In the recent decision in Hamblin v Moorwand [2025] EWHC 817 (Ch), the High Court allowed the victims of an authorised push payment (APP) fraud to assert a derivative claim on behalf of the shell company to which they had sent money, against the payment service provider (PSP) that facilitated the payment. 

This is an interesting development in attempts to use the Quincecare duty to recover funds lost through APP fraud. We have previously commented on the mixed success of victims who assert Quincecare claims against their banks for processing instructions to pay a fraudster. In Philipp v Barclays Bank UK Plc [2023] UKSC 25, the Supreme Court found that banks do not owe a duty to refrain from executing customers’ direct payment instructions where there may be an attempt to defraud the customer. 

The use of a derivative claim on behalf of the shell company that received the funds in this case may present a useful work around for victims of APP fraud in future cases to seek recourse against PSPs that facilitate the fraud. This could be especially useful to victims where the value in question exceeds the Payment Systems Regulator’s mandatory reimbursement threshold.

Background

Hamblin involved an APP fraud in which approximately £160,000 was paid into, and swiftly dissipated from, an electronic wallet account held by RND Global Ltd (RND) with Moorwand Ltd (Moorwand). 

RND was used as the shell company to perpetrate the fraud. RND opened an account at Moorwand using the identity of an individual who had separately been the victim of identity fraud and who was held out as the RND individual from whom Moorwand would be authorised to take instructions. In account opening documents, RND described itself as a marketing consultancy. Documentation provided by RND during the account opening process raised concerns internally at Moorwand, including in relation to documentation that was incomplete or deemed suspicious. However, Moorwand opened RND’s account without resolving these red flags. 

The Hamblins paid RND on the false premise of participating in a legitimate investment opportunity. The majority of the funds received by RND were converted into Bitcoin. The remainder was paid to other recipients, including, for example, for the purchase of luxury goods. 

RND ended up in administration and did not participate in the proceedings. The Hamblins brought a derivative claim on RND’s behalf to recover their funds from Moorwand. The claim was made on the basis that Moorwand had executed payment instructions in breach of the Quincecare duty it owed to RND. The Quincecare duty would require Moorwand not to execute client instructions if it were on notice that the person giving the instruction may be defrauding the client. The Hamblins said Moorwand breached this duty by executing the instructions purportedly provided by RND to transfer the Hamblins’ funds out of RND’s account.

The derivative claim

The Court found that Moorwand was liable to restore the Hamblins’ dissipated funds to RND’s account. Moorwand had been put on inquiry during the account opening phase about a possible fraud or misconduct relating to the instructions it received to transfer funds out of RND’s account. In those circumstances, it should have undertaken further investigation before debiting RND’s account. Its failure to do so was a breach of the Quincecare duty.

The judge’s analysis was that RND itself had not consented to the dissipation of funds from its account (i.e., for conversion to Bitcoin and payments for luxury goods). These instructions had not properly been provided on RND’s behalf. Instead, the payment instructions had been provided by an imposter masquerading as the individual whose identity had been used to set up the account, and who lacked authority to provide instructions on behalf of RND. 

Once concerns had been raised internally at Moorwand, it should have stopped any payments until it had ascertained that the instructions had been genuinely authorised. Instead, Moorwand had overlooked various red flags, including: (i) the mismatch between RND’s stated business as a marketing consultancy and the transactions that were instructed; and (ii) the issues raised at account-opening regarding incomplete or suspicious documentation. By conflating the fraudulent agent’s knowledge and actions with those of RND itself, Moorwand failed properly to recognise that RND had not consented to the relevant payments. 

In these circumstances, the Court found that Moorwand should never have debited RND’s account. As a result, Moorwand is obliged to reimburse the funds to RND’s account. 

Moorwand had also sought to rely upon an exclusion clause in its terms and conditions that excluded liability for any damages arising out of the relationship between Moorwand and RND. However, the judge explained this clause was only capable of excluding claims for damages – it could not bite on a claim to reinstate funds to RND’s account that were improperly paid away. As a result, Moorwand was ordered to restore to RND the monies fraudulently dissipated from RND’s account. The Hamblins will then need to try and recover those monies from RND through its administration process. 

Comment

This case demonstrates a creative use of a derivative action to recover funds that have been lost to fraud. It is a mechanism that victims of fraud should keep in mind in future where shell companies have been used to facilitate fraud. It serves as a reminder to PSPs that when put on inquiry of potential wrongdoing, proper investigations must be undertaken to confirm the accuracy of payment instructions provided on behalf of companies. Even where the fraudsters themselves have set up a shell company for the purpose of receiving funds, PSPs owe duties to those companies not to action payment instructions in furtherance of fraud.