMPANY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES” (emphasis added).

Smith J held that a claim for breach of mandate is a debt claim, which requires a PSP to reconstitute the company’s bank account. Since the Derivative Claim was “not a claim that sounds in damages”, the exclusion clause did not apply to this claim. Moorwand was required to reconstitute RNB’s account because of the breach of its mandate. Indeed, reading the clause such that it extended to protect Moorwand from any obligation to reinstate the account, would render Moorwand’s mandate “meaningless”.

Issue 3: appeal on the Payment Services Claim

The Appellants also made a claim under Regulation 61 of the Payment Services Regulations 2009, SI 2009 No 209 (the PSRs) and argued that Moorwand breached Regulation 55 of the PSRs by making the unauthorised payments out of RND’s account.

Smith J dismissed the Payment Services Claim and refused permission to appeal on this point. He held that the PSRs concerned “transactional speed and efficacy” and had nothing to do with the Quincecare duty under Philipp. These regulations imposed “purely mechanical requirements” on the PSPs to execute instructions swiftly, and Moorwand “punctiliously observed” the payment instructions. Their observance of these instructions did not, however, absolve them from their duty to inquire.

Key Takeaways

• APP fraud continues to be a significant risk for customers and Hamblin is a rare example of a Quincecare duty claim succeeding.
• This case provides a new route for claimants to bring an action against banks and PSPs for breach of their Quincecare duty. APP frauds typically do not engage this duty as it only arises where instructions are received by an agent under circumstances that should arouse suspicion, rather than directly from the account holder.
• One concern that APP fraud victims may have with bringing a derivative claim against a bank or PSP is that the remedy goes to the company rather than the claimant themself. As an unsecured creditor of the (most likely insolvent) company, the claimant may be discouraged by their lower ranking in the payment waterfall compared to the company’s other creditors and decide not to bring a derivative claim at all. However, companies like RND which have been set up to effect APP fraud may not have that many creditors that rank ahead of the claimant to begin with. As a result, the derivative claim route may still be a viable option for claimants to seek recovery for APP fraud through, even if it appears unappealing at first.
• A derivative APP claim is not a claim which sounds in damages but is one which obliges the PSP or bank to restore or correct the balance in the account. As a debt claim, claimants do not have to be concerned about issues of causation of loss and mitigation. In this case, it also fell outside the scope of the exclusion clause which applied to claims in damages only. Banks and PSPs should therefore examine the scope of their exclusion clauses.
• However, it is important to note that the permission given by the first instance court for the Appellants to pursue a derivative action was never under appeal itself. Obtaining permission to bring a derivative claim is likely be a challenge future claimants will need to overcome when seeking similar recourse for APP fraud.
• The Respondent applied in May 2025 for permission to appeal. If granted, it will be interesting to see if a superior court takes a similar approach.

Other related articles

To read more about APP fraud, you can find our civil fraud update for Spring 2025 here.

To read more about Philipp v Barclays, you can find our case digest here and our commentary on its impact on the scope of the bank-customer relationship here.

With thanks to Chee Ling Wu for her assistance with this post.