APP Fraud – the risks and available protections in the UK and ROI

Home
Knowledge
APP Fraud – the risks and available protections in the UK and ROI

APP Fraud – the risks and available protections in the UK and ROI

{5C90E7B3-0F32-4B09-A2F9-449112F27BCA}

February 21, 2025

Authorised push payment fraud (APP fraud) is growing exponentially – as is its cost to economies and individuals.¹ In this note, we discuss some of the legal issues arising from APP fraud and, in particular, the risk posed by deepfake technology. We also provide a comparison of the current position between the UK and Republic of Ireland.

United Kingdom

Common law and APP fraud

In Philipp v. Barclays Bank UK Plc,² the Supreme Court ruled that the Quincecare duty owed by banks to its customers, where a bank has reasonable grounds to suspect a payment request by an agent of a customer is fraudulent, could not be extended to victims of APP fraud in circumstances where the validity of the payment instruction was not in doubt.

The Supreme Court recognised that APP fraud is a growing problem in society but considered that whether victims of APP fraud should bear the losses themselves, or whether financial institutions should be liable to reimburse them, was a matter of social policy for regulators and legislators and not the courts.

Since Philipp, claimants have tried to reformulate these claims in different ways to circumvent the Supreme Court ruling. In Terna Energy Trading v. Revolut,³ Terna successfully argued that Revolut had been unjustly enriched by funds that Terna was tricked into transferring to a fraudulent account held with Revolut. Instead of pursuing its own bank which received instructions from Terna (possibly due to difficulties in establishing a Quincecare duty breach), Terna pursued a claim against Revolut, despite no direct transfer having been made between the parties. Revolut has been given permission to appeal so it remains unclear whether this could be a viable strategy for future victims of APP fraud.

Another attempt to reformulate a claim was seen in Larsson v. Revolut Ltd⁴ where the victim transferred funds from an account with his Swiss bank to five fraudulent accounts at Revolut. Mr Larsson claimed that as he was a customer of Revolut more generally (but not in this specific transaction) a duty of care was owed to protect him from fraud. This was not accepted by the High Court and the position remains that no duty of care is owed by banks to non-customers in these circumstances. There was a similar scenario in CCP Graduate School Ltd v. National Westminster Bank Plc and Santander UK Plc⁵ where it was argued that the receiving bank had a duty to take reasonable steps to recover the funds paid into accounts controlled by fraudsters even if it had no relationship with the victim (referred to as the "retrieval duty"). The High Court found that this was at least an arguable case, refusing the application for summary judgment and allowing the matter to proceed to trial.

Regulation – mandatory reimbursement

In the meantime, the UK Payment Systems Regulator (PSR) has received powers to introduce a mandatory reimbursement scheme for consumers, charities and micro-enterprises who have been the victim of APP fraud. As of 7 October 2024, all payment service providers (PSPs), save for credit unions, municipal banks and national savings banks, must reimburse customers who have fallen victim to fraud or dishonesty when using faster payments. The reimbursement available will be subject to a maximum amount of £85,000.

Liability to customers who are the victim of APP fraud will be split 50-50 between the sending and receiving PSPs. In certain circumstances, the sending PSPs may charge customers a £100 excess fee, but sending PSPs are not obligated to charge this fee.⁶ The new scheme applies to all UK bank transfers, including those made by CHAPS.

The guidance published by the PSR places the burden of proof on PSPs who wish to refuse to reimburse defrauded customers to demonstrate that a consumer has acted with gross negligence. This might include failing to have regard to specific directed warnings by PSPs before executing a payment, failing to report the APP fraud promptly (and, in any event, not more than 13 months after the last relevant payment was authorised), or failing to respond to any reasonable and proportionate requests for information made by the PSP.⁷

After making a reimbursement claim, consumers should, upon request by their PSP, consent to the PSP making a report to the police on the consumer's behalf or report the details of the APP scam directly to a competent national authority.

In the context of APP fraud perpetuated by the use of deepfake technology, PSPs will need to give some careful thought to the type of warnings they give to consumers. The legal test for gross negligence requires a significant degree of carelessness by the consumer – something that may be very difficult to establish given how convincing some deepfakes can be.

Our colleague, Nick Graham, discusses the risks businesses face as a result of deepfake attacks and how they can seek to mitigate their effects in a previous article here⁸

The role of the FCA

The FCA has previously stated that its aim is to promote the safe and responsible use of AI in UK financial markets while ensuring parties can leverage the developing technology in a way that drives beneficial innovation.⁹ Following the changes introduced by the Payment Services (Amendment) Regulations 2024 (including the ability for PSPs to delay outbound payments suspected of fraud by four business days), the FCA has released updated guidance on its role under the Regulations.¹⁰ This includes guidance that PSPs should take into account assessments made using AI technologies to prevent fraud but also minimise the impact on legitimate payments.

The FCA's rules do not usually mandate or prohibit specific technologies, but its guidance suggests that products/services must take into account the risks associated with AI technology, such as deepfakes, and to take action to prevent fraud for customers.

Ireland

APP fraud is now one of the most common types of financial fraud in Ireland and there are growing concerns about fraudsters using AI and deepfakes convincingly to replicate voices and images. One study showed that 82% of the Irish population are targeted by fraudsters at least once a month, with the most common form of fraud being calls, texts or emails. The Banking & Payments Federation Ireland's initiative to raise awareness about financial fraud showed a 25.6% jump year-on-year in APP fraud in Ireland in the first half of 2023.

The courts in Ireland have recognised the Quincecare duty but, unlike in the UK, have not yet ruled on whether it can be extended to victims of APP fraud. It is possible that the courts in Ireland might hold that a bank is liable to compensate an APP fraud victim where it is "put on inquiry" to the fraud, such as where a series of large transfers are made overseas which are out of kilter with the customer's historical use of the account.

Unlike the UK, there is currently no statutory right to compensation for victims of APP fraud. The European Commission, however, proposed amendments to the Second Payment Services Directive in June 2023. The proposals included provision for a right to compensation for certain types of APP fraud, including "spoofing" where somebody impersonates an employee of the bank (for example, by using deepfake voice technology). A refund would not be allowed in cases of "gross negligence" by the victim, including falling victim more than once to the same kind of fraud, and the "spoofing" would have to be convincing, such as replicating the bank's exact email address or phone number. It is likely that the repayment obligation will be wider than this when the legislation is enacted and the EU Committee on Economic and Monetary Affairs (ECON) has proposed expanding the scope of "spoofing" fraud to include cases where the fraudster also impersonates "any other relevant entity of a public or private nature" among other suggested changes. The European Parliament voted to adopt ECON's suggestions in May 2024 but, as at the time of writing, the legislative proposals remain at the stage of inter-institutional negotiations.

It would seem therefore that the increased use of convincing deepfake technology will make it more likely that the right to compensation would apply under the proposed new compensation regime.

Another avenue a fraud victim may pursue in Ireland to get compensation from their bank is to make a complaint to the Irish Financial Services and Pensions Ombudsman (FSPO). The FSPO has a wide jurisdiction and can hear complaints relating to alleged service failings by a bank in dealing with a customer who is a victim of fraud. For example, in one recent FSPO case, an elderly lady sent a total of €82,000 to a care worker abroad, as a result of an ad she had seen online which she subsequently realised was a scam. The victim's bank refused to repay her as she had authorised the payment herself. She argued before the FSPO that the bank never queried why an 80-year-old woman was sending so much money, so often, to a very distant country. After mediation, the bank agreed to refund her money.

Conclusion

Jurisdictions are taking varying approaches to the battle against APP fraud as courts, legislatures and regulators grapple with the question of how best to respond to this growing problem. AI deepfakes are likely only to add to the challenge.

In the meantime, banks and other financial institutions will need to put robust measures in place to ensure that they can react to the new risks and threats that the technology presents.