APP fraud, Electronic Money Institutions, derivative claims and Quincecare: more questions than answers in Moorwand v Hamblin

The Court of Appeal has both provided guidance on, and raised important questions in relation to, how the Quincecare duty interacts with APP fraud, derivative claims and modern crypto-wallet and payment providers in Moorwand v Hamblin [2026] EWCA Civ 942. Notably, the case identifies a route by which some authorised push payment (“APP”) fraud victims might get around the limitations the Supreme Court placed on the Quincecare duty in Philipp v Barclays Bank UK plc [2023] UKSC 25.
 

Background

The Quincecare duty

The Quincecare duty takes its name from Barclays Bank plc v Quincecare Ltd [1992] 4 All ER 363, where the Court held that a bank's duty to execute a customer's payment instructions promptly is subordinate to a duty to refrain from doing so where the bank is "put on inquiry" (meaning it has reasonable grounds, short of proof) for believing the instruction is an attempt to misappropriate the customer's funds.

The duty was refined by the Supreme Court in Philipp, where the Court found that:

1. banks owe a general duty to act with reasonable skill and care in executing instructions, but this is limited to ensuring the instructions are properly carried out, not to second-guess the customer’s decisions;

2. the Quincecare duty is an application of this duty and arises in the context of instructions from agents of the customer. Banks must make inquiries if they have reasonable grounds to suspect an agent is attempting to defraud the customer; and

3. the Quincecare duty does not extend to the customer themself. A bank is contractually obliged and under a strict duty to execute valid payment instructions from its customer. There is no duty (or right) to question payment instructions from the customer, even if the customer is being deceived by a third party.
     

APP Fraud

Authorised push payment (APP) fraud is where a fraudster deceives a victim into knowingly and voluntarily instructing their own bank to transfer funds to an account the fraudster controls, as distinct from "pull" fraud where money is taken from an account without the holder's authorisation. As mentioned above, because the victim has personally and unequivocally authorised the payment, the Supreme Court in Philipp held that the victim's own bank owes no Quincecare duty to refuse or query the instruction, leaving redress for APP fraud largely a matter of social and regulatory policy rather than a private law claim against the sending bank.
 

The Case

The facts

RND Global Ltd ("RND"), a shell company incorporated using a stolen identity, opened electronic money accounts with Moorwand Ltd (“Moorwand”), an FCA-regulated Electronic Money Institution (“EMI”) offering multi-currency and Bitcoin wallets. Mr and Mrs Hamblin were persuaded by a fraudster posing as an FX trading specialist to pay £160,000 into RND's Moorwand account. Within ten days, the bulk of that sum had been paid out as Bitcoin purchases and to two other payees, including a luxury watch dealer. RND was ultimately dissolved and struck off but later restored to the register so that the Hamblins could bring a derivative claim in RND's name against Moorwand. The Hamblins argued that, on account of the fraud, RND held the £160,000 on constructive trust for them and accordingly that they could bring a derivative claim via RND against Moorwand. As the Hamblins were not Moorwand's customer, a derivative action was the only route by which they could bring a claim against Moorwand. The Hamblins also alleged that Moorwand had breached its Quincecare duty by processing the onward payments without making further enquiries despite being “on inquiry”.
  

The route through the courts

The trial judge upheld that the Hamblins could bring a derivative claim via RND against Moorwand and it was undisputed that Moorwand owed a Quincecare duty to RND. However, he dismissed the claim, finding that the payments used the agreed communication channels, appeared unremarkable on their face and that accordingly Moorwand had not been put on inquiry. This was despite some evidence that Moorwand's onboarding of RND had fallen short of anti-money-laundering standards. On appeal, Mr Justice Marcus Smith overturned that judgment, holding that the trial judge had wrongly treated the onboarding failures as automatically irrelevant to the Quincecare analysis (the “ipso facto” issue), and had wrongly elided the fraudster with RND itself rather than treating RND as an innocent victim of its own agent's fraud, contrary to the principle in Singularis Holdings Ltd v Daiwa Capital Markets Europe Ltd [2019] UKSC 50 that a dishonest agent's knowledge is not to be attributed to an innocent corporate principal (the “agent/principal” issue). He ordered Moorwand to re-credit the account. Moorwand appealed to the Court of Appeal.
  

The Court of Appeal's decision

The Court of Appeal restored the trial judge's decision. On the agent/principal issue, it held that the trial judge had not, in fact, made the error of attribution the High Court had identified. It found that he had not treated the fraudster's conduct as RND's own conduct, but had correctly asked only whether Moorwand was put on inquiry that the instructions were given without RND's authority (and answered in the negative). On the "ipso facto" issue, the Court of Appeal accepted that it would constitute a legal error to treat facts underlying regulatory or anti-money laundering shortcomings as being, without more, incapable of bearing on the Quincecare analysis. However, it concluded that the trial judge had not in fact reasoned in this way. The Court of Appeal found that the trial judge had taken the onboarding deficiencies into account but had nevertheless reached the conclusion that they did not give rise to reasonable grounds for suspecting that funds were being misappropriated from RND.

Having found that neither error of law identified by the High Court had in fact been made, the Court of Appeal applied the well-established and high threshold for interfering with a trial judge's evaluative assessment, which was not met. The trial judge's original conclusion, that Moorwand was not put on inquiry and therefore had not breached its Quincecare duty, was restored. It is worth noting that the Quincecare duty itself was not in dispute on this appeal, and its application to a payment services provider such as Moorwand was therefore also not in issue.

Interestingly, some of the most significant parts of this judgment arise from what the Court of Appeal did not decide but which it actively commented upon and ultimately left open for another day.
   

Derivative claims: a route around Quincecare in cases of APP fraud?

Philipp established that a bank's customer who has personally and unequivocally authorised a payment cannot bring a Quincecare claim against its own bank, because the Quincecare duty exists only to protect a customer from instructions given without its authority, not to protect a customer from the consequences of its own free choices. By leaving undisturbed the finding that a derivative claim could be brought in RND's name, the Court of Appeal left standing a mechanism by which an APP fraud victim might, in effect, sidestep that limitation. If the Hamblins had been the named customer they would not have been able to sue Moorwand. But

the Court of Appeal left open the possibility that the Hamblins could bring a claim by standing in the shoes of the fraudster's corporate vehicle, relying on that company's own Quincecare rights and a constructive trust over the funds it received. If confirmed in a future case, the result would be that the availability of a remedy for APP fraud victims may turn on the happenstance of how the fraudster structured the receipt of funds. Specifically, whether the proceeds were channelled through a corporate entity rather than through a personal account. This is a point of real significance for the wider payments and fintech sector. The trial judge himself recognised that the derivative mechanism might allow the Hamblins to "get around" the legal barrier which Philipp otherwise imposes on APP fraud claims of this kind.
   

A derivative route can outperform a tort claim

On the basis of the findings of this case, bringing a derivative action could also significantly out-perform a personal claim in tort:

• first, because the underlying cause of action is the company's debt claim for restoration of its account (underpinned by the constructive trust), the claimant is not competing as an unsecured creditor in the event of the company's insolvency. The proprietary claim secures priority;

• second, there would be no reduction for contributory negligence. However imprudent the claimant's own conduct may have been in falling victim to the fraud, this is irrelevant to a claim brought by the company in debt; and

• third, the claimant is not required to demonstrate that the payment service provider had knowledge that it was holding trust property or assets applied in breach of fiduciary duty.
    

The Quincecare duty potentially applies equally to modern payment institutions - but when it bites remains fact-sensitive

The case proceeded, unchallenged, on the basis that the Quincecare duty applies to an EMI offering crypto wallets in the same way as it would to a high street bank. As the Court of Appeal itself noted, this point was not in dispute on the appeal and so was not tested or decided by the Court. What remains unresolved is precisely when a modern payment provider is "put on inquiry" for the purposes of the duty. The decision turned on a factual evaluation carried out by the trial judge, and offers limited generalisable guidance beyond confirming that regulatory and AML shortcomings at onboarding are relevant background, even if they are not determinative.
  

The application of Quincecare to automated transfers remains open

The Court of Appeal drew attention to the fact that the leading authorities on the Quincecare duty (Quincecare itself, Philipp, and Singularis) all concerned payment instructions communicated through direct human interaction (whether by telephone, in person, or through named bank personnel). In this case, however, the manner in which the fraudster's instructions were received and processed by Moorwand was never established at trial, and no party advanced submissions as to whether or how the duty would operate where payments are executed without human involvement. The Court of Appeal accordingly declined to express any view on whether the Quincecare duty applies at all to automated payment processing, or on what supervisory or monitoring systems (whether algorithmic or otherwise) might be required to discharge the duty in that context. The related question of how a payment's deemed authorisation under the Payment Services Regulations bears on the Quincecare duty was left open for the same reason. These important questions therefore fall to be answered in another case.
  

Other issues left for another day

The Court did not need to resolve several further questions raised by the facts, including:

• whether the directors of a company set up as a vehicle for fraud from the outset would lack actual authority to instruct transfers (because the dispersal itself constitutes a fraud on the company);

• whether (in the same case) a payment service provider can rely on contractual warranties given by a customer as to the legitimacy of its business to defend such a claim (by way of an illegality or circuity defence); and

• how a derivative claim of this kind would operate where the customer seeks damages rather than simple restoration of its account.

However, these are all key questions which may well be answered in the coming years given the prevalence of APP fraud.
   

A costly reminder

The judgment closed on a sobering note about disproportionate costs, recording that the parties' combined costs of the trial and two appeals were estimated at around £1 million, roughly seven times the £160,000 originally in dispute. For a case that ultimately turned on a small number of findings of fact, it is a stark reminder of the price of litigating a relatively modest sum through every available tier of appeal - a warning that lawyers and litigants alike would do well to heed before considering whether to return to the fray.