Tackling Push Payment Fraud

Syedur Rahman of Rahman Ravelli outlines push payment fraud and the value of pursuing injunctions in such cases.

Push payment fraud – also known as authorised push payment fraud or APP fraud – is a crime that has developed and flourished in tandem with the internet and modern banking practices. It is a means by which individuals are deceived into sending money to another. They believe that other person to be genuine and so they authorise a payment to them. That money is then swiftly moved in and out of various accounts – many of which are often abroad – making it hard for the deceived individual to retrieve it.

Push payments involve someone who intends to pay money (the payer) obtaining the account details of the person or company they wish to pay money to (the payee) and instructing their bank or other payment service provider to send money to that payee. Push payment fraud occurs when those looking to perpetrate the fraud attempt to persuade a payer to arrange a transfer from the payer’s account to their account. This can be done in a variety of ways but it will usually involve those committing the fraud posing as an individual – such as a friend or relative – or a business to whom the payee would be expecting to pay money. It is a type of fraud that has become common due to the hacking of emails and use of personal data, such as that on social media, which gives those looking to commit fraud the information they require to successfully impersonate someone who is known to the payer who may be expecting a payment.

The Use of Freezing Orders  

A freezing order is an injunction that prevents someone from disposing of or dissipating assets. They are most commonly obtained when a claimant or potential claimant wants to make sure that the assets of a potential defendant – such as the contents of bank accounts, shares or property - are not disposed of or made difficult to locate before any court judgement can be enforced.

While they can be a vital tool in ensuring a defendant does not hide or dissipate any assets that are the subject of legal action, a court will only issue one if various conditions are met.

Further reading: Freezing Orders - An In-Depth Guide.

In order for a freezing order to be issued:

• the applicant must have a substantive cause of action against the respondent (the potential defendant)
• the applicant must have a good arguable case
• there must be a real risk of the assets being dissipated 
• it must be just and convenient to grant the freezing order, taking into account the applicant’s conduct, the rights of any third parties who may be affected by it and whether it would cause legitimate and disproportionate hardship for the respondent.

World Proteins Kft v Persons Unknown [2019]

In this case, the claimant company received two genuine invoices and a number of genuine emails regarding outstanding payments, which were from one of its regular suppliers. But the email account of the supplier was hacked by an unknown individual who then sent fake emails claiming to be from the supplier. These fake e-mails included a chain of the previous emails relating to invoicing, claimed that the supplier now had a new bank account with Barclays and requested that outstanding payments of €1.5M and €500,000 be made to that account. 

The company made the payments. When it realised it had had push payment fraud perpetrated against it, the company was able to recall the transfer for the €1.5M. But it was not able to recall the €500,000 – so it issued an urgent claim for the €500,000 and applied for a freezing injunction for bank accounts of those that committed the fraud. Following the case of CMOC v Persons Unknown [2017], the court granted an urgent interim freezing injunction. The company had met the elements required for the freezing injunction, as there was an obvious fraud, an arguable case against the person unknown and an obvious and real risk of dissipation of the money. The name of the person committing the fraud was unknown initially but could be identified as the beneficiary of the bank account. And any future issues regarding identification of that person – such as for notifying them of the injunction and its penal notice - would apply equally on any kind of injunction, so there could be no reason not to extend this to freezing orders. Granting of injunctive relief against persons unknown is also logical when it comes to push payment fraud, as those committing are usually unknown because they are hackers. 

The Barclays account, which still contained €350,000, was frozen once the injunction was granted. Disclosure of bank records led to the identification of the person perpetrating the fraud and his UK address, meaning he could be added as a known defendant to the substantive claim. A few weeks after the freezing injunction hearing, the High Court granted default judgment in the claimant’s favour. All sums held by the respondent as a result of his fraud had to be returned to the claimant within 14 days. This outcome was a direct result of the freezing of the assets and the identification of the person who committed the fraud. The freezing injunction (and ancillary orders) against persons unknown had been a precursor to the matter being resolved via default judgment. 

Significantly, the High Court made a number of points which will be of significance to claimants in the future: 

• The principles as set out in Goldcrest Distribution Ltd v McCole & Ore [2016] EWHC 1571 were emphasised, in that it would not be right for the court to hold that declaratory relief could never be given on default judgment. The better rule is that declarations should not be given without inter partes argument except in the clearest of cases. 
• ‘The clearest of cases’ could include cases that were less clear-cut than the instant scenario. 
• The default judgment application had been properly notified to the respondent and he had not replied to it – and it would be disproportionate and unnecessary to expect the claimant to jump through further legal hoops before obtaining an order to be recompensed. 
• Even if the funds had been mixed with other monies this did not rebut the presumption that those funds did belong to the applicant – and an argument against this would have to be proved by a respondent. 

This case (and the earlier CMOC case) can be taken as a clear indicator of both the courts’ understanding of push payment fraud and the scope they have for offering a remedy to those who have had it committed against them - even when there is the issue of initial anonymity and the appearance that a payment has been made voluntarily. Swift injunctive action can, therefore, be a useful tactic even when the identity of the respondent may not be known.

Those who work in or regulate the financial services industry are increasingly aware of the problem of push payment fraud and are taking steps to tackle it. But those who feel they have been targeted by those who perpetrate it should conduct an internal investigation to identify how it has been able to happen. Once a push payment fraud has been confirmed, the police and / or the appropriate regulator should be informed, along with any interested parties or relevant professional bodies.

It should always be remembered that it can be worth requesting an order from the court requiring a disclosure of assets to be provided by those suspected of the fraud. Using the civil law to “put right the wrong’’ can be an effective tool. Issues such as negligence, breach of contract, breach of trust or unjust enrichment could provide the grounds for civil action. Seeking advice on asset tracing and recovery should also be considered, as it may often be the most effective route to recouping any losses cause by push payment fraud.

This article was also featured on Lexology.com.